Skip to content

Provider Trust — Verify a Source or Provider

by scriptmasterlabs.com · remote · no sign-in to list tools · v1.2.0 · published by com.scriptmasterlabs

Verify a source or provider before an AI agent trusts it. Evidence only; unknown stays unknown.

Final · 1
CompareRegistry entry

6 tools: 1 do something that can't be undone and 5 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http provider-trust https://squeezeos-api.onrender.com/mcp/provider-trust

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warncheck_payment

    The server marks "check_payment" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "check_payment" says "payment": a word that usually means money moves, which cannot be taken back.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Can't be undone 1Claude Code: ask
  • check_paymentRead the canonical payment contract, readiness and settlement-evidence endpoints as separate upstream envelopes.1 finding

    Why it is in this group

    • The name "check_payment" says "payment": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "check_payment" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "check_payment" says "payment": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Read the canonical payment contract, readiness and settlement-evidence endpoints as separate upstream envelopes. Use to inspect payment evidence before spending. A 402 challenge, signature, readiness flag or HTTP 200 alone does not prove settled accepted delivery. Never signs or spends.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
Only reads 5Claude Code: allow
  • check_historyRead privacy-filtered provider trust history over the requested hours window (1–2160; default 720).No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read privacy-filtered provider trust history over the requested hours window (1–2160; default 720). Returns the authoritative source/status/body envelope. Use for historical evidence; past observations are not current guarantees. Read-only.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • check_identityRead the live SML ERC-8004 identity document and its source/status envelope.No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read the live SML ERC-8004 identity document and its source/status envelope. Use to inspect declared provider identity; a successful fetch is not external certification or settlement verification. Read-only.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • check_statusRead the authoritative SqueezeOS backend status as a source/status/body envelope.No findings

    Why it is in this group

    • The name "check_status" says "status": a word for reading.
    Description, as the server wrote it
    Read the authoritative SqueezeOS backend status as a source/status/body envelope. Use to diagnose current availability; process status does not independently establish tool delivery or payment settlement. Read-only.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • compare_providersCompare two to five HTTPS providers using separate live evidence envelopes.No findings

    Why it is in this group

    • The name "compare_providers" says "compare": a word for reading.
    Description, as the server wrote it
    Compare two to five HTTPS providers using separate live evidence envelopes. Returns each target and its observed evidence, with composite_score=false. Use for side-by-side selection; there is no fabricated winner, universal score or payment.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • verify_providerInspect live provider evidence before selecting an HTTPS service.No findings

    Why it is in this group

    • The description's first verb is "inspect": a word for reading.
    Description, as the server wrote it
    Inspect live provider evidence before selecting an HTTPS service. Returns the source path, upstream HTTP status and untouched evidence body; unknown evidence stays unknown. Use for provider selection, not as cryptographic certification or proof that a payment settled. This tool does not sign or spend.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http provider-trust https://squeezeos-api.onrender.com/mcp/provider-trust

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__provider-trust__verify_provider",
      "mcp__provider-trust__compare_providers",
      "mcp__provider-trust__check_identity",
      "mcp__provider-trust__check_history",
      "mcp__provider-trust__check_status"
    ],
    "ask": [
      "mcp__provider-trust__check_payment"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as provider-trust. Review it before you use it.