Skip to content

AgentDiet Universal A2A & MCP Tool Discovery, Safe-Proxy & Swarm Router

dev.agentdiet/x402-brokeragentdiet.devstreamable-httpv7.0.17Scanned

Single-connection meta-router indexing 500+ MCP servers & A2A tools with 85% token compression an.

4 tools: 2 change things and 2 only read.

Tools: 0 delete, 0 irreversible, 2 write, 2 read.
  • Reads private data · 0
  • Reads text others write · 3
  • Can send data out · 0
  • 2 findings

Tools listed without sign-in. Remote posture

Anlyon alternative

2 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

4 tools

Changes things 2Claude Code: ask
  • execute_marketplace_toolExecute any of the 16 native AgentDiet B2A tools by slug or proxy an external marketplace tool URL ($0.001-$0.02 per call).Reads text others write1 finding

    Why it is in this group

    • The name "execute_marketplace_tool" says "execute": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "execute_marketplace_tool" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "execute_marketplace_tool" says "execute": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Execute any of the 16 native AgentDiet B2A tools by slug or proxy an external marketplace tool URL ($0.001-$0.02 per call). WHEN TO USE: Call to run a single tool discovered via search_x402_mcp_marketplace; use execute_workflow_bundle when you want to run a 4-tool composite bundle in parallel. WHEN NOT TO USE: Do not use for catalog search (use search_x402_mcp_marketplace) or wallet checks (use get_agent_wallet_status). PARAMETER INTERACTIONS: Set target_tool to a native slug (e.g. 'distill', 'token-intel', 'sec-intel', 'github-audit') or external https:// URL, and pass its primary input in input_value. Omit agent_id and tx_hash during your 5 free calls. Read-only and idempotent; results are cached for 1 hour (<5ms cache hit). Pricing: the first 5 calls per agent_id are free and failed calls are never charged. After 5 calls, the tool returns a payment-required quote (not a fatal error) with a $2 Stripe top-up link and Base/Solana USDC addresses; complete payment, then retry with your agd_pass_ key in agent_id or pass tx_hash. Example: execute_marketplace_tool(target_tool='example')

    Annotations the server declares

    • title: Execute marketplace tool
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • execute_workflow_bundleExecute a 4-tool native workflow bundle in parallel in a single call ($0.015-$0.03) and return a unified dossier, saving 3 LLM round-trips.Reads text others write1 finding

    Why it is in this group

    • The name "execute_workflow_bundle" says "execute": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "execute_workflow_bundle" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "execute_workflow_bundle" says "execute": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Execute a 4-tool native workflow bundle in parallel in a single call ($0.015-$0.03) and return a unified dossier, saving 3 LLM round-trips. WHEN TO USE: Call for comprehensive multi-source due diligence on a token, company domain, repository, or research topic; use execute_marketplace_tool when you only need a single tool. WHEN NOT TO USE: Do not use for single-endpoint queries or free catalog search. PARAMETER INTERACTIONS: Select bundle_id first and provide the matching entity identifier (token/0x address, domain, repo, or URL) in target. Omit agent_id and tx_hash during your 5 free calls. Read-only and idempotent; results are cached for 1 hour (<5ms cache hit). Pricing: the first 5 calls per agent_id are free and failed calls are never charged. After 5 calls, the tool returns a payment-required quote (not a fatal error) with a $2 Stripe top-up link and Base/Solana USDC addresses; complete payment, then retry with your agd_pass_ key in agent_id or pass tx_hash. Example: execute_workflow_bundle(bundle_id='example')

    Annotations the server declares

    • title: Execute workflow bundle
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 2Show 2 read-only tools
  • get_agent_wallet_statusInspect an agent's account ledger: remaining free trial calls (out of 5), prepaid USD balance, cumulative spend, total API calls, and total LLM tokens saved.No findings

    Why it is in this group

    • The name "get_agent_wallet_status" says "get": a word for reading.
    Description, as the server wrote it
    Inspect an agent's account ledger: remaining free trial calls (out of 5), prepaid USD balance, cumulative spend, total API calls, and total LLM tokens saved. WHEN TO USE: Call before a batch of paid tool executions or after completing a Stripe or USDC top-up to confirm your balance. WHEN NOT TO USE: Do not use to process web content, execute marketplace tools, or submit payments; use the other tools on this server for execution. PARAMETER INTERACTIONS: Omit agent_id to inspect the default trial account derived from your client IP, or pass your explicit agent_id or agd_pass_ session key to check a specific funded wallet. Free and read-only: never charges a fee or consumes a free trial call. Example: get_agent_wallet_status(agent_id='example')

    Annotations the server declares

    • title: Get agent wallet status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_x402_mcp_marketplaceSearch 490+ indexed MCP and HTTP 402 (x402) tools by capability keyword and return ranked endpoints with pricing, trust scores, and SLA tiers.Reads text others writeNo findings

    Why it is in this group

    • The name "search_x402_mcp_marketplace" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "search" and "http": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Search 490+ indexed MCP and HTTP 402 (x402) tools by capability keyword and return ranked endpoints with pricing, trust scores, and SLA tiers. WHEN TO USE: Call first to discover which native slug or external endpoint matches your task before calling execute_marketplace_tool. WHEN NOT TO USE: Do not use to execute a tool directly (use execute_marketplace_tool or execute_workflow_bundle). PARAMETER INTERACTIONS: Pass capability keywords or a domain in query; omit agent_id and tx_hash (this discovery tool is always free and never consumes a free trial call). Example: search_x402_mcp_marketplace(query='example')

    Annotations the server declares

    • title: Search x402 mcp marketplace
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write3
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 22, 2026, 15:24 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
2
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
https://x402-broker.agentdiet.dev/.well-known/oauth-protected-resource/mcp
Authorization servers
https://x402-broker.agentdiet.dev
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
yes
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 2 tools that change things (2 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://x402-broker.agentdiet.dev/mcp: tools/list returned 4 tools to an anonymous client, including execute_marketplace_tool (write), execute_workflow_bundle (write)

    What this check looks for

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • The server marks "execute_marketplace_tool" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "execute_marketplace_tool" says "execute": a word for a change.

    What this check looks for
  • The server marks "execute_workflow_bundle" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "execute_workflow_bundle" says "execute": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 7.0.17. Values in angle brackets are yours to fill in.

claude mcp add --transport http x402-broker https://x402-broker.agentdiet.dev/mcp
claude mcp add --transport http x402-broker https://x402-broker.agentdiet.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__x402-broker__search_x402_mcp_marketplace",
      "mcp__x402-broker__get_agent_wallet_status"
    ],
    "ask": [
      "mcp__x402-broker__execute_marketplace_tool",
      "mcp__x402-broker__execute_workflow_bundle"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as x402-broker. Review it before you use it.

Capability tags behind 3 rules
  • mcp__x402-broker__search_x402_mcp_marketplace untrusted-input
  • mcp__x402-broker__execute_marketplace_tool untrusted-input
  • mcp__x402-broker__execute_workflow_bundle untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/dev.agentdiet/x402-broker/verify?hash=16bf4ef16f51f9d85b79112947e4e0772c399c671195730eb9e95d5b7d71a704" | jq -e '.changed == false'

Pinned hash 16bf4ef16f51, from Oct 21, 2026, 19:15 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/dev.agentdiet/x402-broker/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for dev.agentdiet/x402-broker
[![anlyon.dev](https://anlyon.dev/badge/dev.agentdiet/x402-broker.svg)](https://anlyon.dev/servers/dev.agentdiet/x402-broker)

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:11 UTC.