Pay-per-call safety guards for AI agents: injection, tool-call, signing, secret, x402-trust.
Inferido de los transportes que declara este listado (streamable-http). Que un cliente no aparezca aquí no significa que se haya descartado: simplemente Forge no puede confirmarlo.
La verificación confirma la identidad del publicador (la propiedad del repo), no la seguridad del código. El análisis de seguridad cubre los CVE conocidos y los scripts de instalación sospechosos.
Leído de un handshake MCP real initialize → tools/list contra el endpoint declarado. No se invocó ninguna herramienta: tools/list es la llamada de introspección de solo lectura que el protocolo define para esto. Refleja lo que el servidor anunciaba en ese momento; un endpoint alojado no está fijado a ninguna versión y puede cambiar sin avisar.
https://paygent.obsmetrics.com/mcp7 herramientas · 1624 mssecure-code-reviewSecurity review of a code snippet or diff. Returns structured findings (severity, CWE, location, remediation). [security; up to 75c/call]Security review of a code snippet or diff. Returns structured findings (severity, CWE, location, remediation). [security; up to 75c/call]
| Parámetro | Tipo | Descripción |
|---|---|---|
| code* | string | Source code or unified diff to review |
| language | string | Language hint, e.g. typescript, python |
| context | string | Optional context about the code |
pr-summaryTurn a git diff into a clear PR description or release notes. [dev-tools; up to 30c/call]Turn a git diff into a clear PR description or release notes. [dev-tools; up to 30c/call]
| Parámetro | Tipo | Descripción |
|---|---|---|
| diff* | string | Unified git diff to summarise |
| style | string | e.g. conventional, changelog, executive |
x402-trust-auditVet an x402 counterparty before settling USDC: scores the advertised payment requirements AND (when supplied) the EIP-3009 authorization you are about to sign. Returns a machine-enforceable trust verdict (per-entry scores, coverage-honest trustScore, spend-constraint + tamper-evident fingerprint) f…Vet an x402 counterparty before settling USDC: scores the advertised payment requirements AND (when supplied) the EIP-3009 authorization you are about to sign. Returns a machine-enforceable trust verdict (per-entry scores, coverage-honest trustScore, spend-constraint + tamper-evident fingerprint) f…
| Parámetro | Tipo | Descripción |
|---|---|---|
| paymentRequirements* | — | The x402 payment requirements from the counterparty: the 402 `accepts` array, or a single object. |
| selectedOptionIndex | number | Index in the accepts array the buyer intends to settle (default 0). The verdict is scoped to it. |
| paymentPayload | — | The UNSIGNED EIP-3009 authorization the buyer is about to sign: { authorization|message: {from,to,value,validAfter,validBefore,nonce}, domain: {name,version,ch… |
| expected | object | Optional caller expectations. |
| spendPolicy | object | Optional buyer spend policy to evaluate against and to pin facilitators. |
| endpointUrl | string | Resource URL being paid (context only; never fetched). |
| serverMetadata | — | Optional server metadata the caller already holds (context only; not fetched). |
| context | string | Optional free-form context. |
sign-guardPre-sign safety oracle for agent wallets: submit the transaction or EIP-712 message you are about to sign and get a machine-enforceable verdict. Decodes the calldata/typed-data, flags the drainer toolkit (unlimited approvals, setApprovalForAll, permit/permit2 + EIP-3009 to an unexpected party, tran…Pre-sign safety oracle for agent wallets: submit the transaction or EIP-712 message you are about to sign and get a machine-enforceable verdict. Decodes the calldata/typed-data, flags the drainer toolkit (unlimited approvals, setApprovalForAll, permit/permit2 + EIP-3009 to an unexpected party, tran…
| Parámetro | Tipo | Descripción |
|---|---|---|
| tx | object | An EVM transaction you are about to sign. |
| typedData | object | An EIP-712 message you are about to sign (the off-chain drainer surface: permit, Permit2, EIP-3009). { domain, types, primaryType, message }. |
| expected | object | Your stated intent. Supplying it lets the verdict BIND the action; only a fully bound, clean action is auto-sign-safe. For an allowance, you MUST supply maxAmo… |
| spendPolicy | object | Optional buyer spend policy (context only). |
| context | string | Optional free-form context. |
inject-guardUntrusted-content guardrail for agents: submit a blob of text you are about to feed to your own LLM (scraped web content, a tool result, another agent's message) and get a machine-enforceable verdict - is this a prompt-injection / jailbreak / data-exfiltration / tool-hijack attempt? Returns a risk…Untrusted-content guardrail for agents: submit a blob of text you are about to feed to your own LLM (scraped web content, a tool result, another agent's message) and get a machine-enforceable verdict - is this a prompt-injection / jailbreak / data-exfiltration / tool-hijack attempt? Returns a risk…
| Parámetro | Tipo | Descripción |
|---|---|---|
| content* | string | The untrusted text to scan before you feed it to your LLM. |
| context | string | Optional: where the content came from (url, tool name, sender) - context only. |
tool-call-guardPre-execution safety oracle for agent actions: submit the tool call you are about to run (shell, http, sql, file, code, env) plus your stated intent, and get a machine-enforceable verdict before you execute it. Decodes what the call does, flags the danger toolkit (rm -rf, reverse shell, curl|sh, SS…Pre-execution safety oracle for agent actions: submit the tool call you are about to run (shell, http, sql, file, code, env) plus your stated intent, and get a machine-enforceable verdict before you execute it. Decodes what the call does, flags the danger toolkit (rm -rf, reverse shell, curl|sh, SS…
| Parámetro | Tipo | Descripción |
|---|---|---|
| call* | object | The tool call you are about to execute. |
| intent | string | What this call is for (natural language). Used by the classifier for intent-mismatch. |
| expected | object | Machine-checkable constraints. Supplying them lets the verdict BIND the call; only a positively-scoped, satisfied call is auto-exec-safe. |
| context | string | Optional: where the task/input came from (untrusted source label). |
secret-scanLeaked-credential guardrail for agents: submit a blob you are about to commit, log, post, or hand to another tool (a diff, a config, an .env, an LLM output) and get a machine-enforceable verdict - does it contain a live secret? Detects cloud keys (AWS), VCS tokens (GitHub/GitLab), provider API keys…Leaked-credential guardrail for agents: submit a blob you are about to commit, log, post, or hand to another tool (a diff, a config, an .env, an LLM output) and get a machine-enforceable verdict - does it contain a live secret? Detects cloud keys (AWS), VCS tokens (GitHub/GitLab), provider API keys…
| Parámetro | Tipo | Descripción |
|---|---|---|
| content* | string | The text to scan for leaked secrets (diff, config, .env, log line, LLM output). |
7 de 7 herramientas publicaron una descripción.
Los nombres y descripciones de las herramientas los escribe el publicador y se muestran literalmente como texto inerte. Son las cadenas que un cliente MCP pasa al modelo, así que Forge las analiza en busca de patrones de inyección de prompts — cualquier hallazgo aparece junto al análisis de seguridad de arriba. «Privilegiada» es una coincidencia de palabra clave en el nombre de la herramienta, no una auditoría de lo que hace: un nombre inofensivo puede hacer cualquier cosa.
Pay-per-call safety guards for AI agents: injection, tool-call, signing, secret, x402-trust.
Los nombres enlazados abren el índice de Forge con todas las entradas que se observó que exponen esa herramienta. Ver todas las herramientas indexadas.
Esta entrada no publica ningún paquete de npm, así que Forge no tiene un árbol de dependencias para ella. Es una carencia de cobertura, no una afirmación de que no tenga dependencias.