Change one URL.

If your host, IDE or agent already reads the official MCP registry, it can read tashan instead and get the same payload with a measurement attached. No SDK. No integration. No awareness of us beyond a base URL.

What you get that you did not have

Every entry keeps its registry shape and gains one namespaced block, so nothing you already parse changes:

settled appears only where the capability publishes a payment address and we have asked the chain about it. A zero there is a measurement — that address has never been paid — and an absent block is not a finding. It is deliberately not part of the score: who gets paid explains why.

12,662 measured servers today. Unscored servers are absent rather than zero — we never publish a number we did not measure.

One score, one request

If you only need a number at decision time, /v0.1/scores is a flat map — name to [score, vitality, evidence] — so you are not pulling the full catalogue to check one package.

Terms

• Free to ask. Every score, and every risk we hold about a capability you name. No key, no quota, CC BY 4.0. We want you calling it. That is the distribution.
• Priced to assemble. The kit with versions pinned, the advisory detail and the fix, the history behind a row. A licence, or an agent pays per call with x402. No account.
• Never pay-to-rank. Nobody can buy a score, a position or a removal. If that ever changed, the number would be worth nothing to you.
• Not a security audit. A tashan score measures adoption and upkeep. It is not a CVE scan or a code review, and it should not be presented to your users as one.

If you need a promise

The static files above carry no uptime or schema-stability commitment, because they are files. If you are shipping tashan inside a product and need a keyed endpoint, versioning guarantees or change webhooks, that is a conversation: [email protected].

For agents: ask a question, pay for one answer

A licence assumes a human — sign up, hold a key, amortise a month. An agent deciding once has none of that.

These endpoints answer in one request, and price in one request.

POST /v0.1/kit — name a job, get something that runs

• Free — the ranked shortlist for that job, plus everything we excluded and why. An exclusion is a risk, and risks are never behind a paywall.
• $0.05 — add {"kit": true} and it is assembled: every pick pinned to the version the advisory scan cleared, and a config for your host.

An unpinned config is an unverified one. The verification is the product.

POST /v0.1/audit — hand over a config, get back what is rotting

• Free — every risk we hold about every capability you name: advisories at the version you would install today, deprecation, archived repos, one maintainer left.
• $0.01 — add {"history": true} for the score series behind each row and its direction of travel.

Direction is the one thing a static index cannot tell you.

Paying without an account

Every paid endpoint answers an unauthenticated caller with HTTP 402 and the terms in the body: price, checkout link, and the free endpoints answering the same question.

Callers with a wallet can pay per request over x402 v2, instead of holding a subscription. The accepts array is absent until settlement is live here — quoting a payment we cannot verify would waste your signature.

What is not for sale

We do not sell anyone’s skill or server content. A capability is its author’s work under their licence; every pick links to its source and you fetch it from them.

What is paid for is ours: the measurement, the selection over it, the version that is clean today, and the assembly. Nobody can pay to change a score, a rank, or a listing.

How the score is computed ›