Pay-per-call safety guards for AI agents: injection, tool-call, signing, secret, x402-trust.
Inferred from the transports this listing declares (streamable-http). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read from a real MCP initialize → tools/list handshake against the declared endpoint. No tool was ever invoked — tools/list is the read-only introspection call the protocol defines for this. It reflects what the server advertised at that moment; a hosted endpoint is not pinned to any version and can change without notice.
https://paygent.obsmetrics.com/mcp7 tools · 1624mssecure-code-reviewSecurity review of a code snippet or diff. Returns structured findings (severity, CWE, location, remediation). [security; up to 75c/call]Security review of a code snippet or diff. Returns structured findings (severity, CWE, location, remediation). [security; up to 75c/call]
| Parameter | Type | Description |
|---|---|---|
| code* | string | Source code or unified diff to review |
| language | string | Language hint, e.g. typescript, python |
| context | string | Optional context about the code |
pr-summaryTurn a git diff into a clear PR description or release notes. [dev-tools; up to 30c/call]Turn a git diff into a clear PR description or release notes. [dev-tools; up to 30c/call]
| Parameter | Type | Description |
|---|---|---|
| diff* | string | Unified git diff to summarise |
| style | string | e.g. conventional, changelog, executive |
x402-trust-auditVet an x402 counterparty before settling USDC: scores the advertised payment requirements AND (when supplied) the EIP-3009 authorization you are about to sign. Returns a machine-enforceable trust verdict (per-entry scores, coverage-honest trustScore, spend-constraint + tamper-evident fingerprint) f…Vet an x402 counterparty before settling USDC: scores the advertised payment requirements AND (when supplied) the EIP-3009 authorization you are about to sign. Returns a machine-enforceable trust verdict (per-entry scores, coverage-honest trustScore, spend-constraint + tamper-evident fingerprint) f…
| Parameter | Type | Description |
|---|---|---|
| paymentRequirements* | — | The x402 payment requirements from the counterparty: the 402 `accepts` array, or a single object. |
| selectedOptionIndex | number | Index in the accepts array the buyer intends to settle (default 0). The verdict is scoped to it. |
| paymentPayload | — | The UNSIGNED EIP-3009 authorization the buyer is about to sign: { authorization|message: {from,to,value,validAfter,validBefore,nonce}, domain: {name,version,ch… |
| expected | object | Optional caller expectations. |
| spendPolicy | object | Optional buyer spend policy to evaluate against and to pin facilitators. |
| endpointUrl | string | Resource URL being paid (context only; never fetched). |
| serverMetadata | — | Optional server metadata the caller already holds (context only; not fetched). |
| context | string | Optional free-form context. |
sign-guardPre-sign safety oracle for agent wallets: submit the transaction or EIP-712 message you are about to sign and get a machine-enforceable verdict. Decodes the calldata/typed-data, flags the drainer toolkit (unlimited approvals, setApprovalForAll, permit/permit2 + EIP-3009 to an unexpected party, tran…Pre-sign safety oracle for agent wallets: submit the transaction or EIP-712 message you are about to sign and get a machine-enforceable verdict. Decodes the calldata/typed-data, flags the drainer toolkit (unlimited approvals, setApprovalForAll, permit/permit2 + EIP-3009 to an unexpected party, tran…
| Parameter | Type | Description |
|---|---|---|
| tx | object | An EVM transaction you are about to sign. |
| typedData | object | An EIP-712 message you are about to sign (the off-chain drainer surface: permit, Permit2, EIP-3009). { domain, types, primaryType, message }. |
| expected | object | Your stated intent. Supplying it lets the verdict BIND the action; only a fully bound, clean action is auto-sign-safe. For an allowance, you MUST supply maxAmo… |
| spendPolicy | object | Optional buyer spend policy (context only). |
| context | string | Optional free-form context. |
inject-guardUntrusted-content guardrail for agents: submit a blob of text you are about to feed to your own LLM (scraped web content, a tool result, another agent's message) and get a machine-enforceable verdict - is this a prompt-injection / jailbreak / data-exfiltration / tool-hijack attempt? Returns a risk…Untrusted-content guardrail for agents: submit a blob of text you are about to feed to your own LLM (scraped web content, a tool result, another agent's message) and get a machine-enforceable verdict - is this a prompt-injection / jailbreak / data-exfiltration / tool-hijack attempt? Returns a risk…
| Parameter | Type | Description |
|---|---|---|
| content* | string | The untrusted text to scan before you feed it to your LLM. |
| context | string | Optional: where the content came from (url, tool name, sender) - context only. |
tool-call-guardPre-execution safety oracle for agent actions: submit the tool call you are about to run (shell, http, sql, file, code, env) plus your stated intent, and get a machine-enforceable verdict before you execute it. Decodes what the call does, flags the danger toolkit (rm -rf, reverse shell, curl|sh, SS…Pre-execution safety oracle for agent actions: submit the tool call you are about to run (shell, http, sql, file, code, env) plus your stated intent, and get a machine-enforceable verdict before you execute it. Decodes what the call does, flags the danger toolkit (rm -rf, reverse shell, curl|sh, SS…
| Parameter | Type | Description |
|---|---|---|
| call* | object | The tool call you are about to execute. |
| intent | string | What this call is for (natural language). Used by the classifier for intent-mismatch. |
| expected | object | Machine-checkable constraints. Supplying them lets the verdict BIND the call; only a positively-scoped, satisfied call is auto-exec-safe. |
| context | string | Optional: where the task/input came from (untrusted source label). |
secret-scanLeaked-credential guardrail for agents: submit a blob you are about to commit, log, post, or hand to another tool (a diff, a config, an .env, an LLM output) and get a machine-enforceable verdict - does it contain a live secret? Detects cloud keys (AWS), VCS tokens (GitHub/GitLab), provider API keys…Leaked-credential guardrail for agents: submit a blob you are about to commit, log, post, or hand to another tool (a diff, a config, an .env, an LLM output) and get a machine-enforceable verdict - does it contain a live secret? Detects cloud keys (AWS), VCS tokens (GitHub/GitLab), provider API keys…
| Parameter | Type | Description |
|---|---|---|
| content* | string | The text to scan for leaked secrets (diff, config, .env, log line, LLM output). |
7 of 7 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Pay-per-call safety guards for AI agents: injection, tool-call, signing, secret, x402-trust.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
This entry publishes no npm package, so Forge has no dependency tree for it. That is a gap in coverage — not a statement that it has no dependencies.