Skip to content

io.github.robertoyanguas-ops/assay

by robertoyanguas-ops · remote · no sign-in to list tools · v0.4.2 · published by GitHub user robertoyanguas-ops

A2A & MCP Pre-Flight Security: SHA-256 tool schema rug-pull detection and liveness grades.

Changes · 4
CompareRegistry entry

4 tools: 4 change things.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http assay https://assay-207908449630.us-central1.run.app/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnassay_get_ledger_policy

    The server marks "assay_get_ledger_policy" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "assay_get_ledger_policy" says "get": a word for reading.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

4 tools

Changes things 4Claude Code: ask
  • assay_get_ledger_policyRetrieve historical conformance observations and manage pinned SHA-256 tools/list policy hashes in the Assay ledger for a target endpoint.Reads text others write1 finding

    Why it is in this group

    • The name "assay_get_ledger_policy" says "get": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "assay_get_ledger_policy" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "assay_get_ledger_policy" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Retrieve historical conformance observations and manage pinned SHA-256 tools/list policy hashes in the Assay ledger for a target endpoint. When expected_tools_hash is provided, it pins that 64-hex digest as the target's baseline policy and compares it against the latest stored observation; when omitted, it returns the stored dossier and last 20 drift observations without network probing unless the target is unindexed. Idempotent; first 5 calls/IP are free. Use to audit historical drift or pin mcp-lock.json hashes; for live pre-execution gating use assay_preflight; for live re-indexing use assay_probe; for post-payment SLA receipts use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.

    Annotations the server declares

    • title: Query Historical Ledger & Pin Expected Schema Hashes
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • assay_preflightGate a remote MCP, A2A, or x402 endpoint before calling or paying it by probing live JSON-RPC reachability, hashing tools/list (SHA-256), and scanning for prompt-injection poisonin…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Gate a remote MCP, A2A, or x402 endpoint before calling or paying it by probing live JSON-RPC reachability, hashing tools/list (SHA-256), and scanning for prompt-injection poisoning. When expected_tools_hash is provided, any mismatch against the live tools/list digest forces verdict='deny' to block silent schema rug-pulls; when omitted, verdict reflects liveness and injection safety alone. Read-only gate; first 5 calls/IP are free and quota-exceeded calls return a 402 top-up prompt. Use before tool execution or payment; to register or refresh public leaderboard telemetry use assay_probe; to read or pin stored policy hashes use assay_get_ledger_policy; after payment use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.

    Annotations the server declares

    • title: Pre-Flight MCP & A2A Security Gate
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • assay_probeRegister a new remote MCP, A2A, or x402 endpoint or refresh its public Assay Observatory dossier by running a live HTTP, agent-card, and JSON-RPC tools/list inspection without poli…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Register a new remote MCP, A2A, or x402 endpoint or refresh its public Assay Observatory dossier by running a live HTTP, agent-card, and JSON-RPC tools/list inspection without policy gating. Target must be a public HTTPS origin (private IPs are rejected with a 400 error); each call appends a timestamped observation and increments rug_pulls if tools_hash drifted since the prior stored observation. Writes to the public ledger; first 5 calls/IP are free and retries are idempotent on steady schemas. Use to onboard or re-index a server; for pre-call allow/deny gating use assay_preflight; for historical observations or hash pinning use assay_get_ledger_policy; for post-payment disputes use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.

    Annotations the server declares

    • title: Register & Refresh Endpoint Conformance Telemetry
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • assay_verify_deliveryAudit a paid x402 or A2A provider after payment to confirm delivery or prove an SLA breach with an HMAC-SHA256 signed receipt.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Audit a paid x402 or A2A provider after payment to confirm delivery or prove an SLA breach with an HMAC-SHA256 signed receipt. Passing status_code >= 500 forces verdict='sla_breach_confirmed' even if the live re-probe succeeds, while passing tx_hash cryptographically binds your Base or Solana payment signature into the receipt (omitting tx_hash still verifies liveness and issues a probe-bound receipt). Non-destructive; first 5 calls/IP are free and failed target connections do not throw tool errors. Use only after paying a provider; before payment use assay_preflight; for public indexing use assay_probe; for policy history use assay_get_ledger_policy. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.

    Annotations the server declares

    • title: Verify Post-Payment x402 Delivery & Mint SLA Receipt
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write4
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 0.4.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http assay https://assay-207908449630.us-central1.run.app/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__assay__assay_preflight",
      "mcp__assay__assay_probe",
      "mcp__assay__assay_verify_delivery",
      "mcp__assay__assay_get_ledger_policy"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as assay. Review it before you use it.

Capability tags behind 4 rules
  • mcp__assay__assay_preflight untrusted-input
  • mcp__assay__assay_probe untrusted-input
  • mcp__assay__assay_verify_delivery untrusted-input
  • mcp__assay__assay_get_ledger_policy untrusted-input