# SpendPreflight

> Operated by SpendPreflight: sanctions screening and allow/hold/block preflight for x402 payments.

- name: io.github.spendpreflight/spendpreflight
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 80/100 flags: no-repository
- quality: 72/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.spendpreflight%2Fspendpreflight
- tools: https://api.protogrid.dev/v1/servers/io.github.spendpreflight%2Fspendpreflight/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "spendpreflight": {
      "type": "http",
      "url": "https://api.spendpreflight.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 45
- drivers: +website +reachable +uptime-100% +updated-14d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 72/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 5 of 5 tools declare readOnlyHint or destructiveHint
- warn `tools.directory_hints`: 1 of 5 tools declare all four hints; missing: check_payee (destructiveHint); preflight_payment (destructiveHint); check_endpoint (destructiveHint); …
- pass `tools.token_cost`: about 1,743 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 11 tool changes in 30 days
- fail `stability.rug_pull`: 1 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 5, about 1,743 tokens to load them all
- tool set hash: 151667f8f5ff2ca265c8dce45b9cffef
- tools last changed: 2026-10-18T14:14:15.154Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.spendpreflight/spendpreflight.svg)](https://protogrid.dev/servers/io.github.spendpreflight/spendpreflight)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-18 `lint_endpoint` added
  - Free x402 Lint by SpendPreflight. Checks a public HTTPS endpoint with an unpaid GET: v1/v2 challenge shape, payTo/asset/network syntax, price, Bazaar metadata and browser CORS headers. Returns fixes and a public seven-day report link. No payment or credentials; GET cannot validate a POST-only endpoint or paid delivery. Do not submit private URLs.
- 2026-10-14 `get_service_info` changed (description, inputSchema, outputSchema)
  - before: Free, read-only service reference. Use first to learn prices, default spending rules, payment setup, trial allowance, and integration links. Takes no arguments and performs no payee screening or payment decision. Use check_payee for standalone payee risk; use preflight_payment for an x402 challenge or cart and an allow/hold/block decision.
  - after: Free, read-only service reference. Use when you need prices, default spending rules, payment setup, trial allowance, or a ready-to-use example call. If you already have a payment challenge or cart, call preflight_payment directly; this reference call is optional. Takes no arguments and performs no payee screening or payment decision. Use check_payee for standalone payee risk; use preflight_payment for an x402 challenge or cart and an allow/hold/block decision.
- 2026-10-14 `check_endpoint` changed (inputSchema)
- 2026-10-14 `preflight_payment` changed (description, inputSchema)
  - before: Spend preflight for AI agents. Send the x402 PaymentRequired body (v1 or v2) you received, or a cart, plus optional rules (per-payment max, hold threshold, daily cap, allowlists, new-domain days, endpoint category price multiple, liveness and payTo changes). Returns allow|hold|block with reasons, the cheapest acceptable payment option, and a receipt id. Read-only: never signs, settles, or holds funds. Use before every payment. It includes payee screening in its spending-rule decision. For standalone wallet, name, or domain screening without a payment, use check_payee instead. Each repeat call creates a new receipt and may consume another trial or paid call. Price $0.02 per call (free trial first).
  - after: Call this before any x402/USDC payment to evaluate the actual challenge or cart before signing. Spend preflight for AI agents. Send the x402 PaymentRequired body (v1 or v2) you received, or a cart, plus optional rules (per-payment max, hold threshold, daily cap, allowlists, new-domain days, endpoint category price multiple, liveness and payTo changes). Returns allow|hold|block with reasons, the cheapest acceptable payment option, and a receipt id. Read-only: never signs, settles, or holds funds. Use before every payment. It includes payee screening in its spending-rule decision. For standalone wallet, name, or domain screening without a payment, use check_payee instead. Each repeat call creates a new receipt and may consume another trial or paid call. Price $0.02 per call (free trial first).
- 2026-10-14 `check_payee` changed (description, inputSchema)
  - before: Payee risk check. Screens a payee wallet address and name against the OFAC SDN sanctions list and checks the merchant domain's registration age and DNS. Returns risk low|medium|high|unknown with flags such as sanctioned_address, sanctioned_name_possible, new_domain. Use for standalone payee screening before paying. Provide at least one of domain, address, or name; inputs may be combined, and domain accepts a hostname or URL. For an x402 challenge or cart and an allow/hold/block spending-rule decision, use preflight_payment instead. Price $0.01 per call (free trial first).
  - after: Payee risk check. Screens a payee wallet address and name against the OFAC SDN sanctions list and checks the merchant domain's registration age and DNS. Returns risk low|medium|high|unknown with flags such as sanctioned_address, sanctioned_name_possible, new_domain. Call this before a USDC payment when you only have a payee name, wallet or domain. Provide at least one of domain, address, or name; inputs may be combined, and domain accepts a hostname or URL. For an x402 challenge or cart and an allow/hold/block spending-rule decision, use preflight_payment instead. Price $0.01 per call (free trial first).
- 2026-10-10 `check_endpoint` added
  - Cached x402 endpoint observations, operated by SpendPreflight. Returns a transparent score (or unknown), its components and seven-day unpaid probe history for an already publicly listed URL. Never fetches the caller's URL or pays the endpoint. Unlisted, unavailable or stale data is not charged. This is not a paid-delivery or compliance guarantee. Provide the exact resource URL; add method when the URL has multiple advertised methods. Use for endpoint history and price context before paying. Use check_payee for wallet/name screening or preflight_payment for an allow/hold/block decision. Price $0.005 per cached lookup (shared free trial first). An unknown score means missing evidence; repeated paid calls may incur another charge.
- 2026-10-10 `preflight_payment` changed (description, inputSchema, outputSchema)
  - before: Spend preflight for AI agents. Send the x402 PaymentRequired body (v1 or v2) you received, or a cart, plus optional rules (per-payment max, hold threshold, daily cap, allowlists, new-domain days). Returns allow|hold|block with reasons, the cheapest acceptable payment option, and a receipt id. Read-only: never signs, settles, or holds funds. Use before every payment. It includes payee screening in its spending-rule decision. For standalone wallet, name, or domain screening without a payment, use check_payee instead. Each repeat call creates a new receipt and may consume another trial or paid call. Price $0.02 per call (free trial first).
  - after: Spend preflight for AI agents. Send the x402 PaymentRequired body (v1 or v2) you received, or a cart, plus optional rules (per-payment max, hold threshold, daily cap, allowlists, new-domain days, endpoint category price multiple, liveness and payTo changes). Returns allow|hold|block with reasons, the cheapest acceptable payment option, and a receipt id. Read-only: never signs, settles, or holds funds. Use before every payment. It includes payee screening in its spending-rule decision. For standalone wallet, name, or domain screening without a payment, use check_payee instead. Each repeat call creates a new receipt and may consume another trial or paid call. Price $0.02 per call (free trial first).
- 2026-10-10 `check_payee` changed (inputSchema)
- 2026-10-07 `get_service_info` changed (description) **meaning changed**
  - before: Free. Returns pricing, default spending rules, payment details, trial allowance, and integration links.
  - after: Free, read-only service reference. Use first to learn prices, default spending rules, payment setup, trial allowance, and integration links. Takes no arguments and performs no payee screening or payment decision. Use check_payee for standalone payee risk; use preflight_payment for an x402 challenge or cart and an allow/hold/block decision.
- 2026-10-07 `preflight_payment` changed (description)
  - before: Spend preflight for AI agents. Send the x402 PaymentRequired body (v1 or v2) you received, or a cart, plus optional rules (per-payment max, hold threshold, daily cap, allowlists, new-domain days). Returns allow|hold|block with reasons, the cheapest acceptable payment option, and a receipt id. Read-only: never signs, settles, or holds funds. Use before every payment. Price $0.02 per call (free trial first).
  - after: Spend preflight for AI agents. Send the x402 PaymentRequired body (v1 or v2) you received, or a cart, plus optional rules (per-payment max, hold threshold, daily cap, allowlists, new-domain days). Returns allow|hold|block with reasons, the cheapest acceptable payment option, and a receipt id. Read-only: never signs, settles, or holds funds. Use before every payment. It includes payee screening in its spending-rule decision. For standalone wallet, name, or domain screening without a payment, use check_payee instead. Each repeat call creates a new receipt and may consume another trial or paid call. Price $0.02 per call (free trial first).

Full history: https://api.protogrid.dev/v1/servers/io.github.spendpreflight%2Fspendpreflight/changes

## Remotes

- https://api.spendpreflight.com/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (5)

- `check_endpoint`: Cached x402 endpoint observations, operated by SpendPreflight. Returns a transparent score (or unknown), its components and seven-day unpaid probe history for an already publicly listed URL. Never fetches the caller's URL or pays the endpoint. Unlisted, unavailable or stale data is not charged. This is not a paid-delivery or compliance guarantee. Provide the exact resource URL; add method when the URL has multiple advertised methods. Use for endpoint history and price context before paying. Use check_payee for wallet/name screening or preflight_payment for an allow/hold/block decision. Price $0.005 per cached lookup (shared free trial first). An unknown score means missing evidence; repeated paid calls may incur another charge.
- `check_payee`: Payee risk check. Screens a payee wallet address and name against the OFAC SDN sanctions list and checks the merchant domain's registration age and DNS. Returns risk low|medium|high|unknown with flags such as sanctioned_address, sanctioned_name_possible, new_domain. Call this before a USDC payment when you only have a payee name, wallet or domain. Provide at least one of domain, address, or name; inputs may be combined, and domain accepts a hostname or URL. For an x402 challenge or cart and an allow/hold/block spending-rule decision, use preflight_payment instead. Price $0.01 per call (free trial first).
- `get_service_info`: Free, read-only service reference. Use when you need prices, default spending rules, payment setup, trial allowance, or a ready-to-use example call. If you already have a payment challenge or cart, call preflight_payment directly; this reference call is optional. Takes no arguments and performs no payee screening or payment decision. Use check_payee for standalone payee risk; use preflight_payment for an x402 challenge or cart and an allow/hold/block decision.
- `lint_endpoint`: Free x402 Lint by SpendPreflight. Checks a public HTTPS endpoint with an unpaid GET: v1/v2 challenge shape, payTo/asset/network syntax, price, Bazaar metadata and browser CORS headers. Returns fixes and a public seven-day report link. No payment or credentials; GET cannot validate a POST-only endpoint or paid delivery. Do not submit private URLs.
- `preflight_payment`: Call this before any x402/USDC payment to evaluate the actual challenge or cart before signing. Spend preflight for AI agents. Send the x402 PaymentRequired body (v1 or v2) you received, or a cart, plus optional rules (per-payment max, hold threshold, daily cap, allowlists, new-domain days, endpoint category price multiple, liveness and payTo changes). Returns allow|hold|block with reasons, the cheapest acceptable payment option, and a receipt id. Read-only: never signs, settles, or holds funds. Use before every payment. It includes payee screening in its spending-rule decision. For standalone wallet, name, or domain screening without a payment, use check_payee instead. Each repeat call creates a new receipt and may consume another trial or paid call. Price $0.02 per call (free trial first).