io.github.spendpreflight/spendpreflight

Est-ce que io.github.spendpreflight/spendpreflight est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.spendpreflight/spendpreflight » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 5 outils

• check_endpoint≈ 662 tokens

  Cached x402 endpoint observations, operated by SpendPreflight. Returns a transparent score (or unknown), its components and seven-day unpaid probe history for an already publicly listed URL. Never fetches the caller's URL or pays the endpoint. Unlisted, unavailable or stale data is not charged. This is not a paid-delivery or compliance guarantee. Provide the exact resource URL; add method when the URL has multiple advertised methods. Use for endpoint history and price context before paying. Use check_payee for wallet/name screening or preflight_payment for an allow/hold/block decision. Price $0.005 per cached lookup (shared free trial first). An unknown score means missing evidence; repeated paid calls may incur another charge.

  Paramètres, retour & exemple (2)

  Paramètres

  • url · string · requis
    Exact public HTTP(S) URL already listed by Bazaar or x402scan
  • method · string · optionnel
    Advertised method such as GET or POST; required if the URL is ambiguous

  Exemple d'appel

  {"name": "check_endpoint", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"url": "texte", "score": "texte", "method": "texte", "history": [], "sources": [], "category": "texte", "operator": "texte", "assessment": {}, "components": {}, "data_as_of": "texte", "disclaimer": "texte", "methodology": "texte"}}

• check_payee≈ 552 tokens

  Payee risk check. Screens a payee wallet address and name against the OFAC SDN sanctions list and checks the merchant domain's registration age and DNS. Returns risk low|medium|high|unknown with flags such as sanctioned_address, sanctioned_name_possible, new_domain. Call this before a USDC payment when you only have a payee name, wallet or domain. Provide at least one of domain, address, or name; inputs may be combined, and domain accepts a hostname or URL. For an x402 challenge or cart and an allow/hold/block spending-rule decision, use preflight_payment instead. Price $0.01 per call (free trial first).

  Paramètres, retour & exemple (3)

  Paramètres

  • name · string · optionnel
    Merchant or payee legal name
  • domain · string · optionnel
    Merchant domain or URL, e.g. shop.example.com
  • address · string · optionnel
    Payee wallet address (EVM 0x…, BTC, etc.)

  Exemple d'appel

  {"name": "check_payee", "arguments": {"name": "texte", "domain": "texte", "address": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"risk": "low", "flags": [], "domain": "texte", "sanctions": {}, "data_as_of": "texte", "disclaimer": "texte"}}

• get_service_info≈ 482 tokens

  Free, read-only service reference. Use when you need prices, default spending rules, payment setup, trial allowance, or a ready-to-use example call. If you already have a payment challenge or cart, call preflight_payment directly; this reference call is optional. Takes no arguments and performs no payee screening or payment decision. Use check_payee for standalone payee risk; use preflight_payment for an x402 challenge or cart and an allow/hold/block decision.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_service_info", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"site": "texte", "trust": {}, "payment": {}, "pricing": {}, "http_api": {}, "disclaimer": "texte", "guarantees": [], "when_to_use": "texte", "client_guard": "texte", "example_call": {}, "example_note": "texte", "default_rules": {}}}

• lint_endpoint≈ 213 tokens

  Free x402 Lint by SpendPreflight. Checks a public HTTPS endpoint with an unpaid GET: v1/v2 challenge shape, payTo/asset/network syntax, price, Bazaar metadata and browser CORS headers. Returns fixes and a public seven-day report link. No payment or credentials; GET cannot validate a POST-only endpoint or paid delivery. Do not submit private URLs.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis

  Exemple d'appel

  {"name": "lint_endpoint", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• preflight_payment≈ 1193 tokens

  Call this before any x402/USDC payment to evaluate the actual challenge or cart before signing. Spend preflight for AI agents. Send the x402 PaymentRequired body (v1 or v2) you received, or a cart, plus optional rules (per-payment max, hold threshold, daily cap, allowlists, new-domain days, endpoint category price multiple, liveness and payTo changes). Returns allow|hold|block with reasons, the cheapest acceptable payment option, and a receipt id. Read-only: never signs, settles, or holds funds. Use before every payment. It includes payee screening in its spending-rule decision. For standalone wallet, name, or domain screening without a payment, use check_payee instead. Each repeat call creates a new receipt and may consume another trial or paid call. Price $0.02 per call (free trial first).

  Paramètres, retour & exemple (6)

  Paramètres

  • cart · object · optionnel
    Use instead of challenge for agent checkout / card payments
  • rules · object · optionnel
    Spending rules; all optional. See get_service_info for defaults.
  • challenge · object · optionnel
    The x402 PaymentRequired body (v1 or v2) your agent received with HTTP 402
  • resource_url · string · optionnel
    URL that returned the 402, if not inside the challenge
  • resource_method · string · optionnel
    Advertised method for an indexed URL with multiple methods
  • spent_today_usd · number · optionnel
    What this agent already spent today, for the daily cap

  Exemple d'appel

  {"name": "preflight_payment", "arguments": {"cart": {}, "rules": {}, "challenge": {}, "resource_url": "texte", "resource_method": "texte", "spent_today_usd": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"payee": "texte", "reasons": [], "receipt": {}, "decision": "allow", "chosen_option": "texte", "index_evidence": {}, "options_evaluated": 1}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://api.spendpreflight.com/mcp