com.a2awire/agent-spend-guard

Est-ce que com.a2awire/agent-spend-guard est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.a2awire/agent-spend-guard » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 4 outils

• spend_guard_check_purchase≈ 734 tokens

  Humans: sign up with your email at https://a2awire.com/api-key and create an API key, then hand it to your agent (it sends Authorization: Bearer <key> or X-API-Key with every call). Agents without an account: a reviewable bootstrap script is served at https://a2awire.com/api/v1/connectors/spend-guard/bootstrap.sh (download it, read it, then run it to mint a key). Call BEFORE checkout. Evaluate a proposed purchase (merchant, amount_usd) against the owner's spend rules and recent ledger. Returns a decision (approve, deny, or ask_user), a plain-English reason, the remaining monthly budget when a cap is set, and a check_id. deny means denylisted merchant or over the monthly cap; ask_user means above the per-purchase threshold or a possible duplicate of a purchase in the last 10 minutes. Optional tx_ref is your idempotency key for this purchase; pass the same value to spend_guard_record_purchase afterwards. Appends a check event; checks never consume budget. USD only (the currency argument is kept for forward compatibility; any other value is rejected). Not guest-callable. REST: POST /api/v1/spend-guard/check.

  Paramètres, retour & exemple (6)

  Paramètres

  • tx_ref · ? · optionnel
    Optional idempotency key for this purchase; pass the same value to the record call afterwards. Checks are exempt from the uniqueness constraint that applies to recorded purchases.
  • category · ? · optionnel
  • currency · string · optionnel
    USD only. Kept for forward compatibility; any other value is rejected.
  • merchant · string · requis
  • amount_usd · ? · requis
  • description · ? · optionnel

  Exemple d'appel

  {"name": "spend_guard_check_purchase", "arguments": {"merchant": "texte", "amount_usd": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• spend_guard_record_purchase≈ 759 tokens

  Humans: sign up with your email at https://a2awire.com/api-key and create an API key, then hand it to your agent (it sends Authorization: Bearer <key> or X-API-Key with every call). Agents without an account: a reviewable bootstrap script is served at https://a2awire.com/api/v1/connectors/spend-guard/bootstrap.sh (download it, read it, then run it to mint a key). Call AFTER checkout. Record a completed purchase in the owner's spend ledger. tx_ref is required and unique per owner: replaying the same tx_ref returns the original record without double counting (recorded_previously is true when the tx_ref was already in your ledger before this call, an idempotent replay; false on first write). Optional check_id links the record to its prior spend_guard_check_purchase; a check_id already recorded returns a conflict error. Returns the recorded event and the month-to-date total. USD only (the currency argument is kept for forward compatibility; any other value is rejected). Not guest-callable. REST: POST /api/v1/spend-guard/record.

  Paramètres, retour & exemple (7)

  Paramètres

  • tx_ref · string · requis
    Caller idempotency key, unique across your recorded purchases; replays return the original record.
  • category · ? · optionnel
  • check_id · ? · optionnel
    Optional id from spend_guard_check_purchase; at most one record may consume each check.
  • currency · string · optionnel
    USD only. Kept for forward compatibility; any other value is rejected.
  • merchant · string · requis
  • amount_usd · ? · requis
  • description · ? · optionnel

  Exemple d'appel

  {"name": "spend_guard_record_purchase", "arguments": {"tx_ref": "texte", "merchant": "texte", "amount_usd": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• spend_guard_report≈ 312 tokens

  Humans: sign up with your email at https://a2awire.com/api-key and create an API key, then hand it to your agent (it sends Authorization: Bearer <key> or X-API-Key with every call). Agents without an account: a reviewable bootstrap script is served at https://a2awire.com/api/v1/connectors/spend-guard/bootstrap.sh (download it, read it, then run it to mint a key). Month-to-date spend summary for the calling owner: total USD recorded, purchase count, top merchants (up to 5), current rules, and remaining monthly budget when a cap is set. Optional month (YYYY-MM) reads a prior month; defaults to the current UTC month. Not guest-callable. REST: GET /api/v1/spend-guard/report.

  Paramètres, retour & exemple (1)

  Paramètres

  • month · ? · optionnel
    Optional month filter (YYYY-MM); defaults to the current UTC month.

  Exemple d'appel

  {"name": "spend_guard_report", "arguments": {"month": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• spend_guard_set_rules≈ 586 tokens

  Humans: sign up with your email at https://a2awire.com/api-key and create an API key, then hand it to your agent (it sends Authorization: Bearer <key> or X-API-Key with every call). Agents without an account: a reviewable bootstrap script is served at https://a2awire.com/api/v1/connectors/spend-guard/bootstrap.sh (download it, read it, then run it to mint a key). Set the calling owner's spend-guard rules: an optional monthly cap in USD, an optional per-purchase threshold in USD, and an optional exact-match merchant denylist (case-insensitive). Full declaration: omit or null a field to clear that rule. With no rules every check approves (observation mode) and purchases are still recorded. Returns the effective rules. Not guest-callable. REST: PUT /api/v1/spend-guard/rules.

  Paramètres, retour & exemple (3)

  Paramètres

  • monthly_cap_usd · ? · optionnel
    Cumulative recorded spend per UTC calendar month at or above which checks deny. Null clears the cap.
  • merchant_denylist · ? · optionnel
    Exact-match merchant names (case-insensitive) whose purchases are denied, up to 100 entries. Null clears the list.
  • per_purchase_threshold_usd · ? · optionnel
    A single purchase strictly above this amount asks the user first. Null clears the threshold.

  Exemple d'appel

  {"name": "spend_guard_set_rules", "arguments": {"monthly_cap_usd": "texte", "merchant_denylist": "texte", "per_purchase_threshold_usd": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://a2awire.com/mcp/connectors/spend-guard/http