Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "agent-ledger": {
      "type": "http",
      "url": "https://aiagentscity.com/mcp/"
    }
  }
}

claude mcp add --transport http agent-ledger https://aiagentscity.com/mcp/

[mcp_servers.agent-ledger]
url = "https://aiagentscity.com/mcp/"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "agent-ledger": {
      "type": "remote",
      "url": "https://aiagentscity.com/mcp/",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "agent-ledger": {
      "type": "http",
      "url": "https://aiagentscity.com/mcp/"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=agent-ledger&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vYWlhZ2VudHNjaXR5LmNvbS9tY3AvIn0%3D"
}

{
  "servers": {
    "agent-ledger": {
      "type": "http",
      "url": "https://aiagentscity.com/mcp/"
    }
  }
}

{
  "mcpServers": {
    "agent-ledger": {
      "httpUrl": "https://aiagentscity.com/mcp/"
    }
  }
}

extensions:
  "agent-ledger":
    enabled: true
    name: "agent-ledger"
    type: streamable_http
    uri: "https://aiagentscity.com/mcp/"
    timeout: 300

Quality 84 / 100good

protocol88 · weight 25

pass
protocol.modernsupports 2026-07-28 (server/discover)
pass
protocol.statelessanswers without a session
pass
protocol.transportstreamable HTTP
warn
protocol.list_ttltools/list declares ttlMs 0, so clients re-fetch it on every use

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene86 · weight 30

pass
tools.descriptionsevery tool has a description
warn
tools.description_length2 tools have descriptions over 1,024 characters, which crowds the context
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations16 of 18 tools declare readOnlyHint or destructiveHint
warn
tools.directory_hints1 of 18 tools declare all four hints; missing: ledger_rotate_secret (openWorldHint); ledger_proxy_attach (openWorldHint); ledger_alerts (openWorldHint); …
pass
tools.token_costabout 5,039 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability75 · weight 15

warn
stability.changes12 tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

18 tools, about 5,039 tokens to load them all · tool set da392849a624 · tools last changed 2026-10-12 · checked 2026-10-20 10:03 UTC

Tool changes

2026-10-12ledger_startchangeddescription
before
Get a FREE AgentLedger workspace with no credential and no arguments — the MCP equivalent of opening POST /start in a browser. Call this FIRST if you have no credentials yet. Every other tool here (ledger_track, ledger_set_budget, ledger_report, ledger_alerts) needs a workspace_key or an agent_secret, so a caller arriving with neither must start here or it has nowhere to go. Takes NO arguments on purpose: the goal is zero friction. It returns a `workspace_key` (shown exactly once — it cannot be re-revealed, so store it before continuing) which you then send as `workspace_key` on your first ledger_track for a NEW agent_id. That first write returns the agent's own `agent_secret`, which authenticates every write after it. The free tier includes every rail, enforced budget caps, alerts, reports and the MCP server, capped at 3 agents per workspace. Minting is rate-limited per caller IP, the same limit the human door uses. Prefer to pay? POST /v1/billing/x402 with a wallet-signed payment needs no human and buys 24h of Pro (unlimited agents).
after · 94% of words in common
Get a FREE AgentLedger workspace with no credential and no arguments — the MCP equivalent of opening POST /start in a browser. Call this FIRST if you have no credentials yet. Every other tool here (ledger_track, ledger_set_budget, ledger_report, ledger_alerts) needs a workspace_key or an agent_secret, so a caller arriving with neither must start here or it has nowhere to go. Takes NO arguments on purpose: the goal is zero friction. It returns a `workspace_key` (shown exactly once — it cannot be re-revealed, so store it before continuing) which you then send as `workspace_key` on your first ledger_track for a NEW agent_id. That first write returns the agent's own `agent_secret`, which authenticates every write after it. The free tier includes every rail, enforced budget caps, alerts, reports and the MCP server, capped at 3 agents per workspace. Minting is rate-limited per caller IP, the same limit the human door uses. Prefer to pay? POST /v1/billing/x402 with a wallet-signed payment needs no human and buys 24h of Pro (agent allowance per the live pass tier — see /pricing.md).
2026-10-11ledger_api_docschangedinput schema
2026-10-11ledger_wait_eventsadded
Long-poll an agent's event feed — how an agent with no public URL receives alerts. Webhooks (POST /v1/webhooks) push events to a URL you own; an agent on stdio MCP cannot host one, so it waits here instead. Call this in a loop: the call holds open up to `timeout` seconds (max 30) and returns when events arrive or the wait lapses. `consumer_id` names this consumer durably — pick a stable one (e.g. "claude-code-main") and reuse it. Each call returns a `cursor`; pass it back on your next call once you have processed that batch — that is the ack. To get restart redelivery, also pass `client_instance` (your process id or any per-boot token) and `client_started` (when your process booted): when the pair changes, events that were served but never acked come back with `redelivered: true`, so nothing is lost to a crash between serve and process. (The stdio MCP server supplies its own pid/started automatically — hosted callers must opt in because the gateway cannot see the client's process.) Each event is an envelope: id (deterministic — dedupe on it), kind (alert.raised | budget.warning | budget.exceeded | anomaly.detected), summary, context (agent_id, alert_type, timestamp), alerts_since_last_write (how many alerts are stacked up since the agent's last spend write — use it to throttle escalation), redelivered. Requires a credential: either the agent's own agent_secret or its workspace's workspace_key (same rule as GET /v1/agents/{agent_id}/events/wait).
2026-10-10ledger_set_budgetchangeddescription
before
Set spending caps for an agent. Warns at 80%, blocks spend when exceeded — enforced: a ledger_track call that would cross the cap is rejected. Dollar caps (monthly_cents/daily_cents) and token caps (monthly_tokens/ daily_tokens) are independent dimensions: dollar caps only cover non-"tokens" rails, token caps only cover rail="tokens" bookkeeping rows (tokens_in/tokens_out). Set both if the agent uses both. Monthly cap is required; the rest are optional (0 = no limit). Overwrites any existing budget for the agent. Claiming a brand-new agent_id requires your workspace_key; that first call mints an agent_secret (returned once — save it); later calls for that agent_id must pass the agent_secret back (no workspace_key needed again).
after · 78% of words in common
Set spending caps for an agent. Warns at 80%, blocks spend when exceeded — enforced: a ledger_track call that would cross the cap is rejected. Dollar caps (monthly_cents/daily_cents) and token caps (monthly_tokens/ daily_tokens) are independent dimensions: dollar caps only cover non-"tokens" rails, token caps only cover rail="tokens" bookkeeping rows (tokens_in/tokens_out). Set both if the agent uses both. Monthly cap is required; the rest are optional (0 = no limit). Overwrites any existing budget for the agent — with one rule: raising or removing an existing cap requires the workspace_key. An agent_secret can tighten its own caps but never loosen them; to grow an allowance the agent asks its owner (see ledger_request_approval). Claiming a brand-new agent_id requires your workspace_key; that first call mints an agent_secret (returned once — save it); later calls for that agent_id must pass the agent_secret back (no workspace_key needed again).
2026-10-09ledger_approval_decideadded
Approve or deny a pending spend permit — workspace owner only. The agent's own agent_secret can REQUEST an approval but can never decide one: a credential that can approve its own requests is not a control. decision must be 'approve' or 'deny'; only pending permits can be decided. An approved permit is consumed by the agent's next ledger_track within its amount — it is a one-shot exception, not a raised cap.
2026-10-09ledger_approvalsadded
List spend-approval permits — yours, or your whole workspace's.
2026-10-09ledger_request_approvaladded
Ask your workspace owner for a one-shot spend exception before a ledger_track that the cap would refuse. Creates a pending permit for exactly amount_cents on the given service. The owner (a human, or a supervisor agent holding the workspace_key) approves or denies it with ledger_approval_decide. An APPROVED permit is consumed by the next ledger_track for this agent whose amount fits inside it — the budget cap itself does not change. Permits expire after 1 hour undecided. Poll with ledger_approvals to see the decision. Claiming a brand-new agent_id requires workspace_key; otherwise pass the agent's agent_secret.
2026-10-02ledger_trackchangeddescription
before
Record a spend entry for an AI agent on any payment rail, with optional token counts. Claiming a brand-new agent_id requires your workspace_key (get one via x402 at POST /v1/billing/x402 — no human, no login — or at /start). That first call mints an agent_secret and returns it in the response — save it, every later call for that same agent_id must pass it back (no workspace_key needed again) or the write is rejected. Amounts are capped at $100,000/entry and must be >= 0. If a budget is set for this agent, an entry that would cross the monthly/daily cap is blocked, not just logged. Include tokens_in/tokens_out + model on every LLM call so token burn shows up in the /v1/tokens report.
after · 79% of words in common
Record a spend entry for an AI agent on any payment rail, with optional token counts. Claiming a brand-new agent_id requires your workspace_key (get one via x402 at POST /v1/billing/x402 — no human, no login — or at /start). That first call mints an agent_secret and returns it in the response — save it, every later call for that same agent_id must pass it back (no workspace_key needed again) or the write is rejected. Amounts are capped at $100,000/entry and must be >= 0. If a budget is set for this agent, an entry that would cross the monthly/daily cap is blocked, not just logged. Caps here bind the AMOUNT YOU REPORT — a caller that lies to amount_cents lies to the cap. The only enforcement against real spend is routing the provider call through the /proxy/{provider} rail, which prices from the provider's own usage block. Include tokens_in/tokens_out + model on every LLM call so token burn shows up in the /v1/tokens report.
2026-09-27ledger_list_agentsremoved
Owner-only: full cross-tenant listing of every agent ever claimed on this instance, with totals. Requires the operator's admin_secret — this is a portfolio-wide view, not a per-agent report (use ledger_report for that — it requires that agent's agent_secret or its workspace_key).
2026-09-27ledger_priceadded
What will this call cost? Priced from the same table the caps use. Exists because ledger_track requires the CALLER to supply amount_cents, so an agent whose spend is capped could under-report its own cost and stay under the cap. This returns the number the enforcement path would use, so an agent can report honestly (and plan before it spends). Cost = (tokens_in * in_rate + tokens_out * out_rate) / 1_000_000. If the model has cache rates, the standard in-rate is used, which is the conservative direction for a spend cap. Every price carries the source it came from and the date it was read, and `verified: false` means the number was NOT read off the provider's own pricing page. Treat an unverified price as an estimate, not a measurement.

Showing the latest 10. Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 97 / 100

provenance90

liveness100

freshness100

hygiene100

+repository +namespace-matches-repo +website +reachable +uptime-99% +updated-4d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://aiagentscity.com/mcp/` streamable-http	none	yes	99%	267 ms	2026-07-28	2026-10-20

Tools (18)

`ledger_alerts`read-only	Alert history for an agent: budget warnings (80% threshold) and spending spikes. Requires a credential: either the agent's own agent_secret or its workspace's workspace_key (same rule as GET /v1/alerts).
`ledger_api_docs`read-only	Self-serve documentation for AgentLedger — quickstart, MCP tools, REST endpoints, budget caps, error codes, and idempotency usage, as markdown.
`ledger_approval_decide`destructive	Approve or deny a pending spend permit — workspace owner only. The agent's own agent_secret can REQUEST an approval but can never decide one: a credential that can approve its own requests is not a control. decision must be 'approve' or 'deny'; only pending permits can be decided. An approved permit is consumed by the agent's next ledger_track within its amount — it is a one-shot exception, not a raised cap.
`ledger_approvals`read-only	List spend-approval permits — yours, or your whole workspace's.
`ledger_check_spend`read-only	Ask BEFORE you spend: may this agent spend this much right now? Returns allowed (true/false), a stable reason code (within_budget, over_monthly_cap, over_daily_cap, over_monthly_token_cap, over_daily_token_cap, no_budget_set, unpriced_model), a one-line message, the cost estimate, the price used (with its source and as_of date) and every budget window with cap, spent and remaining. Same decision the /proxy/{provider} gate enforces. Read-only: nothing is recorded or reserved, so record the spend with ledger_track afterwards. Give exactly one spend shape: amount_cents (any rail, e.g. an x402 purchase), OR model with tokens_in/tokens_out.
`ledger_examples`read-only	Complete, runnable Python recipe for a common AgentLedger integration pattern.
`ledger_price`read-only	What will this call cost? Priced from the same table the caps use. Exists because ledger_track requires the CALLER to supply amount_cents, so an agent whose spend is capped could under-report its own cost and stay under the cap. This returns the number the enforcement path would use, so an agent can report honestly (and plan before it spends). Cost = (tokens_in * in_rate + tokens_out * out_rate) / 1_000_000. If the model has cache rates, the standard in-rate is used, which is the conservative direction for a spend cap. Every price carries the source it came from and the date it was read, and `verified: false` means the number was NOT read off the provider's own pricing page. Treat an unverified price as an estimate, not a measurement.
`ledger_proxy_attach`read-only	Point your provider traffic at the proxy so budget caps are enforced BEFORE the provider is contacted, instead of being reported afterwards. This closes the gap where the brake was unreachable from MCP: an agent connected over MCP could record spend (ledger_track) but nothing could refuse a call. With this, the cap is enforced on every LLM call. Returns the base_url to use, the two headers to send, and the exact change for the OpenAI and Anthropic SDKs. Your provider credential is NOT part of this: it stays in Authorization / x-api-key and is only forwarded, never stored.
`ledger_report`read-only	Spend report for an agent over a rolling window. Returns total spend, breakdown by rail and by service, budget status (ok/warning/exceeded), detected anomalies, and entry count. Requires a credential: either the agent's own agent_secret or its workspace's workspace_key (same rule as GET /v1/report).
`ledger_request_approval`	Ask your workspace owner for a one-shot spend exception before a ledger_track that the cap would refuse. Creates a pending permit for exactly amount_cents on the given service. The owner (a human, or a supervisor agent holding the workspace_key) approves or denies it with ledger_approval_decide. An APPROVED permit is consumed by the next ledger_track for this agent whose amount fits inside it — the budget cap itself does not change. Permits expire after 1 hour undecided. Poll with ledger_approvals to see the decision. Claiming a brand-new agent_id requires workspace_key; otherwise pass the agent's agent_secret.
`ledger_revoke_secret`destructive	Invalidate an agent_id's agent_secret WITHOUT deleting its spend history. Use when a credential may have leaked, or to stop an agent writing. Subsequent writes to that agent fail with agent_secret_mismatch until you rotate a new secret in. The agent_id stays claimed, so no other workspace can claim it and inherit the ledger. Requires the workspace_key that owns agent_id. Returns {"agent_id", "revoked": True, "_note"}, or {"error", "error_code"}.
`ledger_rotate_secret`destructive	Mint a NEW agent_secret for an agent_id your workspace already owns, invalidating the old one. Use this to RECOVER an agent whose secret was lost: the previous credential stops working immediately. Requires the workspace_key that owns agent_id — an agent's own agent_secret cannot rotate itself, because a leaked agent credential must not be able to lock its real owner out. Unlike ledger_track this never claims a new agent_id: an unknown id returns agent_not_claimed. The new secret is returned ONCE. Store it before you drop the response. Returns {"agent_id", "agent_secret", "_note"}, or {"error", "error_code"}.
`ledger_set_budget`destructive	Set spending caps for an agent. Warns at 80%, blocks spend when exceeded — enforced: a ledger_track call that would cross the cap is rejected. Dollar caps (monthly_cents/daily_cents) and token caps (monthly_tokens/ daily_tokens) are independent dimensions: dollar caps only cover non-"tokens" rails, token caps only cover rail="tokens" bookkeeping rows (tokens_in/tokens_out). Set both if the agent uses both. Monthly cap is required; the rest are optional (0 = no limit). Overwrites any existing budget for the agent — with one rule: raising or removing an existing cap requires the workspace_key. An agent_secret can tighten its own caps but never loosen them; to grow an allowance the agent asks its owner (see ledger_request_approval). Claiming a brand-new agent_id requires your workspace_key; that first call mints an agent_secret (returned once — save it); later calls for that agent_id must pass the agent_secret back (no workspace_key needed again).
`ledger_start`	Get a FREE AgentLedger workspace with no credential and no arguments — the MCP equivalent of opening POST /start in a browser. Call this FIRST if you have no credentials yet. Every other tool here (ledger_track, ledger_set_budget, ledger_report, ledger_alerts) needs a workspace_key or an agent_secret, so a caller arriving with neither must start here or it has nowhere to go. Takes NO arguments on purpose: the goal is zero friction. It returns a `workspace_key` (shown exactly once — it cannot be re-revealed, so store it before continuing) which you then send as `workspace_key` on your first ledger_track for a NEW agent_id. That first write returns the agent's own `agent_secret`, which authenticates every write after it. The free tier includes every rail, enforced budget caps, alerts, reports and the MCP server, capped at 3 agents per workspace. Minting is rate-limited per caller IP, the same limit the human door uses. Prefer to pay? POST /v1/billing/x402 with a wallet-signed payment needs no human and buys 24h of Pro (agent allowance per the live pass tier — see /pricing.md).
`ledger_track`	Record a spend entry for an AI agent on any payment rail, with optional token counts. Claiming a brand-new agent_id requires your workspace_key (get one via x402 at POST /v1/billing/x402 — no human, no login — or at /start). That first call mints an agent_secret and returns it in the response — save it, every later call for that same agent_id must pass it back (no workspace_key needed again) or the write is rejected. Amounts are capped at $100,000/entry and must be >= 0. If a budget is set for this agent, an entry that would cross the monthly/daily cap is blocked, not just logged. Caps here bind the AMOUNT YOU REPORT — a caller that lies to amount_cents lies to the cap. The only enforcement against real spend is routing the provider call through the /proxy/{provider} rail, which prices from the provider's own usage block. Include tokens_in/tokens_out + model on every LLM call so token burn shows up in the /v1/tokens report.
`ledger_wait_events`read-only	Long-poll an agent's event feed — how an agent with no public URL receives alerts. Webhooks (POST /v1/webhooks) push events to a URL you own; an agent on stdio MCP cannot host one, so it waits here instead. Call this in a loop: the call holds open up to `timeout` seconds (max 30) and returns when events arrive or the wait lapses. `consumer_id` names this consumer durably — pick a stable one (e.g. "claude-code-main") and reuse it. Each call returns a `cursor`; pass it back on your next call once you have processed that batch — that is the ack. To get restart redelivery, also pass `client_instance` (your process id or any per-boot token) and `client_started` (when your process booted): when the pair changes, events that were served but never acked come back with `redelivered: true`, so nothing is lost to a crash between serve and process. (The stdio MCP server supplies its own pid/started automatically — hosted callers must opt in because the gateway cannot see the client's process.) Each event is an envelope: id (deterministic — dedupe on it), kind (alert.raised \| budget.warning \| budget.exceeded \| anomaly.detected), summary, context (agent_id, alert_type, timestamp), alerts_since_last_write (how many alerts are stacked up since the agent's last spend write — use it to throttle escalation), redelivered. Requires a credential: either the agent's own agent_secret or its workspace's workspace_key (same rule as GET /v1/agents/{agent_id}/events/wait).
`read_skill`	Read a product skill file by its skill:// URI.
`skills_list_tool`	List this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`.

Schemas: list_tools.

Similar MCP servers

More from io.github.entradox

And 1 more from this publisher.

Official server.json

{
  "name": "io.github.entradox/agent-ledger",
  "title": "AgentLedger",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://aiagentscity.com/mcp/",
      "type": "streamable-http"
    }
  ],
  "version": "0.4.7",
  "repository": {
    "url": "https://github.com/entradox/agent-ledger",
    "source": "github"
  },
  "websiteUrl": "https://aiagentscity.com",
  "description": "Meter, cap, and block AI agent spend before the provider is charged."
}