Curbi

io.github.Curbi-IncPublished by GitHub account Curbi-Incv0.1.0Updated Nov 6, 2026

Check agent replies, lint policies, export regression tests and verify caller-trusted proof bundles.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Curbi checks AI agent replies against explicit price and forbidden-phrase policies, lints policies, exports CI regression tests and verifies proof bundles.

What you can do
  • Check one or up to 50 replies against explicit prices, forbidden phrases and supplied outcome records, deterministically with no model calls
  • Validate and lint a policy for schema errors, duplicate or overlapping price items, duplicate forbid entries, unrepresentable prices and rules that never fire
  • Export a policy check as a CI regression: a curbi.regression JSON file plus a dependency-free node:test file that replays it against the Check API
  • Verify proof bundles with caller-supplied public keys, covering signatures, key windows, log inclusion, attestation binding and history consistency
  • Search the published Curbi documentation catalog and fetch catalog summaries for returned ids
When to use it
Useful when an assistant or agent pipeline needs a deterministic guardrail on outgoing replies, such as enforcing stated prices or blocking forbidden phrases, and when you want those checks turned into repeatable CI tests or need to verify a Curbi proof bundle against keys you trust.
Requirements
Remote streamable HTTP endpoint at api.curbi.io; no packages, environment variables or headers are declared. verify_bundle requires caller-supplied public keys as the trust anchor. Network access to the endpoint is needed.
Before you install
Read-only public preview: actions, private projects and provider calls are unavailable. Caller records are unverified and receipt verification is unavailable here. A passing check grants no execution authority and is not general truth. Keys inside a bundle are never trusted; only the keys you supply count.

Installation

In SourceWeft

  1. Open Curbi in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.Curbi-Inc%2Fcurbi/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "curbi": {
      "type": "http",
      "url": "https://api.curbi.io/mcp"
    }
  }
}

Tools

6

policy_check

Check an agent reply

Check one reply or up to 50 replies against explicit prices, forbidden phrases and supplied outcome records. Deterministic, no model calls. Caller records are unverified; receipt verification is unavailable here. A pass grants no execution authority.

Parameterscasesreplypolicyrequiredrecordverifyversion

validate_policy

Validate and lint a policy

Check a policy against the same schema rules as policy_check, then lint it: no rules at all, duplicate or overlapping price items, duplicate forbid ids or phrases, prices that cannot be stated in cents, and rules the checker never fires on (probed with the shipped checker). Returns valid, errors and warnings. Nothing is stored. A valid policy is not a complete one, and grants no execution authority.

Parameterspolicyrequired

export_regression

Export a regression test

Run policy_check with caller-supplied records (no receipts or required-signature mode) and return it as a CI regression: curbi.regression JSON with each reply's expected verdict and rules, plus a dependency-free node:test file that replays it against the Check API. Expectations come from the checker, never from the caller. Nothing is stored. A pass grants no execution authority.

Parameterscasesreplytitlepolicyrequiredrecordverifyversion

verify_bundle

Verify a Curbi proof bundle offline

Run the open Curbi Proof verifier (curbi.proof/0.1) on a bundle with the public keys you choose: signatures, key windows, RFC 9162 inclusion under the signed log head, attestation binding and history consistency. Keys are required and are the trust anchor; keys inside the bundle are never trusted here. Test keys verify only with allowTest. Pure computation: no network, nothing stored. A verified bundle shows what a trusted key signed and logged; it does not show that the provider action happened, and grants no authority.

ParameterskeysrequiredmodeknownbundlerequiredallowTest

fetch

Fetch a Curbi documentation summary

Fetch the first-party catalog summary for an id returned by search. Returns a canonical URL and a link to full documentation; does not retrieve caller URLs.

Parametersidrequired

Version history

1
  1. v0.1.0LatestNov 6, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.