Skip to content

AssetFare

by assetfare · remote · no sign-in to list tools · v1.21.3 · published by GitHub user assetfare

Exact-amount top-two routing for six pilots; caller signs; AssetFare never signs or submits

Final · 4Changes · 3
CompareRegistry entry

11 tools: 4 do something that can't be undone, 3 change things and 4 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http assetfare https://api.assetfare.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnassetfare_v2_prepare

    The server marks "assetfare_v2_prepare" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The description's first verb is "return": a word for reading.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

11 tools

Can't be undone 4Claude Code: ask
  • assetfare_v2_session_createCreate one receipt-driven workflow.Reads text others writeNo findings

    Why it is in this group

    • The name "assetfare_v2_session_create" says "create": a word for a change.
    • The input addresses people (input.verification_context.direct_route_summary.to): what it sends cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create one receipt-driven workflow. Example: pass caller_approved=true, a session approval_v3, its idempotency_key, a caller-local session token, and the quote-bound verification_context. Economic guidance is advisory and adds no request field. The adapter validates approval and context before the upstream request. Every returned action is deeply verified and receives a caller-wallet handoff. AssetFare never signs or submits.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • assetfare_v2_session_observe_outputRecord an already-produced bridge or destination output, then advance the workflow.Reads text others writeNo findings

    Why it is in this group

    • The input addresses people (input.verification_context.direct_route_summary.to): what it sends cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Record an already-produced bridge or destination output, then advance the workflow. Example: pass the output hash, a new idempotency key, and the original verification_context. Any next current_action is deeply verified and receives a wallet handoff. AssetFare never signs or submits.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • assetfare_v2_session_observe_sourceRecord source hashes the caller already signed and submitted, then advance the workflow.Reads text others writeNo findings

    Why it is in this group

    • The input addresses people (input.verification_context.direct_route_summary.to): what it sends cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Record source hashes the caller already signed and submitted, then advance the workflow. Example: pass one finalized source hash, a new idempotency key, and the original verification_context. Any next current_action is deeply verified and receives a wallet handoff. AssetFare never signs or submits.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • assetfare_v2_session_refresh_actionRefresh an expired action only while it remains unsubmitted.Reads text others writeNo findings

    Why it is in this group

    • The input addresses people (input.verification_context.direct_route_summary.to): what it sends cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Refresh an expired action only while it remains unsubmitted. Example: pass the existing session, a new idempotency key, and the original verification_context. The refreshed action is deeply verified and receives a wallet handoff. Never refresh a submitted step; AssetFare never signs or submits.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 3Claude Code: ask
  • assetfare_v2_prepareReturn one deeply verified first unsigned bundle and caller-wallet handoff.Reads text others write1 finding

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "assetfare_v2_prepare" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The description's first verb is "return": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Return one deeply verified first unsigned bundle and caller-wallet handoff. Example: pass caller_approved=true, a one_shot approval_v3, and the quote-bound verification_context; multi-step routes reject one_shot. Economic guidance is advisory and adds no request field. Context is validated before the upstream request and never forwarded. AssetFare never signs or submits.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • assetfare_v2_quote_selected_candidateReuse the chosen exact request-time quote while valid; after expiry refresh only that candidate at the same amount and never reselect.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reuse the chosen exact request-time quote while valid; after expiry refresh only that candidate at the same amount and never reselect. Example: pass candidate_id and the selection receipt hash. An AssetFare result requires a caller-local proof check and fresh wallet simulation before verified_for_signing; remote verification is not signing authority. An external result is only its provider handoff and has no AssetFare transaction-verification claim. Never prepares, signs, submits, or grants transaction authority.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • assetfare_v2_route_selectionQuote the recent top two plus the best AssetFare graph at the exact amount; return up to two all-in choices labeled assetfare_verified_unsigned or external_provider_handoff.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Quote the recent top two plus the best AssetFare graph at the exact amount; return up to two all-in choices labeled assetfare_verified_unsigned or external_provider_handoff. AssetFare cost, ETA and rank are always present; a recent winning range needs two supporting higher buckets and disappears on conflict. Example: compare Solana USDC to Base USDC at USD 347.25 with balanced (60s). Fast is 30s; balanced and explicit economy are 60s. The 60-second ceiling is absolute for recommendations; slower routes are reference-only. Never approves, prepares, signs, or submits.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 4Claude Code: allow
  • assetfare_manifestRead the Ed25519-signed release manifest and safety-bundle binding before preparing an action.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Read the Ed25519-signed release manifest and safety-bundle binding before preparing an action. Example: call this once to verify the current release and contract pins; it never creates state, signs, or submits.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • assetfare_v2_capabilitiesRead all 100 technically available routes, live provider readiness, route-specific guidance, direct_route_summary, and continuation_v3 contracts before quoting.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Read all 100 technically available routes, live provider readiness, route-specific guidance, direct_route_summary, and continuation_v3 contracts before quoting. Forty-four routes are price-recommended only at or above their published threshold; 56 have no current price recommendation. Example: call once before requesting an exact route quote. Confirm every fresh quote. Economic guidance is advisory and never adds an execution gate. continuation_v3 separately binds execution selection, wallets, bounds, and mode. Read-only; creates no wallet login, session, or action.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • assetfare_v2_quoteGet one fresh AssetFare quote with amount-specific economic_guidance, direct_route_summary, continuation_v3, and unsigned_prepare_requirements.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get one fresh AssetFare quote with amount-specific economic_guidance, direct_route_summary, continuation_v3, and unsigned_prepare_requirements. Example: quote Solana USDC to Base USDC. price_recommended_for_amount is advisory; compare alternatives when price matters, but no economic acknowledgement field is required. The quote remains an unranked_candidate until separate explicit approval selects one mode. The adapter validates hashes, path, bounds, and TTL and never creates approval, prepares, signs, or submits.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • assetfare_v2_session_getRead an existing v2 workflow without advancing it.Reads text others writeNo findings

    Why it is in this group

    • The name "assetfare_v2_session_get" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Read an existing v2 workflow without advancing it. Example: pass session_id, session_token, and the original verification_context after restart. The adapter deeply verifies any current_action and emits a self-verifying wallet handoff, or fails closed. Read-only; never signs or submits.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write11
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:56 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
7
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 7 tools that change things (4 irreversible, 3 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://api.assetfare.dev/mcp: tools/list returned 11 tools to an anonymous client, including assetfare_v2_session_create (irreversible), assetfare_v2_session_observe_source (irreversible), assetfare_v2_session_observe_output (irreversible), assetfare_v2_session_refresh_action (irreversible), assetfare_v2_route_selection (write) and 2 more

    What this check looks for

Install

Pinned to version 1.21.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http assetfare https://api.assetfare.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__assetfare__assetfare_manifest",
      "mcp__assetfare__assetfare_v2_capabilities",
      "mcp__assetfare__assetfare_v2_quote",
      "mcp__assetfare__assetfare_v2_session_get"
    ],
    "ask": [
      "mcp__assetfare__assetfare_v2_route_selection",
      "mcp__assetfare__assetfare_v2_quote_selected_candidate",
      "mcp__assetfare__assetfare_v2_prepare",
      "mcp__assetfare__assetfare_v2_session_create",
      "mcp__assetfare__assetfare_v2_session_observe_source",
      "mcp__assetfare__assetfare_v2_session_observe_output",
      "mcp__assetfare__assetfare_v2_session_refresh_action"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as assetfare. Review it before you use it.

Capability tags behind 11 rules
  • mcp__assetfare__assetfare_manifest untrusted-input
  • mcp__assetfare__assetfare_v2_capabilities untrusted-input
  • mcp__assetfare__assetfare_v2_route_selection untrusted-input
  • mcp__assetfare__assetfare_v2_quote_selected_candidate untrusted-input
  • mcp__assetfare__assetfare_v2_quote untrusted-input
  • mcp__assetfare__assetfare_v2_prepare untrusted-input
  • mcp__assetfare__assetfare_v2_session_create untrusted-input
  • mcp__assetfare__assetfare_v2_session_get untrusted-input
  • mcp__assetfare__assetfare_v2_session_observe_source untrusted-input
  • mcp__assetfare__assetfare_v2_session_observe_output untrusted-input
  • mcp__assetfare__assetfare_v2_session_refresh_action untrusted-input