Pay-per-call safety guards for AI agents: injection, tool-call, signing, secret, x402-trust.
Abgeleitet aus den Transporten, die dieser Eintrag deklariert (streamable-http). Ein Client, der hier nicht steht, ist damit nicht ausgeschlossen — Forge kann ihn nur nicht bestätigen.
Die Verifizierung bestätigt die Identität des Publishers (die Inhaberschaft am Repo), nicht die Sicherheit des Codes. Der Sicherheits-Scan deckt bekannte CVEs und verdächtige Installationsskripte ab.
Aus einem echten MCP-Handshake initialize → tools/list gegen den deklarierten Endpunkt gelesen. Es wurde nie ein Tool aufgerufen — tools/list ist der lesende Introspektionsaufruf, den das Protokoll dafür vorsieht. Es spiegelt wider, was der Server in diesem Moment angeboten hat; ein gehosteter Endpunkt ist an keine Version gebunden und kann sich ohne Ankündigung ändern.
https://paygent.obsmetrics.com/mcp7 Tools · 1624 mssecure-code-reviewSecurity review of a code snippet or diff. Returns structured findings (severity, CWE, location, remediation). [security; up to 75c/call]Security review of a code snippet or diff. Returns structured findings (severity, CWE, location, remediation). [security; up to 75c/call]
| Parameter | Typ | Beschreibung |
|---|---|---|
| code* | string | Source code or unified diff to review |
| language | string | Language hint, e.g. typescript, python |
| context | string | Optional context about the code |
pr-summaryTurn a git diff into a clear PR description or release notes. [dev-tools; up to 30c/call]Turn a git diff into a clear PR description or release notes. [dev-tools; up to 30c/call]
| Parameter | Typ | Beschreibung |
|---|---|---|
| diff* | string | Unified git diff to summarise |
| style | string | e.g. conventional, changelog, executive |
x402-trust-auditVet an x402 counterparty before settling USDC: scores the advertised payment requirements AND (when supplied) the EIP-3009 authorization you are about to sign. Returns a machine-enforceable trust verdict (per-entry scores, coverage-honest trustScore, spend-constraint + tamper-evident fingerprint) f…Vet an x402 counterparty before settling USDC: scores the advertised payment requirements AND (when supplied) the EIP-3009 authorization you are about to sign. Returns a machine-enforceable trust verdict (per-entry scores, coverage-honest trustScore, spend-constraint + tamper-evident fingerprint) f…
| Parameter | Typ | Beschreibung |
|---|---|---|
| paymentRequirements* | — | The x402 payment requirements from the counterparty: the 402 `accepts` array, or a single object. |
| selectedOptionIndex | number | Index in the accepts array the buyer intends to settle (default 0). The verdict is scoped to it. |
| paymentPayload | — | The UNSIGNED EIP-3009 authorization the buyer is about to sign: { authorization|message: {from,to,value,validAfter,validBefore,nonce}, domain: {name,version,ch… |
| expected | object | Optional caller expectations. |
| spendPolicy | object | Optional buyer spend policy to evaluate against and to pin facilitators. |
| endpointUrl | string | Resource URL being paid (context only; never fetched). |
| serverMetadata | — | Optional server metadata the caller already holds (context only; not fetched). |
| context | string | Optional free-form context. |
sign-guardPre-sign safety oracle for agent wallets: submit the transaction or EIP-712 message you are about to sign and get a machine-enforceable verdict. Decodes the calldata/typed-data, flags the drainer toolkit (unlimited approvals, setApprovalForAll, permit/permit2 + EIP-3009 to an unexpected party, tran…Pre-sign safety oracle for agent wallets: submit the transaction or EIP-712 message you are about to sign and get a machine-enforceable verdict. Decodes the calldata/typed-data, flags the drainer toolkit (unlimited approvals, setApprovalForAll, permit/permit2 + EIP-3009 to an unexpected party, tran…
| Parameter | Typ | Beschreibung |
|---|---|---|
| tx | object | An EVM transaction you are about to sign. |
| typedData | object | An EIP-712 message you are about to sign (the off-chain drainer surface: permit, Permit2, EIP-3009). { domain, types, primaryType, message }. |
| expected | object | Your stated intent. Supplying it lets the verdict BIND the action; only a fully bound, clean action is auto-sign-safe. For an allowance, you MUST supply maxAmo… |
| spendPolicy | object | Optional buyer spend policy (context only). |
| context | string | Optional free-form context. |
inject-guardUntrusted-content guardrail for agents: submit a blob of text you are about to feed to your own LLM (scraped web content, a tool result, another agent's message) and get a machine-enforceable verdict - is this a prompt-injection / jailbreak / data-exfiltration / tool-hijack attempt? Returns a risk…Untrusted-content guardrail for agents: submit a blob of text you are about to feed to your own LLM (scraped web content, a tool result, another agent's message) and get a machine-enforceable verdict - is this a prompt-injection / jailbreak / data-exfiltration / tool-hijack attempt? Returns a risk…
| Parameter | Typ | Beschreibung |
|---|---|---|
| content* | string | The untrusted text to scan before you feed it to your LLM. |
| context | string | Optional: where the content came from (url, tool name, sender) - context only. |
tool-call-guardPre-execution safety oracle for agent actions: submit the tool call you are about to run (shell, http, sql, file, code, env) plus your stated intent, and get a machine-enforceable verdict before you execute it. Decodes what the call does, flags the danger toolkit (rm -rf, reverse shell, curl|sh, SS…Pre-execution safety oracle for agent actions: submit the tool call you are about to run (shell, http, sql, file, code, env) plus your stated intent, and get a machine-enforceable verdict before you execute it. Decodes what the call does, flags the danger toolkit (rm -rf, reverse shell, curl|sh, SS…
| Parameter | Typ | Beschreibung |
|---|---|---|
| call* | object | The tool call you are about to execute. |
| intent | string | What this call is for (natural language). Used by the classifier for intent-mismatch. |
| expected | object | Machine-checkable constraints. Supplying them lets the verdict BIND the call; only a positively-scoped, satisfied call is auto-exec-safe. |
| context | string | Optional: where the task/input came from (untrusted source label). |
secret-scanLeaked-credential guardrail for agents: submit a blob you are about to commit, log, post, or hand to another tool (a diff, a config, an .env, an LLM output) and get a machine-enforceable verdict - does it contain a live secret? Detects cloud keys (AWS), VCS tokens (GitHub/GitLab), provider API keys…Leaked-credential guardrail for agents: submit a blob you are about to commit, log, post, or hand to another tool (a diff, a config, an .env, an LLM output) and get a machine-enforceable verdict - does it contain a live secret? Detects cloud keys (AWS), VCS tokens (GitHub/GitLab), provider API keys…
| Parameter | Typ | Beschreibung |
|---|---|---|
| content* | string | The text to scan for leaked secrets (diff, config, .env, log line, LLM output). |
7 von 7 Tools haben eine Beschreibung veröffentlicht.
Tool-Namen und -Beschreibungen stammen vom Publisher und werden wortgetreu als inerter Text angezeigt. Es sind die Zeichenketten, die ein MCP-Client an ein Modell übergibt, deshalb prüft Forge sie auf Prompt-Injection-Muster — jeder Befund erscheint oben beim Sicherheits-Scan. „Privilegiert“ ist ein Schlagwort-Treffer im Tool-Namen, keine Prüfung dessen, was das Tool tut: ein harmlos klingender Name kann trotzdem alles tun.
Pay-per-call safety guards for AI agents: injection, tool-call, signing, secret, x402-trust.
Verlinkte Namen öffnen den Forge-Index aller Einträge, bei denen dieses Tool beobachtet wurde. Alle indexierten Tools durchsuchen.
Dieser Eintrag veröffentlicht kein npm-Paket, daher hat Forge keinen Abhängigkeitsbaum dafür. Das ist eine Lücke in der Abdeckung — keine Aussage, dass er keine Abhängigkeiten hat.