Search / com.mandateshield/payment-authority
protogridR0· no sign-inAnalyzes delegated AI payment authority and exposes supported Stripe/x402 evidence contracts.
v1.13.0 · active · website · descriptor JSON · versions
{
"mcpServers": {
"payment-authority": {
"type": "http",
"url": "https://mandateshield.com/api/mcp",
"headers": {
"Authorization": "Bearer ${PAYMENT_AUTHORITY_TOKEN}"
}
}
}
}claude mcp add --transport http payment-authority https://mandateshield.com/api/mcp --header "Authorization: Bearer ${PAYMENT_AUTHORITY_TOKEN}"[mcp_servers.payment-authority]
url = "https://mandateshield.com/api/mcp"
bearer_token_env_var = "PAYMENT_AUTHORITY_TOKEN"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"payment-authority": {
"type": "remote",
"url": "https://mandateshield.com/api/mcp",
"enabled": true,
"headers": {
"Authorization": "Bearer {env:PAYMENT_AUTHORITY_TOKEN}"
}
}
}
}{
"mcpServers": {
"payment-authority": {
"type": "http",
"url": "https://mandateshield.com/api/mcp",
"headers": {
"Authorization": "Bearer ${PAYMENT_AUTHORITY_TOKEN}"
}
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=payment-authority&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWFuZGF0ZXNoaWVsZC5jb20vYXBpL21jcCIsImhlYWRlcnMiOnsiQXV0aG9yaXphdGlvbiI6IkJlYXJlciAke1BBWU1FTlRfQVVUSE9SSVRZX1RPS0VOfSJ9fQ%3D%3D"
}{
"servers": {
"payment-authority": {
"type": "http",
"url": "https://mandateshield.com/api/mcp",
"headers": {
"Authorization": "Bearer ${PAYMENT_AUTHORITY_TOKEN}"
}
}
}
}{
"mcpServers": {
"payment-authority": {
"httpUrl": "https://mandateshield.com/api/mcp",
"headers": {
"Authorization": "Bearer ${PAYMENT_AUTHORITY_TOKEN}"
}
}
}
}extensions:
"payment-authority":
enabled: true
name: "payment-authority"
type: streamable_http
uri: "https://mandateshield.com/api/mcp"
headers:
"Authorization": "Bearer ${PAYMENT_AUTHORITY_TOKEN}"
timeout: 300
Placeholders to fill from your own secret store: ${PAYMENT_AUTHORITY_TOKEN}. The registry never accepts secret values.
protocol.modernsupports 2026-07-28 (server/discover)protocol.statelessanswers without a sessionprotocol.transportstreamable HTTPprotocol.list_ttltools/list declares ttlMs 0, so clients re-fetch it on every useauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotations3 of 3 tools declare readOnlyHint or destructiveHinttools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHinttools.token_costabout 5,741 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changesno tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+dns-namespace +website +reachable +uptime-100% ~updated-83d-ago -no-repository
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://mandateshield.com/api/mcp streamable-http | none | yes | 100% | 1690 ms | 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26 | 2026-10-20 |
check_ai_payment_authority | Use before an AI agent buys, subscribes, transfers value, calls a metered API, or accesses a paid resource when the user wants a payment-authority check. Analyze whether the proposed purchase fits supplied policy facts. This v1 entry check is non-executable and always returns enforcement_authorized=false; use the strict cryptographic tool for a production gate. Never send payment credentials or private keys. |
normalize_agent_payment_protocolread-only | Use when an agent encounters an AP2 terminal closed-payment projection, x402 v2 PAYMENT-REQUIRED offer, or explicitly profiled MPP Payment challenge and needs the supported fields projected before an authority check. Map those documented fields into a deterministic MandateShield purchase envelope. X402 requires source-matched network+payTo identity and MPP requires source-matched HTTPS service-origin+method identity; merchant_id alone is insufficient. Evidence references are not independently verified. projection_fields_valid is not full protocol conformance: this tool never verifies delegated authority or a payment credential and always returns enforcement_authorized=false under assurance. |
verify_cryptographic_payment_authority | Use only for a production pre-payment authority gate after the caller has a registered mandate, pinned issuer key, fresh challenge, VERIFY-scoped key, exact final purchase and supported signed evidence. Fail closed for JWS, an AP2-shaped closed-payment SD-JWT projection with RFC 9901 KB-JWT, or normalized TAP-shaped RFC 9421-style evidence. Full AP2 checkout/delegate-chain and Visa TAP structured-field/trust-store processing remain external. A qualifying live ALLOW creates only a short RESERVED authorization and cumulative-budget allocation. This MCP tool never executes payment and exposes no processor transition: a separate trusted gateway with an audience-bound PROCESSOR key must CONSUME and freshly redeem the provider-bound permit before attempting an idempotent provider operation, then reconcile the outcome. |
Schemas: list_tools.
{
"name": "com.mandateshield/payment-authority",
"_meta": {
"io.modelcontextprotocol.registry/publisher-provided": {
"cli": "https://mandateshield.com/sdk/v1.13.0/mandateshield-cli.mjs",
"jwks": "https://mandateshield.com/.well-known/jwks.json",
"connect": "https://mandateshield.com/connect",
"openapi": "https://mandateshield.com/openapi.json",
"website": "https://mandateshield.com",
"a2aAgentCard": "https://mandateshield.com/.well-known/agent-card.json",
"agentCatalog": "https://mandateshield.com/.well-known/ai-catalog.json",
"analysisOnly": "https://mandateshield.com/api/v1/preflight",
"proofNetwork": "https://mandateshield.com/api/v1/proof-network/proofs",
"executionRule": "V1 tools never authorize payment. Strict live verification creates only RESERVED. New accounts must CONSUME with exact provider binding in a credential-isolated gateway; older accounts retain legacy compatibility. A fresh claim authorizes an idempotent provider request, not exactly-once delivery. Reports and webhooks are hints. MandateShield checks configured Stripe or x402 evidence without trusting the caller before finalization. Caller-independent is not an external audit or independent-organization verification. Unknown or conflicting outcomes fail closed.",
"fullDiscovery": "https://mandateshield.com/.well-known/mandateshield.json",
"specification": "https://mandateshield.com/standard",
"currentRelease": "https://mandateshield.com/current-release.json",
"releaseManifest": "https://mandateshield.com/evidence/v1.13.0/release-manifest.json",
"standardVersion": "2.4.0",
"integrationGuide": "https://mandateshield.com/integrations",
"javascriptClient": "https://mandateshield.com/sdk/v1.13.0/mandateshield.mjs",
"versionedOpenapi": "https://mandateshield.com/openapi/3.4.0.json",
"zeroAccountTrial": "https://mandateshield.com/sdk/mandateshield-trial.mjs",
"executionContract": {
"mode": "live",
"decision": "ALLOW",
"keyTrust": "ACCOUNT_PINNED",
"persisted": true,
"consumable": true,
"authorityValid": true,
"authorizationState": "RESERVED",
"analysisIsExecutable": false,
"enforcementAuthorized": true,
"processorConsumeRequired": true,
"providerRedemptionRequired": true,
"signedWebhookIsTerminalProof": false,
"unknownAndConflictRemainFailClosed": true,
"offlineVerificationPermitsSubmission": false,
"providerOrFacilitatorAdoptionClaimed": false,
"missingAccountCreationTimeFailsClosed": true,
"callerReportIndependentEvidenceClasses": [
"PROVIDER_API_VERIFIED",
"CHAIN_FINALIZED"
],
"providerSubmissionReportIsTerminalProof": false,
"providerBoundConsumeRequiredForNewAccounts": true,
"externalAuditOrIndependentOrganizationClaimed": false,
"providerBoundConsumeRequiredFromAccountCreatedAt": "2026-07-26T12:01:24.000Z",
"callerReportIndependentEvidenceCanAutonomouslyFinalize": true,
"legacyUnboundConsumeAllowedOnlyForAccountsCreatedBefore": "2026-07-26T12:01:24.000Z"
},
"cryptographicBatch": "https://mandateshield.com/api/v2/batch",
"zeroAccountSandbox": "https://mandateshield.com/api/v2/sandbox/lifecycle",
"standaloneNoAuthMcp": "https://mandateshield.com/api/mcp/plugin",
"proofAttestationSpec": "https://mandateshield.com/specifications/proof-attestation/v1",
"publicProofSemantics": "Externally bound self-report; not users, installations, certification, or independently executed conformance.",
"proofNetworkChallenge": "https://mandateshield.com/api/v1/proof-network/challenges",
"verificationChallenge": "https://mandateshield.com/api/v2/challenges",
"zeroAccountSandboxSpec": "https://mandateshield.com/specifications/strict-lifecycle-sandbox/v1",
"proofNetworkAttestation": "https://mandateshield.com/api/v1/proof-network/attestations",
"cryptographicVerification": "https://mandateshield.com/api/v2/verify",
"executionEvidenceVerifier": "https://mandateshield.com/sdk/v1.13.0/mandateshield-execution-evidence-verifier.mjs",
"installableCurrentPackage": "https://mandateshield.com/sdk/mandateshield-sdk-current.tgz",
"paymentAuthorityDiscovery": "https://mandateshield.com/.well-known/agent-payment-authority.json",
"installableVersionedPackage": "https://mandateshield.com/packages/npm/1.13.0/mandateshield-sdk-1.13.0.tgz",
"installableVersionedPackageSha256": "https://mandateshield.com/packages/npm/1.13.0/SHA256SUMS"
}
},
"icons": [
{
"src": "https://mandateshield.com/icon-192.png",
"sizes": [
"192x192"
],
"mimeType": "image/png"
},
{
"src": "https://mandateshield.com/icon-512.png",
"sizes": [
"512x512"
],
"mimeType": "image/png"
},
{
"src": "https://mandateshield.com/favicon.svg",
"sizes": [
"any"
],
"mimeType": "image/svg+xml"
}
],
"title": "MandateShield AI Payment Evidence",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://mandateshield.com/api/mcp",
"type": "streamable-http",
"headers": [
{
"name": "Authorization",
"isSecret": true,
"description": "Optional VERIFY-scoped API key for strict production tools. Include Bearer; never use a PROCESSOR key."
}
]
}
],
"version": "1.13.0",
"websiteUrl": "https://mandateshield.com/connect",
"description": "Analyzes delegated AI payment authority and exposes supported Stripe/x402 evidence contracts."
}