XGuard Live

io.github.moelayyan90Published by GitHub account moelayyan90v6.0.0Updated Nov 4, 2026

Read current software facts with primary-source evidence and verification timestamps.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingFinance

Overview

XGuard Live's hosted MCP server (xguardgate.com); no sign-in required; Streamable HTTP; 5 tools.

No AI overview yet: these facts come from the registry entry and the server itself.

Endpoint
xguardgate.com
Last checked

Installation

In SourceWeft

  1. Open XGuard Live in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.moelayyan90%2Fxguard/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "xguard-live": {
      "type": "http",
      "url": "https://xguardgate.com/mcp"
    }
  }
}

README

XGuard Live

The live facts layer for AI.

Current facts. Source verified. Change tracked. Machine readable.

XGuard Live observes public primary sources and publishes compact, canonical facts with verification timestamps, source evidence and immutable history. People and machines retrieve the same data through ordinary HTTP. No account, SDK, plugin or paid API key is needed for public facts.

Live site · Fact index · Methodology · Changes · Connect AI tools

sh
curl https://xguardgate.com/fact/npm/react/latest-versioncurl -H 'Accept: text/markdown' https://xguardgate.com/fact/npm/react/latest-versioncurl -H 'Accept: application/json' https://xguardgate.com/fact/npm/react/latest-version

A published observation includes the current or last observed value, source URL, source hash, observed/verified timestamps, freshness limit, previous value and history. STALE/UNKNOWN never imply a current verified value. Verification means a match to the source at retrieval, not independent certification of every publisher claim. Candidates remain unpublished until schema and source checks pass.

Connect an AI client

Use XGuard Live's MCP endpoint with Streamable HTTP and call xguard.fact.get with {"factId":"npm/react/latest-version"}. Free public fact reads need no account or API key. Install in your client or use the A2A agent card.

Development

Use Node 24.

sh
npm ci --prefix apps/relaynpm run checknpm testnpm run buildnpm run --prefix apps/relay live:test-runtimenpm run dev

Local development uses a separate Worker config and local SQLite Durable Objects. Production smoke checks are read-only and excluded from business metrics: npm run smoke. The primary-source check is node scripts/live-source-check.mjs; robots restrictions, rate limits and changed source schemas can legitimately prevent collection.

Operations

The production Worker is xguard-mainnet. Cron runs every ten minutes; persistent shard alarms collect due sources with domain limits and backoff. Cloudflare cache serves bounded, format-specific representations. /healthz exposes real counts and scheduler health. /admin requires an owner key and protects all mutations.

Deployment: use a pull request, pass CI/CodeQL, merge, then the Deploy XGuard Live workflow deploys the tested commit. Manual deployment with existing Cloudflare credentials: npx --prefix apps/relay wrangler deploy --config apps/relay/wrangler.jsonc --tag git-$(git rev-parse --short=12 HEAD). Production lifecycle changes must first pass node scripts/durable-object-deploy-guard.mjs <deployed-git-ref> HEAD and be isolated from runtime changes.

See operations and rollback and migration inventory. The former execution gateway is retained solely for state/recovery compatibility and historical reference; it is not the public Live product. Historical result recovery still requires its original signed quote. Legacy marketing and release workflows are archived and do not run.

Monetization

Launch mode is observe. Cloudflare Pay Per Crawl eligibility and Pay Per Use buyer participation require confirmation in the owner's Cloudflare account. The application does not fabricate revenue, simulate paid production traffic or equate crawler requests with paid use. Actual provider report imports and invoice costs are separate, auditable records. No report means unknown account revenue, not proven zero. Discovery remains free even when eligible high-value detail pages are later configured for paid retrieval.

Source: README.md at commit b57c599

Tools

5

xguard.fact.get

Read one free published software fact by canonical ID. Returns the primary source, verification status and timestamp. Use xguard.web.fetch for a separate paid fetch of a public URL.

ParametersfactIdrequired

xguard.capabilities

Discover XGuard capabilities

Return the enabled and disabled XGuard tools, their security boundary, and canonical discovery URLs. Free.

Takes no parameters.

xguard.preflight

Preflight a guarded paid request

Free, read-only safety gate for xguard.web.fetch. Validates the public HTTPS target, SSRF policy, DNS reachability and selected payment path without contacting the target or attempting payment. On allow, call xguard.web.fetch directly; it creates the signed quote and returns the mandatory x402 v2 PaymentRequired result.

Takes no parameters.

xguard.pricing.quote

Get a signed execution quote

Get an optional signed quote for xguard.web.fetch. Call xguard.web.fetch directly to receive the price in an HTTP 402 challenge.

Takes no parameters.

xguard.web.fetch

Fetch a public HTTPS resource

Fetch one public HTTPS resource after x402 v2 payment and on-chain settlement verification. Retry the identical MCP call with Payment-Signature and X-XGuard-Quote. A completed retry returns the prior receipt.

Takes no parameters.

Version history

2
  1. v6.0.0LatestNov 4, 2026
  2. v0.6.2Sep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.