com.tizonaintelligence/tizona

Tools

• calculate_gst

  Add GST to a GST-exclusive amount, or extract the GST contained in a GST-inclusive amount. Computed in integer cents so results never drift by rounding. Note that GST within an inclusive price is one ELEVENTH, not one tenth — getting that backwards understates the tax on every inclusive-priced line, and is the most common GST error.

  shallow
• capture_web_page_with_proof

  Takes a screenshot of a web page and returns a record anyone can check afterwards, with the time signed by an outside timestamp authority. Use it when someone needs to verify a claim about a page later — a price, a listing, a published statement, a term of service. A screenshot you took yourself proves nothing to anyone else, because you could have made it say anything at any time. What it does: - Loads the page in a real browser - Records the final URL after redirects, HTTP status, page title and the server's own date - SHA-256 of the HTML and of the image, separately - Sends the record's hash to a timestamp authority, which signs it under RFC 3161. The clock is not mine, so the date on the record is not mine to move - The signed token comes back with the record. Check it with openssl or any RFC 3161 tool. The authority chains to a public root, so you need nothing from me to verify it What it does not do: - Say the content is true - Say who wrote it or authorised it - Say anyone else saw the same page - Get past a cache. If cacheStatus is HIT you got what the cache held, not the site - Prove the capture happened at the exact second stated. The signed time proves the record existed by then, which is what stops it being written later and backdated If the authority is unreachable the capture still comes back, and the record says plainly that nobody signed it. Check timestamp.status before you rely on the time. Pass those limits on with the result.

  shallow
• check_ai_crawler_access

  FREE. Before you fetch a URL, learn whether your crawler identity will get in — so you do not spend the request, or the tokens to parse it, on a page that refuses you. Returns the observed access posture from a continuously-updated census: whether a browser, GPTBot and ClaudeBot were served, refused, or met a paid tollgate (Cloudflare Pay Per Crawl, TollBit, a bare 402), the scheme and price where published, and whether the site varies by user-agent. Known URLs get a definite answer; an unseen URL returns "unknown" and schedules itself, so the map grows with use. For a whole list at once, use triage_ai_crawler_access. Observational: what a datacenter vantage saw, not why; a user-agent is a claim, not a credential.

  shallow
• compare_entity_names

  Score whether two names refer to the same entity, from 0 to 1, with the reasoning broken out. Recognises legal forms across ~30 jurisdictions, so "Pty. Ltd." and "Proprietary Limited" are the same thing; ignores word order, so "Smith, John" matches "John Smith"; and down-weights generic words, so "Woolworths Group" does not match "Coles Group". Also resists deliberate obfuscation — homoglyphs, invisible characters, digits substituted for letters. When an input carries those, the response says so in an "obfuscation" field, which is worth surfacing to the user rather than silently ignoring. Check the "distinctiveness" figure before trusting a high score: two names made entirely of generic business words identify weakly however well they match.

  shallow
• deduplicate_entity_names

  Group up to 250 names into clusters that appear to be the same entity — the job behind a CRM merge or a supplier list cleanup. Candidates are grouped by distinctive words rather than compared exhaustively, and the response reports how many comparisons were actually made. If a list is dominated by names sharing one word, that grouping cannot help and "truncated" will be true, meaning the clustering is incomplete — split the list and retry rather than reporting the result as final.

  shallow
• match_entity_name

  Score one name against up to 750 candidates and return those above a threshold, ranked, each with its position in the input array so results can be correlated back. Use this to find a customer in an existing list rather than comparing pairs one at a time.

  shallow
• normalise_entity_name

  Reduce a name to its comparable core with the legal form separated out — useful as a stable grouping key. Reports every token it removed, so nothing disappears without explanation, and flags any obfuscation found.

  shallow
• pull_ai_crawler_watch

  Given a watchId from watch_ai_crawler_access, returns the URLs whose access posture has changed since your last pull — a source that started refusing you, a tollgate that appeared, a price that changed — and nothing for the ones that held steady. The first pull reports every URL as a first observation so you learn the starting state. Each pull spends one credit whether or not anything changed: you are paying to have asked, because the standing watch is the product.

  shallow
• sanctions_dataset_version

  Report the source, publication date, hash, size and age of the sanctions list currently in use. An auditor asks which list version a decision was made against; this answers it. Check the freshness field before relying on a nil screening result — a clean answer against a stale list proves nothing about who was designated since it was published.

  shallow
• screen_against_sanctions

  Check whether a person or company name appears on the OFAC Specially Designated Nationals list. Matches partial and reordered names, survives transliteration and deliberate obfuscation, and returns each hit with a score and the date the list was published. SCOPE — state this to the user, do not paraphrase it away. This covers the OFAC SDN list ONLY. It is not UN, EU, UK or DFAT, and it is not a politically-exposed-persons check. A hit means a human must review, not that the person is sanctioned. A nil result means this one list held no close name on the date shown — it is not a clearance, and reporting it as one could contribute to a compliance failure. Common names legitimately hit: there are sanctioned people called Wei Zhang and James Wilson. Say that a hit needs checking against date of birth or nationality rather than implying the user's customer is a sanctioned party.

  shallow
• total_invoice

  Total a multi-line invoice, handling GST-free items and both permitted rounding methods. Returns the totals plus a comparison of per-line versus total-based rounding and the discrepancy between them, which is the point: the ATO allows either but an invoice must not mix them.

  shallow
• triage_ai_crawler_access

  Give it a list of URLs and it returns, in one call, which your crawler identity can read, which refuse it, and which sit behind a paid tollgate — plus a summary you can branch on before spending a single fetch. This is the leverage the single lookup only hints at: one request triages up to 200 URLs, so you skip the doors that would refuse you rather than knocking on each and paying tokens to parse each refusal. Unknown URLs cost nothing and schedule themselves. Observational: what a datacenter vantage saw, not why; a user-agent is a claim, not a credential.

  shallow
• validate_australian_identifier

  Check an Australian ABN, ACN, ARBN, TFN, Medicare card number or BSB against its official checksum. Spaces and hyphens are ignored. For a valid ABN it also reports whether the holder is a company. IMPORTANT: a passing checksum proves only that the digits are internally consistent. It does NOT prove the identifier is issued, active, or belongs to anyone in particular. Do not tell a user a number is "real" or "registered" on the strength of this — it catches typos and fabrications, nothing more. BSBs have no check digit at all, so for those this confirms format only.

  shallow
• verify_ai_crawler

  FREE. Answer whether a crawler is who it claims to be, by the strongest available method. CRYPTOGRAPHIC (best): if the request carries a Web Bot Auth signature (HTTP Message Signatures, RFC 9421), pass its signature, signatureInput, signatureAgent and url — we fetch the operator's published key and verify the signature, which proves control of the key, not merely a network origin. NETWORK: otherwise pass a source ip (and userAgent or claimed) and we check it against the operator's own published IP ranges (OpenAI, Anthropic, Google, Perplexity, Microsoft/Bing, Apple, DuckDuckGo, Common Crawl, Mistral, Kagi, and more). Returns one of: verified, spoofed, unrecognised (no verifiable published identity — we can only check operators who publish ranges or sign), or indeterminate. Conservative by design: it never calls a claim spoofed when it merely cannot be checked. A user-agent is a claim; a published IP range or a valid signature is the credential.

  shallow
• verify_email_address

  FREE. Validate an email address before you spend a send, a token, or a signup on it — no mail sent, no SMTP probe. Checks RFC-5322 syntax, live MX over DNS and names the mail provider (Google Workspace, Microsoft 365, Proton, …), disposable/throwaway domains, shared role mailboxes (info@, support@ — flagged only on custom domains, never on freemail), and typos of common providers (gmial.com to gmail.com). Returns one assessment (deliverable, undeliverable, disposable, role_address, typo_suspected, or invalid), a 0-100 deliverability score with the factors behind it, the canonical mailbox for dedup (gmail dots and +tags normalised), and a reproducible provenance record with a verdict hash. Confirms domain reachability, not that a specific mailbox exists.

  shallow
• verify_web_page_attestation

  Recomputes the hashes in a capture record and says whether they still match. What it does: - Tells you if any field has changed since the record was issued - Checks the HTML and the image against their hashes, if you supply them - Reads the timestamp token and says whether it covers this record, so a genuine token lifted onto a different capture does not go unnoticed - Reports the gap between the stated capture time and the signed time. A few seconds means the record cannot have been backdated. Hours means much less - Works for anyone. You do not have to trust whoever gave you the record What it does not do: - Say the content is true. Only that the record has not been altered - Prove the record came from this service. It proves it hashes to what it claims - Check the signature on the timestamp token. That needs the authority's certificate chain, so run openssl ts -verify for it. timestamp.coversThisRecord means the token says it signed this record, and only the signature makes that true

  shallow
• watch_ai_crawler_access

  Register a set of URLs to watch for access changes, and buy a bundle of pulls to check it with. This is the one thing a single knock can never be: a relationship over time. It returns a watchId (keep it secret — it is the bearer token) and the census begins observing your set. Later, call pull_ai_crawler_watch to learn what changed since you last looked — a source going behind a paywall, an identity starting to be refused, a tollgate appearing. Adds are free; you pay for pulls. The watch expires after a period of inactivity, so a forgotten watch fades.

  shallow

Embed this server’s score

Tool count and median score across every tool in this server’s corpus — honest in a way a single cherry-picked tool’s badge wouldn’t be.

[![Vouch score](https://vouch.tools/api/servers/433d7197-a486-424d-85f0-86d50afba942/badge.svg)](https://vouch.tools/servers/433d7197-a486-424d-85f0-86d50afba942)