Search / com.obsmetrics.paygent/agents
Pay-per-call safety guards for AI agents: injection, tool-call, signing, secret, x402-trust.
v0.0.8 · active · website · descriptor JSON · versions
protogrid{
"mcpServers": {
"agents": {
"type": "http",
"url": "https://paygent.obsmetrics.com/mcp"
}
}
}claude mcp add --transport http agents https://paygent.obsmetrics.com/mcp[mcp_servers.agents]
url = "https://paygent.obsmetrics.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"agents": {
"type": "remote",
"url": "https://paygent.obsmetrics.com/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"agents": {
"type": "http",
"url": "https://paygent.obsmetrics.com/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=agents&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vcGF5Z2VudC5vYnNtZXRyaWNzLmNvbS9tY3AifQ%3D%3D"
}{
"servers": {
"agents": {
"type": "http",
"url": "https://paygent.obsmetrics.com/mcp"
}
}
}{
"mcpServers": {
"agents": {
"httpUrl": "https://paygent.obsmetrics.com/mcp"
}
}
}extensions:
"agents":
enabled: true
name: "agents"
type: streamable_http
uri: "https://paygent.obsmetrics.com/mcp"
timeout: 300
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky onestools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: x402-trust-audit (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); sign-guard (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); inject-guard (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …tools.token_costabout 2,500 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changesno tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+dns-namespace +website -unreachable(5 failures) ~updated-126d-ago -no-repository
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://paygent.obsmetrics.com/mcp streamable-http | none | no (5 failures) | 94% | 588 ms | 2025-06-18 | 2026-10-13 |
inject-guard | Untrusted-content guardrail for agents: submit a blob of text you are about to feed to your own LLM (scraped web content, a tool result, another agent's message) and get a machine-enforceable verdict - is this a prompt-injection / jailbreak / data-exfiltration / tool-hijack attempt? Returns a risk level, the detected classes with spans, the unicode obfuscation it found (zero-width, bidi-override, tag-chars, homoglyphs), and a SANITIZED copy safe to feed onward. Hybrid: a deterministic, uninjectable pattern engine (authoritative) plus an LLM classifier that can only raise the risk, never clear a flag. Detection of known injection classes - not a proof of safety. [security; up to 15c/call] |
pr-summary | Turn a git diff into a clear PR description or release notes. [dev-tools; up to 30c/call] |
secret-scan | Leaked-credential guardrail for agents: submit a blob you are about to commit, log, post, or hand to another tool (a diff, a config, an .env, an LLM output) and get a machine-enforceable verdict - does it contain a live secret? Detects cloud keys (AWS), VCS tokens (GitHub/GitLab), provider API keys (Stripe, OpenAI, Anthropic, Google, Slack), private-key blocks, JWTs, and credentials embedded in URLs, plus high-entropy key=value assignments. Returns a risk level, the detected classes with a MASKED locator (never the secret itself, so the verdict cannot re-leak), and a REDACTED copy safe to emit onward. Deterministic, sub-second, never fetches. Detection of known secret formats - not a proof of cleanliness. [security; up to 200c/call] |
secure-code-review | Security review of a code snippet or diff. Returns structured findings (severity, CWE, location, remediation). [security; up to 75c/call] |
sign-guard | Pre-sign safety oracle for agent wallets: submit the transaction or EIP-712 message you are about to sign and get a machine-enforceable verdict. Decodes the calldata/typed-data, flags the drainer toolkit (unlimited approvals, setApprovalForAll, permit/permit2 + EIP-3009 to an unexpected party, transferFrom draining an unnamed account, ownership transfer, raw ETH to a stranger), and binds the decoded action to your stated intent - only a fully pinned, clean action is auto-sign-safe. Fails closed: an undecodable on-chain call is cautioned and an unrecognized off-chain signature grant is blocked. Deterministic, sub-second, no endpoint fetch. It vouches that the action matches what you said; it does NOT vouch that a counterparty is trustworthy. [security; up to 200c/call] |
tool-call-guard | Pre-execution safety oracle for agent actions: submit the tool call you are about to run (shell, http, sql, file, code, env) plus your stated intent, and get a machine-enforceable verdict before you execute it. Decodes what the call does, flags the danger toolkit (rm -rf, reverse shell, curl|sh, SSRF to cloud metadata, credential reads, DROP/DELETE-without-WHERE, path traversal, dynamic eval), and binds it to your intent (allowedHosts/allowedPaths/readOnly/noNetwork) - only a fully pinned, clean, intent-matched call is auto-exec-safe. Hybrid: a deterministic, uninjectable detector engine (authoritative) plus an LLM classifier that can only raise the risk. Fails closed. Detection of known-dangerous patterns, not a proof of safety; it never executes the call. [security; up to 8c/call] |
x402-trust-audit | Vet an x402 counterparty before settling USDC: scores the advertised payment requirements AND (when supplied) the EIP-3009 authorization you are about to sign. Returns a machine-enforceable trust verdict (per-entry scores, coverage-honest trustScore, spend-constraint + tamper-evident fingerprint) for buyer agents and wallet/spend-policy layers. No endpoint fetch. [security; up to 200c/call] |
Schemas: list_tools.
{
"name": "com.obsmetrics.paygent/agents",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://paygent.obsmetrics.com/mcp",
"type": "streamable-http"
}
],
"version": "0.0.8",
"websiteUrl": "https://paygent.obsmetrics.com",
"description": "Pay-per-call safety guards for AI agents: injection, tool-call, signing, secret, x402-trust."
}