Skip to content

GhostKey — Route Paid APIs with x402

by scriptmasterlabs.com · remote · no sign-in to list tools · v1.1.0 · published by com.scriptmasterlabs

Find paid APIs, check access policy and price, and route x402 requests. No autonomous spending.

Read only
CompareRegistry entry

4 tools: 4 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http ghostkey https://squeezeos-api.onrender.com/mcp/ghostkey

Findings

Matches of fixed checks, with the text they matched.

1 info

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

4 tools

Only reads 4Claude Code: allow
  • ghostkey_catalogList this embedded GhostKey interface's exposed tool names and monetization policy.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List this embedded GhostKey interface's exposed tool names and monetization policy. Returns the canonical paid catalog and quote-authority pointers. Use for discovery; no paid work is executed or billed here.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • ghostkey_policyRead the embedded GhostKey discovery/payment policy and upstream-rights rules.1 finding

    Why it is in this group

    • The description's first verb is "read": a word for reading.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...very; it does not grant browser access, credentials or spending authorization."

      What this check looks for
    Description, as the server wrote it
    Read the embedded GhostKey discovery/payment policy and upstream-rights rules. Returns charges_here=false, the canonical paid authority and explicit boundaries. Use to understand permitted discovery; it does not grant browser access, credentials or spending authorization.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • ghostkey_quoteReturn pre-spend guidance for a named capability, with charged=false and payment_is_delivery=false.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Return pre-spend guidance for a named capability, with charged=false and payment_is_delivery=false. Use to locate the canonical paid execution authority and request its fresh 402 quote. This response is guidance, not an executable price quote or settlement receipt.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • ghostkey_statusRead the embedded GhostKey discovery role, hosting and live payment-authority envelope.No findings

    Why it is in this group

    • The name "ghostkey_status" says "status": a word for reading.
    Description, as the server wrote it
    Read the embedded GhostKey discovery role, hosting and live payment-authority envelope. Use before selecting SML paid execution. This embedded helper is free discovery, not the standalone browser-session action surface; it never signs, spends or claims paid delivery.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http ghostkey https://squeezeos-api.onrender.com/mcp/ghostkey

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__ghostkey__ghostkey_status",
      "mcp__ghostkey__ghostkey_catalog",
      "mcp__ghostkey__ghostkey_quote",
      "mcp__ghostkey__ghostkey_policy"
    ],
    "ask": [],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as ghostkey. Review it before you use it.