ExitProof

by davisvillelabs.com · remote · no sign-in to list tools · v0.1.0 · published by com.davisvillelabs

Reversibility intelligence and durable exit evidence for AI agents before real-world commitments.

Final · 3Changes · 1

Compare Registry entry

6 tools: 3 do something that can't be undone, 1 change things and 2 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone3Claude Code: ask: see these tools
Changes things1Claude Code: ask: see these tools
Only reads2Claude Code: allow: see these tools

17 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http exitproof https://exitproof.davisvillelabs.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn16 info

Warncheck_reversibility
The server marks "check_reversibility" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "evaluate": a word for a change.
What this check looks for
Infocheck_reversibility
The input schema at properties.merchant.description mentions "credentials".
Matched text
inputSchema.properties.merchant.description: "...erlays; do not include account numbers, credentials, or secrets."
What this check looks for
Infocheck_reversibility
The input schema at properties.checkout_terms.properties.source_url.description mentions "credentials".
Matched text
inputSchema.properties.checkout_terms.properties.source_url.description: "...ed transaction terms. ExitProof removes credentials, query parameters, and fragments before..."
What this check looks for
Infocheck_agent_purchase
The description mentions "credentials".
Matched text
description: "...gnals. ExitProof never forwards payment credentials and never sends a live POST, PUT, PATCH..."
What this check looks for
Infocheck_agent_purchase
The input schema at description mentions "credential".
Matched text
inputSchema.description: "...P purchase. ExitProof either performs a credential-free GET/HEAD probe or analyzes a 402 c..."
What this check looks for
Infocheck_agent_purchase
The input schema at properties.target_url.description mentions "Credentials".
Matched text
inputSchema.properties.target_url.description: "...dpoint the agent is considering paying. Credentials, localhost, private-address literals, a..."
What this check looks for

Show 11 more findings

Infocheck_agent_purchase
The input schema at properties.live_probe.description mentions "credential".
Matched text
inputSchema.properties.live_probe.description: "...ether ExitProof may make one anonymous, credential-free request to target_url. Defaults tr..."
What this check looks for
Infocheck_agent_purchase
The input schema at properties.observed_response.description mentions "credential".
Matched text
inputSchema.properties.observed_response.description: "...challenge headers only, never a payment credential."
What this check looks for
Infocreate_exit_manifest
The description mentions "credential".
Matched text
description: "...cal settled retry with the same payment credential recovers the same manifest without a se..."
What this check looks for
Infocreate_exit_manifest
The input schema at properties.merchant.description mentions "credentials".
Matched text
inputSchema.properties.merchant.description: "...erlays; do not include account numbers, credentials, or secrets."
What this check looks for
Infocreate_exit_manifest
The input schema at properties.checkout_terms.properties.source_url.description mentions "credentials".
Matched text
inputSchema.properties.checkout_terms.properties.source_url.description: "...ed transaction terms. ExitProof removes credentials, query parameters, and fragments before..."
What this check looks for
Infoget_exit_manifest
The description mentions "credentials".
Matched text
description: "...idence; missing, expired, or mismatched credentials fail without modifying the manifest."
What this check looks for
Infoget_exit_manifest
The input schema at description mentions "Credentials".
Matched text
inputSchema.description: "Credentials for one previously created Exit Manifes..."
What this check looks for
Infoget_exit_manifest
The input schema at properties.access_token.description mentions "credential".
Matched text
inputSchema.properties.access_token.description: "...uired with manifest_id; treat it like a credential and do not log or expose it."
What this check looks for
Infobuild_exit_pack
The description mentions "credential".
Matched text
description: "...est_id and access_token together as the credential pair returned by create_exit_manifest o..."
What this check looks for
Infobuild_exit_pack
The input schema at description mentions "Credentials".
Matched text
inputSchema.description: "Credentials for one previously created Exit Manifes..."
What this check looks for
Infobuild_exit_pack
The input schema at properties.access_token.description mentions "credential".
Matched text
inputSchema.properties.access_token.description: "...uired with manifest_id; treat it like a credential and do not log or expose it."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Can't be undone 3Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

check_agent_purchaseInspect one autonomous HTTP purchase before the calling agent pays it.5 findings
Why it is in this group
- The name "check_agent_purchase" says "purchase": a word that usually means money moves, which cannot be taken back.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...gnals. ExitProof never forwards payment credentials and never sends a live POST, PUT, PATCH..."
  What this check looks for
- Info
  The input schema at description mentions "credential".
  Matched text
  inputSchema.description: "...P purchase. ExitProof either performs a credential-free GET/HEAD probe or analyzes a 402 c..."
  What this check looks for
- Info
  The input schema at properties.target_url.description mentions "Credentials".
  Matched text
  inputSchema.properties.target_url.description: "...dpoint the agent is considering paying. Credentials, localhost, private-address literals, a..."
  What this check looks for
- Info
  The input schema at properties.live_probe.description mentions "credential".
  Matched text
  inputSchema.properties.live_probe.description: "...ether ExitProof may make one anonymous, credential-free request to target_url. Defaults tr..."
  What this check looks for
- Info
  The input schema at properties.observed_response.description mentions "credential".
  Matched text
  inputSchema.properties.observed_response.description: "...challenge headers only, never a payment credential."
  What this check looks for
Description, as the server wrote it
Inspect one autonomous HTTP purchase before the calling agent pays it. This $0.01 machine-payment operation validates a real 402 challenge, compares advertised price/protocol/network/asset/payment destination when supplied, checks x402 v2 exact resource binding when available, and surfaces retry or settled-delivery recovery signals. ExitProof never forwards payment credentials and never sends a live POST, PUT, PATCH, or DELETE probe; for those methods the caller supplies an already-observed 402 challenge. Conflicting, malformed, inaccessible, non-402, or unsafe targets are rejected before ExitProof issues its own payment challenge. Use check_reversibility instead for cancellation/refund terms on a real-world commitment, create_exit_manifest to preserve an eligible exit path, and build_exit_pack when an exit is actually needed. A successful check is not a recommendation, merchant-identity guarantee, delivery guarantee, legal opinion, or authorization to spend.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
check_reversibilityEvaluate one commitment’s cancellation/refund reversibility from transaction-specific checkout terms plus maintained policy evidence, without charging or creating durable state.3 findings
Why it is in this group
- The description's first verb is "evaluate": a word for a change.
- The input carries an amount (input.amount) and a currency, so it moves money.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
  The input schema at properties.merchant.description mentions "credentials".
  Matched text
  inputSchema.properties.merchant.description: "...erlays; do not include account numbers, credentials, or secrets."
  What this check looks for
- Info
  The input schema at properties.checkout_terms.properties.source_url.description mentions "credentials".
  Matched text
  inputSchema.properties.checkout_terms.properties.source_url.description: "...ed transaction terms. ExitProof removes credentials, query parameters, and fragments before..."
  What this check looks for
- Warn
  The server marks "check_reversibility" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "evaluate": a word for a change.
  What this check looks for
Description, as the server wrote it
Evaluate one commitment’s cancellation/refund reversibility from transaction-specific checkout terms plus maintained policy evidence, without charging or creating durable state. Use before a purchase, booking, subscription, rental, service, ticket, digital purchase, or deposit when exit deadlines or loss matter; use list_supported_policies only for maintained-overlay coverage, and create_exit_manifest only after paidExitManifestAvailable=true. Do not use for purchase desirability, legal advice, chargeback decisions, or executing a cancellation. Supply checkout_terms whenever available because they control the transaction-specific assessment; expected_commitment_at moves deadline evaluation forward when the commitment is future-dated, and missing or conflicting evidence can return assessment=unknown rather than inventing an exit right.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
create_exit_manifestPersist a privacy-minimized Exit Manifest for an eligible commitment, then return its manifest_id and secret access_token.3 findings
Why it is in this group
- The name "create_exit_manifest" says "create": a word for a change.
- The input carries an amount (input.amount) and a currency, so it moves money.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...cal settled retry with the same payment credential recovers the same manifest without a se..."
  What this check looks for
- Info
  The input schema at properties.merchant.description mentions "credentials".
  Matched text
  inputSchema.properties.merchant.description: "...erlays; do not include account numbers, credentials, or secrets."
  What this check looks for
- Info
  The input schema at properties.checkout_terms.properties.source_url.description mentions "credentials".
  Matched text
  inputSchema.properties.checkout_terms.properties.source_url.description: "...ed transaction terms. ExitProof removes credentials, query parameters, and fragments before..."
  What this check looks for
Description, as the server wrote it
Persist a privacy-minimized Exit Manifest for an eligible commitment, then return its manifest_id and secret access_token. Use only after check_reversibility says paidExitManifestAvailable=true; pass the exact commitment facts to preserve, with transaction-specific checkout_terms controlling the assessment when supplied. Use check_reversibility for evaluation only, or get_exit_manifest when a manifest already exists. This state-changing $0.25 stablecoin MPP operation checks eligibility before any payment challenge; a fresh authorization creates durable state, while an identical settled retry with the same payment credential recovers the same manifest without a second settlement. The plaintext access token is returned to the caller but stored only as a SHA-256 hash.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true

Changes things 1Creates or changes something that can be changed back.Claude Code: ask

build_exit_packBuild a bounded cancellation/refund action pack from an existing actionable Exit Manifest.3 findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...est_id and access_token together as the credential pair returned by create_exit_manifest o..."
  What this check looks for
- Info
  The input schema at description mentions "Credentials".
  Matched text
  inputSchema.description: "Credentials for one previously created Exit Manifes..."
  What this check looks for
- Info
  The input schema at properties.access_token.description mentions "credential".
  Matched text
  inputSchema.properties.access_token.description: "...uired with manifest_id; treat it like a credential and do not log or expose it."
  What this check looks for
Description, as the server wrote it
Build a bounded cancellation/refund action pack from an existing actionable Exit Manifest. Pass manifest_id and access_token together as the credential pair returned by create_exit_manifest or settlement recovery; use get_exit_manifest for retrieval only, or check_reversibility then create_exit_manifest when no manifest exists. This $1.00 MPP operation prefers Tempo stablecoin when available, retains Stripe card/link as a compatible fallback, and can charge but never contacts the merchant, executes a cancellation, files a chargeback, or guarantees success. Invalid or mismatched credentials and non-actionable manifests are rejected before payment; an identical settled retry with the same payment credential avoids a second settlement, while generatedAt and deadlineStatus can reflect the current time.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true

Only reads 2Looks things up and changes nothing.Claude Code: allow

get_exit_manifestRetrieve one previously created Exit Manifest without charging or changing stored state.3 findings
Why it is in this group
- The name "get_exit_manifest" says "get": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...idence; missing, expired, or mismatched credentials fail without modifying the manifest."
  What this check looks for
- Info
  The input schema at description mentions "Credentials".
  Matched text
  inputSchema.description: "Credentials for one previously created Exit Manifes..."
  What this check looks for
- Info
  The input schema at properties.access_token.description mentions "credential".
  Matched text
  inputSchema.properties.access_token.description: "...uired with manifest_id; treat it like a credential and do not log or expose it."
  What this check looks for
Description, as the server wrote it
Retrieve one previously created Exit Manifest without charging or changing stored state. Pass manifest_id and access_token together: the ID selects the record and the secret token authorizes access to that same record, so neither value is sufficient alone. Use this for preserved evidence and terms; use build_exit_pack for an actionable cancellation/refund plan, or create_exit_manifest when no manifest exists. This free, repeatable read does not refresh, re-evaluate, or extend evidence; missing, expired, or mismatched credentials fail without modifying the manifest.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_supported_policiesList the maintained merchant policy overlays and snapshot version/date ExitProof can add to transaction-specific evidence.No findings
Why it is in this group
- The name "list_supported_policies" says "list": a word for reading.
Description, as the server wrote it
List the maintained merchant policy overlays and snapshot version/date ExitProof can add to transaction-specific evidence. Use this only to inspect maintained coverage; use check_reversibility to evaluate an actual commitment, including an unlisted merchant when transaction-specific checkout_terms are available. An absent merchant means no maintained overlay, not that no cancellation, refund, contractual, or legal right exists. This is a free read-only snapshot: it creates no durable state, issues no payment challenge, and does not fetch or verify a merchant’s live policy at call time.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http exitproof https://exitproof.davisvillelabs.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__exitproof__get_exit_manifest",
      "mcp__exitproof__list_supported_policies"
    ],
    "ask": [
      "mcp__exitproof__check_reversibility",
      "mcp__exitproof__check_agent_purchase",
      "mcp__exitproof__create_exit_manifest",
      "mcp__exitproof__build_exit_pack"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as exitproof. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.davisvillelabs/exitproof/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

4 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 17:53 UTC.

For agents: Markdown · JSON · report this listing