Skip to content

Assay A2A, MCP & x402 Pre-Flight Verifier & Observatory

by agentdiet.dev · remote · no sign-in to list tools · v7.0.17 · published by dev.agentdiet

Live behavioral security verifier, schema auditor, and trust oracle for A2A, MCP & x402 agents.

Changes · 4
CompareRegistry entry

4 tools: 4 change things.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http assay https://assay.agentdiet.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnassay_get_ledger_policy

    The server marks "assay_get_ledger_policy" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "assay_get_ledger_policy" says "get": a word for reading.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

4 tools

Changes things 4Claude Code: ask
  • assay_get_ledger_policyRetrieve historical conformance observations and manage pinned SHA-256 tools/list policy hashes in the Assay ledger for a target endpoint.1 finding

    Why it is in this group

    • The name "assay_get_ledger_policy" says "get": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "assay_get_ledger_policy" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "assay_get_ledger_policy" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Retrieve historical conformance observations and manage pinned SHA-256 tools/list policy hashes in the Assay ledger for a target endpoint. When expected_tools_hash is provided, it pins that 64-hex digest as the target's baseline policy and compares it against the latest stored observation; when omitted, it returns the stored dossier and last 20 drift observations without network probing unless the target is unindexed. Idempotent; first 5 calls/IP are free. Use to audit historical drift or pin mcp-lock.json hashes; for live pre-execution gating use assay_preflight; for live re-indexing use assay_probe; for post-payment SLA receipts use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.

    Annotations the server declares

    • title: Query Historical Ledger & Pin Expected Schema Hashes
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • assay_preflightGate a remote MCP, A2A, or x402 endpoint before calling or paying it by probing live JSON-RPC reachability, hashing tools/list (SHA-256), and scanning for prompt-injection poisonin…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Gate a remote MCP, A2A, or x402 endpoint before calling or paying it by probing live JSON-RPC reachability, hashing tools/list (SHA-256), and scanning for prompt-injection poisoning. When expected_tools_hash is provided, any mismatch against the live tools/list digest forces verdict='deny' to block silent schema rug-pulls; when omitted, verdict reflects liveness and injection safety alone. Read-only gate; first 5 calls/IP are free and quota-exceeded calls return a 402 top-up prompt. Use before tool execution or payment; to register or refresh public leaderboard telemetry use assay_probe; to read or pin stored policy hashes use assay_get_ledger_policy; after payment use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.

    Annotations the server declares

    • title: Pre-Flight MCP & A2A Security Gate
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • assay_probeRegister a new remote MCP, A2A, or x402 endpoint or refresh its public Assay Observatory dossier by running a live HTTP, agent-card, and JSON-RPC tools/list inspection without poli…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Register a new remote MCP, A2A, or x402 endpoint or refresh its public Assay Observatory dossier by running a live HTTP, agent-card, and JSON-RPC tools/list inspection without policy gating. Target must be a public HTTPS origin (private IPs are rejected with a 400 error); each call appends a timestamped observation and increments rug_pulls if tools_hash drifted since the prior stored observation. Writes to the public ledger; first 5 calls/IP are free and retries are idempotent on steady schemas. Use to onboard or re-index a server; for pre-call allow/deny gating use assay_preflight; for historical observations or hash pinning use assay_get_ledger_policy; for post-payment disputes use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.

    Annotations the server declares

    • title: Register & Refresh Endpoint Conformance Telemetry
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • assay_verify_deliveryAudit a paid x402 or A2A provider after payment to confirm delivery or prove an SLA breach with an HMAC-SHA256 signed receipt.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Audit a paid x402 or A2A provider after payment to confirm delivery or prove an SLA breach with an HMAC-SHA256 signed receipt. Passing status_code >= 500 forces verdict='sla_breach_confirmed' even if the live re-probe succeeds, while passing tx_hash cryptographically binds your Base or Solana payment signature into the receipt (omitting tx_hash still verifies liveness and issues a probe-bound receipt). Non-destructive; first 5 calls/IP are free and failed target connections do not throw tool errors. Use only after paying a provider; before payment use assay_preflight; for public indexing use assay_probe; for policy history use assay_get_ledger_policy. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.

    Annotations the server declares

    • title: Verify Post-Payment x402 Delivery & Mint SLA Receipt
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 7.0.17. Values in angle brackets are yours to fill in.

claude mcp add --transport http assay https://assay.agentdiet.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__assay__assay_preflight",
      "mcp__assay__assay_probe",
      "mcp__assay__assay_verify_delivery",
      "mcp__assay__assay_get_ledger_policy"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as assay. Review it before you use it.