# SpendGate

> Score a planned spend before an agent pays. Verdicts: approve, ask_human, or block.

- name: io.github.toolweather/spendgate
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 97/100
- quality: 85/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.toolweather%2Fspendgate
- tools: https://api.protogrid.dev/v1/servers/io.github.toolweather%2Fspendgate/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "spendgate": {
      "type": "http",
      "url": "https://spendgate.toolweather.workers.dev/mcp",
      "headers": {
        "Authorization": "Bearer ${SPENDGATE_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${SPENDGATE_TOKEN}`.

## Trust

- hygiene: 100
- liveness: 100
- freshness: 100
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-100% +updated-5d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 85/100 (new)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 2 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 4 of 4 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 2,298 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool history recorded for 4 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 4, about 2,298 tokens to load them all
- tool set hash: 04fedaa3db65e23a641b25f979eefae6
- tools last changed: 2026-10-16T17:42:37.784Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.toolweather/spendgate.svg)](https://protogrid.dev/servers/io.github.toolweather/spendgate)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-16 `set_wallet_allowlist` added
  - Store the 0x wallets this sg_live_ key is allowed to spend from. Call it when an operator names those wallets, once, not on every spend, and not to approve a payment. score_spend still has to run before any transfer. A block or ask_human from score_spend means do not broadcast. Pass allowed_wallets. This replaces the stored list for that key in one write. An empty array stores an allowlist that authorizes no wallet, so a later score with from_wallet and no call-level list returns block, reason unauthorized_wallet. allowed_wallets is required. At most 32 addresses. A published developer test account (Hardhat/Anvil default accounts, Ganache, BIP-39 test, and other public test mnemonics) is rejected with dev_wallet and is not stored. Requires api_key, or Authorization: Bearer sg_live_. Anonymous and bundle callers cannot store a list; they can pass allowed_wallets on score_spend instead. An unrecognized key returns invalid_api_key. A missing key returns api_key_required. Does not consume a score and is never billed. Returns key_id, key_prefix, allowed_wallets, and updated_at. A new key starts with no list, which makes a later from_wallet ask_human with reason wallet_unverified until you set one. Do not put a private key or a recovery phrase in this tool. Addresses only.
- 2026-10-16 `score_spend` changed (description, inputSchema)
  - before: Score one planned payment before it is sent: a crypto transfer, gift card, subscription, or paid API or merchant. Do not use it for a pure read, or for a status_check under $1 you will not pay; that still burns a free score and approves unless a budget you pass is exceeded. Each call uses one free score (anonymous 100/UTC day, sg_live_ key 1,000 from get_api_key). Past that cap the call is HTTP 402 and costs 0.001 USDC on Base via x402. It does not pay the merchant. A domain, https URL, or 0x payee that is not on the local known-host list is checked with PayCheck. Trusted counts as a known merchant. Block means do not pay, including under the micro threshold. If PayCheck is unreachable, local merchant rules are used and the score still returns. While free quota remains, the same arguments consume another score. category overrides purpose. When category is omitted, purpose is matched as a category name; any other prose is unknown risk. merchant overrides endpoint when both are set. A set daily_budget_remaining or monthly_budget_remaining blocks when amount is greater; omitted budgets are skipped. Returns score 0-100, verdict approve|ask_human|block, reasons, recommended_action, checked_at, detail, and quota (daily_limit, used_today, remaining_today, paid_today, resets_at). approve means pay; ask_human means stop for a person; block means do not pay. Read the cap with get_quota instead of spending a score.
  - after: Score one planned payment before it is sent: a crypto transfer, gift card, subscription, or paid API or merchant. Do not use it for a pure read, or for a status_check under $1 you will not pay; that still burns a free score and approves unless a budget you pass is exceeded. Each call uses one free score (anonymous 100/UTC day, sg_live_ key 1,000 from get_api_key). Past that cap the call is HTTP 402 and costs 0.001 USDC on Base via x402. It does not pay the merchant. A domain, https URL, or 0x payee that is not on the local known-host list is checked with PayCheck. Trusted counts as a known merchant. Block means do not pay, including under the micro threshold. If PayCheck is unreachable, local merchant rules are used and the score still returns. While free quota remains, the same arguments consume another score. category overrides purpose. When category is omitted, purpose is matched as a category name; any other prose is unknown risk. merchant overrides endpoint when both are set. A set daily_budget_remaining or monthly_budget_remaining blocks when amount is greater; omitted budgets are skipped. Pass from_wallet, the 0x account that would sign or pay gas, whenever the spend leaves a wallet. Omit from_wallet and the verdict is unchanged. Pass allowed_wallets to allowlist this call, or omit it to use the list stored for the sg_live_ key by set_wallet_allowlist. An empty allowed_wallets array authorizes no wallet. Do not derive a key from a public recovery phrase, and do not spend from a wallet the task did not give you. A published Hardhat, Anvil, Ganache, BIP-39 test, or other public dev-mnemonic account is block with reason dev_wallet, including under $1, even if that address is allowlisted. A from_wallet that is not on the effective allowlist is block with reason unauthorized_wallet. A from_wallet with no allowlist on the call and none stored for the key is ask_human with reason wallet_unverified. Stop and ask a person. Do not broadcast. Returns score 0-100, verdict approve|ask_human|block, reasons, recommended_action, checked_at, payment_source (from_wallet, allowlisted, checked_at, reason, and signature only when the server already has BUNDLE_PROXY_SECRET), detail, and quota (daily_limit, used_today, remaining_today, paid_today, resets_at). approve means pay; ask_human means stop for a person; block means do not pay. Read the cap with get_quota instead of spending a score.
- 2026-10-15 `get_api_key` changed (title, description, inputSchema, annotations) **meaning changed**
  - before: Mint a free SpendGate API key. The secret is returned once. Store it and send it as Authorization: Bearer, or as api_key on later score_spend calls. Do not call this on every turn.
  - after: Mint one free sg_live_ key so later score_spend and get_quota calls use 1,000 scores per UTC day instead of the anonymous 100. Call once per agent when you will score often and have no stored key. Do not call every turn, do not mint again if you already stored the secret, and do not call just to read remaining scores (use get_quota). Returns the secret once as api_key, plus key_id, key_prefix, label, tier free, daily_limit, created_at, and note. Only a hash is stored, so the secret cannot be shown again. Keys do not expire and there is no revoke tool; a lost key stays valid, and an unknown or non-sg_live_ value later returns invalid_api_key. At most 20 mints per client per UTC day, then key_mint_limit and no new key. Minting is free and does not consume a score. Send the secret later as Authorization: Bearer or as api_key. label is an optional stored name and does not set a cap, a scope, or an expiry.
- 2026-10-15 `get_quota` changed (title, description, inputSchema, annotations) **meaning changed**
  - before: Read how many free SpendGate scores remain today for this anonymous caller or API key. Does not consume a score and is not billed.
  - after: Read today's free-score balance. Prefer this over score_spend when you are not judging a specific payment, including before a batch or after a 402: it does not consume a score, returns no verdict, and is never billed. Do not use it to approve or block a spend. Pass api_key for that sg_live_ key (tier free, 1,000/UTC day); omit it for this client's anonymous bucket (tier anonymous, 100/UTC day). An unrecognized or non-sg_live_ key returns invalid_api_key and does not fall back. Returns subject (anonymous|api_key|bundle), key_id, key_prefix, tier (anonymous|free|bundle), daily_limit, used_today, remaining_today, paid_today, price_usd, price_atomic, asset (USDC), network, resets_at (next UTC midnight), and paid_configured. Mint a higher cap with get_api_key.
- 2026-10-15 `score_spend` changed (title, description, inputSchema, annotations) **meaning changed**
  - before: Score a planned payment before sending it. Call this before any tool that transfers crypto, buys a gift card, starts a subscription, or pays an API or merchant. Pass amount in USD, category, merchant or endpoint URL, and any budget remaining. Returns score 0-100, verdict approve | ask_human | block, reasons, and recommended_action.
  - after: Score one planned payment before it is sent: a crypto transfer, gift card, subscription, or paid API or merchant. Do not use it for a pure read, or for a status_check under $1 you will not pay; that still burns a free score and approves unless a budget you pass is exceeded. Each call uses one free score (anonymous 100/UTC day, sg_live_ key 1,000 from get_api_key). Past that cap the call is HTTP 402 and costs 0.001 USDC on Base via x402. It does not pay the merchant. A domain, https URL, or 0x payee that is not on the local known-host list is checked with PayCheck. Trusted counts as a known merchant. Block means do not pay, including under the micro threshold. If PayCheck is unreachable, local merchant rules are used and the score still returns. While free quota remains, the same arguments consume another score. category overrides purpose. When category is omitted, purpose is matched as a category name; any other prose is unknown risk. merchant overrides endpoint when both are set. A set daily_budget_remaining or monthly_budget_remaining blocks when amount is greater; omitted budgets are skipped. Returns score 0-100, verdict approve|ask_human|block, reasons, recommended_action, checked_at, detail, and quota (daily_limit, used_today, remaining_today, paid_today, resets_at). approve means pay; ask_human means stop for a person; block means do not pay. Read the cap with get_quota instead of spending a score.

Full history: https://api.protogrid.dev/v1/servers/io.github.toolweather%2Fspendgate/changes

## Remotes

- https://spendgate.toolweather.workers.dev/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (4)

- `get_api_key`: Mint one free sg_live_ key so later score_spend and get_quota calls use 1,000 scores per UTC day instead of the anonymous 100. Call once per agent when you will score often and have no stored key. Do not call every turn, do not mint again if you already stored the secret, and do not call just to read remaining scores (use get_quota). Returns the secret once as api_key, plus key_id, key_prefix, label, tier free, daily_limit, created_at, and note. Only a hash is stored, so the secret cannot be shown again. Keys do not expire and there is no revoke tool; a lost key stays valid, and an unknown or non-sg_live_ value later returns invalid_api_key. At most 20 mints per client per UTC day, then key_mint_limit and no new key. Minting is free and does not consume a score. Send the secret later as Authorization: Bearer or as api_key. label is an optional stored name and does not set a cap, a scope, or an expiry.
- `get_quota`: Read today's free-score balance. Prefer this over score_spend when you are not judging a specific payment, including before a batch or after a 402: it does not consume a score, returns no verdict, and is never billed. Do not use it to approve or block a spend. Pass api_key for that sg_live_ key (tier free, 1,000/UTC day); omit it for this client's anonymous bucket (tier anonymous, 100/UTC day). An unrecognized or non-sg_live_ key returns invalid_api_key and does not fall back. Returns subject (anonymous|api_key|bundle), key_id, key_prefix, tier (anonymous|free|bundle), daily_limit, used_today, remaining_today, paid_today, price_usd, price_atomic, asset (USDC), network, resets_at (next UTC midnight), and paid_configured. Mint a higher cap with get_api_key.
- `score_spend`: Score one planned payment before it is sent: a crypto transfer, gift card, subscription, or paid API or merchant. Do not use it for a pure read, or for a status_check under $1 you will not pay; that still burns a free score and approves unless a budget you pass is exceeded. Each call uses one free score (anonymous 100/UTC day, sg_live_ key 1,000 from get_api_key). Past that cap the call is HTTP 402 and costs 0.001 USDC on Base via x402. It does not pay the merchant. A domain, https URL, or 0x payee that is not on the local known-host list is checked with PayCheck. Trusted counts as a known merchant. Block means do not pay, including under the micro threshold. If PayCheck is unreachable, local merchant rules are used and the score still returns. While free quota remains, the same arguments consume another score. category overrides purpose. When category is omitted, purpose is matched as a category name; any other prose is unknown risk. merchant overrides endpoint when both are set. A set daily_budget_remaining or monthly_budget_remaining blocks when amount is greater; omitted budgets are skipped. Pass from_wallet, the 0x account that would sign or pay gas, whenever the spend leaves a wallet. Omit from_wallet and the verdict is unchanged. Pass allowed_wallets to allowlist this call, or omit it to use the list stored for the sg_live_ key by set_wallet_allowlist. An empty allowed_wallets array authorizes no wallet. Do not derive a key from a public recovery phrase, and do not spend from a wallet the task did not give you. A published Hardhat, Anvil, Ganache, BIP-39 test, or other public dev-mnemonic account is block with reason dev_wallet, including under $1, even if that address is allowlisted. A from_wallet that is not on the effective allowlist is block with reason unauthorized_wallet. A from_wallet with no allowlist on the call and none stored for the key is ask_human with reason wallet_unverified. Stop and ask a person. Do not broadcast. Returns score 0-100, verdict approve|ask_human|block, reasons, recommended_action, checked_at, payment_source (from_wallet, allowlisted, checked_at, reason, and signature only when the server already has BUNDLE_PROXY_SECRET), detail, and quota (daily_limit, used_today, remaining_today, paid_today, resets_at). approve means pay; ask_human means stop for a person; block means do not pay. Read the cap with get_quota instead of spending a score.
- `set_wallet_allowlist`: Store the 0x wallets this sg_live_ key is allowed to spend from. Call it when an operator names those wallets, once, not on every spend, and not to approve a payment. score_spend still has to run before any transfer. A block or ask_human from score_spend means do not broadcast. Pass allowed_wallets. This replaces the stored list for that key in one write. An empty array stores an allowlist that authorizes no wallet, so a later score with from_wallet and no call-level list returns block, reason unauthorized_wallet. allowed_wallets is required. At most 32 addresses. A published developer test account (Hardhat/Anvil default accounts, Ganache, BIP-39 test, and other public test mnemonics) is rejected with dev_wallet and is not stored. Requires api_key, or Authorization: Bearer sg_live_. Anonymous and bundle callers cannot store a list; they can pass allowed_wallets on score_spend instead. An unrecognized key returns invalid_api_key. A missing key returns api_key_required. Does not consume a score and is never billed. Returns key_id, key_prefix, allowed_wallets, and updated_at. A new key starts with no list, which makes a later from_wallet ask_human with reason wallet_unverified until you set one. Do not put a private key or a recovery phrase in this tool. Addresses only.