Search / io.github.robertoyanguas-ops/assay
assay
R0· no sign-inA2A & MCP Pre-Flight Security: SHA-256 tool schema rug-pull detection and liveness grades.
v0.4.2 · active · descriptor JSON · versions
Search / io.github.robertoyanguas-ops/assay
R0· no sign-inA2A & MCP Pre-Flight Security: SHA-256 tool schema rug-pull detection and liveness grades.
v0.4.2 · active · descriptor JSON · versions
{
"mcpServers": {
"assay": {
"type": "http",
"url": "https://assay-207908449630.us-central1.run.app/mcp"
}
}
}claude mcp add --transport http assay https://assay-207908449630.us-central1.run.app/mcp[mcp_servers.assay]
url = "https://assay-207908449630.us-central1.run.app/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"assay": {
"type": "remote",
"url": "https://assay-207908449630.us-central1.run.app/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"assay": {
"type": "http",
"url": "https://assay-207908449630.us-central1.run.app/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=assay&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vYXNzYXktMjA3OTA4NDQ5NjMwLnVzLWNlbnRyYWwxLnJ1bi5hcHAvbWNwIn0%3D"
}{
"servers": {
"assay": {
"type": "http",
"url": "https://assay-207908449630.us-central1.run.app/mcp"
}
}
}{
"mcpServers": {
"assay": {
"httpUrl": "https://assay-207908449630.us-central1.run.app/mcp"
}
}
}extensions:
"assay":
enabled: true
name: "assay"
type: streamable_http
uri: "https://assay-207908449630.us-central1.run.app/mcp"
timeout: 300
protocol.modernsupports 2026-07-28 (server/discover)protocol.statelessanswers without a sessionprotocol.transportstreamable HTTPprotocol.list_ttltools/list carries no ttlMs, so clients re-fetch itauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotations4 of 4 tools declare readOnlyHint or destructiveHinttools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHinttools.token_costabout 1,642 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changes, stability.rug_pulltool history recorded for 3 of the 7 days neededdeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageassay_get_ledger_policychangedoutput schemaassay_verify_deliverychangedoutput schemaassay_probechangedoutput schemaassay_preflightchangedoutput schemaassay_get_ledger_policychangeddescription, input schemaRetrieve historical conformance observations and manage pinned SHA-256 tools/list policy hashes in the Assay ledger for a target endpoint. When expected_tools_hash is provided, it pins that 64-hex digest as the target's baseline policy and compares it against the latest stored observation; when omitted, it returns the stored dossier and last 20 drift observations without network probing unless the target is unindexed. Idempotent; first 5 calls/IP are free. Use to audit historical drift or pin mcp-lock.json hashes; for live pre-execution gating use assay_preflight; for live re-indexing use assay_probe; for post-payment SLA receipts use assay_verify_delivery.
Retrieve historical conformance observations and manage pinned SHA-256 tools/list policy hashes in the Assay ledger for a target endpoint. When expected_tools_hash is provided, it pins that 64-hex digest as the target's baseline policy and compares it against the latest stored observation; when omitted, it returns the stored dossier and last 20 drift observations without network probing unless the target is unindexed. Idempotent; first 5 calls/IP are free. Use to audit historical drift or pin mcp-lock.json hashes; for live pre-execution gating use assay_preflight; for live re-indexing use assay_probe; for post-payment SLA receipts use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.
assay_verify_deliverychangeddescription, input schemaAudit a paid x402 or A2A provider after payment to confirm delivery or prove an SLA breach with an HMAC-SHA256 signed receipt. Passing status_code >= 500 forces verdict='sla_breach_confirmed' even if the live re-probe succeeds, while passing tx_hash cryptographically binds your Base or Solana payment signature into the receipt (omitting tx_hash still verifies liveness and issues a probe-bound receipt). Non-destructive; first 5 calls/IP are free and failed target connections do not throw tool errors. Use only after paying a provider; before payment use assay_preflight; for public indexing use assay_probe; for policy history use assay_get_ledger_policy.
Audit a paid x402 or A2A provider after payment to confirm delivery or prove an SLA breach with an HMAC-SHA256 signed receipt. Passing status_code >= 500 forces verdict='sla_breach_confirmed' even if the live re-probe succeeds, while passing tx_hash cryptographically binds your Base or Solana payment signature into the receipt (omitting tx_hash still verifies liveness and issues a probe-bound receipt). Non-destructive; first 5 calls/IP are free and failed target connections do not throw tool errors. Use only after paying a provider; before payment use assay_preflight; for public indexing use assay_probe; for policy history use assay_get_ledger_policy. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.
assay_probechangeddescription, input schemaRegister a new remote MCP, A2A, or x402 endpoint or refresh its public Assay Observatory dossier by running a live HTTP, agent-card, and JSON-RPC tools/list inspection without policy gating. Target must be a public HTTPS origin (private IPs are rejected with a 400 error); each call appends a timestamped observation and increments rug_pulls if tools_hash drifted since the prior stored observation. Writes to the public ledger; first 5 calls/IP are free and retries are idempotent on steady schemas. Use to onboard or re-index a server; for pre-call allow/deny gating use assay_preflight; for historical observations or hash pinning use assay_get_ledger_policy; for post-payment disputes use assay_verify_delivery.
Register a new remote MCP, A2A, or x402 endpoint or refresh its public Assay Observatory dossier by running a live HTTP, agent-card, and JSON-RPC tools/list inspection without policy gating. Target must be a public HTTPS origin (private IPs are rejected with a 400 error); each call appends a timestamped observation and increments rug_pulls if tools_hash drifted since the prior stored observation. Writes to the public ledger; first 5 calls/IP are free and retries are idempotent on steady schemas. Use to onboard or re-index a server; for pre-call allow/deny gating use assay_preflight; for historical observations or hash pinning use assay_get_ledger_policy; for post-payment disputes use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.
assay_preflightchangeddescription, input schemaGate a remote MCP, A2A, or x402 endpoint before calling or paying it by probing live JSON-RPC reachability, hashing tools/list (SHA-256), and scanning for prompt-injection poisoning. When expected_tools_hash is provided, any mismatch against the live tools/list digest forces verdict='deny' to block silent schema rug-pulls; when omitted, verdict reflects liveness and injection safety alone. Read-only gate; first 5 calls/IP are free and quota-exceeded calls return a 402 top-up prompt. Use before tool execution or payment; to register or refresh public leaderboard telemetry use assay_probe; to read or pin stored policy hashes use assay_get_ledger_policy; after payment use assay_verify_delivery.
Gate a remote MCP, A2A, or x402 endpoint before calling or paying it by probing live JSON-RPC reachability, hashing tools/list (SHA-256), and scanning for prompt-injection poisoning. When expected_tools_hash is provided, any mismatch against the live tools/list digest forces verdict='deny' to block silent schema rug-pulls; when omitted, verdict reflects liveness and injection safety alone. Read-only gate; first 5 calls/IP are free and quota-exceeded calls return a 402 top-up prompt. Use before tool execution or payment; to register or refresh public leaderboard telemetry use assay_probe; to read or pin stored policy hashes use assay_get_ledger_policy; after payment use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.
assay_get_ledger_policychangedtitle, description, input schema, annotationsmeaning changedQuery historical conformance observations, rug-pull drift events, and canonical SHA-256 tools/list policy hashes (expected_tools_hash) for a target MCP or A2A endpoint. Returns {verdict, reason, receipt, pinned_tools_hash, observations, dossier}. Use to audit historical ledger data or pin expected_tools_hash in mcp-lock.json; for pre-flight allow/deny gating use assay_preflight.
Retrieve historical conformance observations and manage pinned SHA-256 tools/list policy hashes in the Assay ledger for a target endpoint. When expected_tools_hash is provided, it pins that 64-hex digest as the target's baseline policy and compares it against the latest stored observation; when omitted, it returns the stored dossier and last 20 drift observations without network probing unless the target is unindexed. Idempotent; first 5 calls/IP are free. Use to audit historical drift or pin mcp-lock.json hashes; for live pre-execution gating use assay_preflight; for live re-indexing use assay_probe; for post-payment SLA receipts use assay_verify_delivery.
assay_verify_deliverychangeddescription, input schemameaning changedIndependently probe a paid x402/A2A provider after payment to verify delivery or confirm an SLA breach. Combines reported status_code with a live probe and binds tx_hash into an HMAC-SHA256 receipt. Returns {verdict ('delivery_verified'|'sla_breach_confirmed'), sla_breach, grade, score, sla_receipt ('asr_sla_...')}. Use only after paying a provider; before payment use assay_preflight. First 5 calls/IP free.
Audit a paid x402 or A2A provider after payment to confirm delivery or prove an SLA breach with an HMAC-SHA256 signed receipt. Passing status_code >= 500 forces verdict='sla_breach_confirmed' even if the live re-probe succeeds, while passing tx_hash cryptographically binds your Base or Solana payment signature into the receipt (omitting tx_hash still verifies liveness and issues a probe-bound receipt). Non-destructive; first 5 calls/IP are free and failed target connections do not throw tool errors. Use only after paying a provider; before payment use assay_preflight; for public indexing use assay_probe; for policy history use assay_get_ledger_policy.
Showing the latest 10. Full history: list_changes · trend: quality JSON.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+reachable +uptime-100% +updated-3d-ago -no-repository
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://assay-207908449630.us-central1.run.app/mcp streamable-http | none | yes | 100% | 233 ms | 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26 | 2026-10-19 |
assay_get_ledger_policy | Retrieve historical conformance observations and manage pinned SHA-256 tools/list policy hashes in the Assay ledger for a target endpoint. When expected_tools_hash is provided, it pins that 64-hex digest as the target's baseline policy and compares it against the latest stored observation; when omitted, it returns the stored dossier and last 20 drift observations without network probing unless the target is unindexed. Idempotent; first 5 calls/IP are free. Use to audit historical drift or pin mcp-lock.json hashes; for live pre-execution gating use assay_preflight; for live re-indexing use assay_probe; for post-payment SLA receipts use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'. |
assay_preflightread-only | Gate a remote MCP, A2A, or x402 endpoint before calling or paying it by probing live JSON-RPC reachability, hashing tools/list (SHA-256), and scanning for prompt-injection poisoning. When expected_tools_hash is provided, any mismatch against the live tools/list digest forces verdict='deny' to block silent schema rug-pulls; when omitted, verdict reflects liveness and injection safety alone. Read-only gate; first 5 calls/IP are free and quota-exceeded calls return a 402 top-up prompt. Use before tool execution or payment; to register or refresh public leaderboard telemetry use assay_probe; to read or pin stored policy hashes use assay_get_ledger_policy; after payment use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'. |
assay_probe | Register a new remote MCP, A2A, or x402 endpoint or refresh its public Assay Observatory dossier by running a live HTTP, agent-card, and JSON-RPC tools/list inspection without policy gating. Target must be a public HTTPS origin (private IPs are rejected with a 400 error); each call appends a timestamped observation and increments rug_pulls if tools_hash drifted since the prior stored observation. Writes to the public ledger; first 5 calls/IP are free and retries are idempotent on steady schemas. Use to onboard or re-index a server; for pre-call allow/deny gating use assay_preflight; for historical observations or hash pinning use assay_get_ledger_policy; for post-payment disputes use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'. |
assay_verify_delivery | Audit a paid x402 or A2A provider after payment to confirm delivery or prove an SLA breach with an HMAC-SHA256 signed receipt. Passing status_code >= 500 forces verdict='sla_breach_confirmed' even if the live re-probe succeeds, while passing tx_hash cryptographically binds your Base or Solana payment signature into the receipt (omitting tx_hash still verifies liveness and issues a probe-bound receipt). Non-destructive; first 5 calls/IP are free and failed target connections do not throw tool errors. Use only after paying a provider; before payment use assay_preflight; for public indexing use assay_probe; for policy history use assay_get_ledger_policy. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'. |
Schemas: list_tools.
And 17 more from this publisher.
{
"name": "io.github.robertoyanguas-ops/assay",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://assay-207908449630.us-central1.run.app/mcp",
"type": "streamable-http"
}
],
"version": "0.4.2",
"description": "A2A & MCP Pre-Flight Security: SHA-256 tool schema rug-pull detection and liveness grades."
}