Assay

io.github.robertoyanguas-opsPublished by GitHub account robertoyanguas-opsv0.4.2Updated Oct 26, 2026

A2A & MCP Pre-Flight Security: SHA-256 tool schema rug-pull detection and liveness grades.

The publisher's own server: X402-Broker Global A2A, MCP & x402 Super-Marketplace

VerifiedStreamable HTTPWeb executableSecurity & MonitoringAI & ML

Overview

AI-generated overview

Checks remote MCP, A2A and x402 endpoints before use: liveness, SHA-256 tool-schema pinning and prompt-injection scanning.

What you can do
  • Pre-flight gate a remote MCP, A2A or x402 endpoint, returning a verdict and denying on a tools/list hash mismatch
  • Probe and register public HTTPS endpoints, building an Observatory dossier from HTTP, agent-card and JSON-RPC inspection
  • Audit a paid x402 or A2A provider after payment and get an HMAC-SHA256 signed delivery or SLA-breach receipt
  • Read historical conformance observations and manage pinned SHA-256 tools/list policy hashes in the Assay ledger
When to use it
Useful when an assistant is about to call or pay an unfamiliar remote agent or MCP endpoint and you want a liveness check, a rug-pull guard on the tool list, and a signed record of whether a paid provider delivered.
Requirements
Remote streamable HTTP endpoint; no authentication, environment variables or headers declared. Targets must be public HTTPS origins, since private IPs are rejected.
Before you install
It sends requests to third-party endpoints you name and records observations in a public ledger. Payment-related tools take a transaction hash binding a Base or Solana payment, so only pass hashes you are willing to disclose; verdicts are advisory and do not guarantee an endpoint is safe.

Installation

In SourceWeft

  1. Open Assay in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.robertoyanguas-ops%2Fassay/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "assay": {
      "type": "http",
      "url": "https://assay-207908449630.us-central1.run.app/mcp"
    }
  }
}

Tools

4

assay_preflight

Pre-Flight MCP & A2A Security Gate

Gate a remote MCP, A2A, or x402 endpoint before calling or paying it by probing live JSON-RPC reachability, hashing tools/list (SHA-256), and scanning for prompt-injection poisoning. When expected_tools_hash is provided, any mismatch against the live tools/list digest forces verdict='deny' to block silent schema rug-pulls; when omitted, verdict reflects liveness and injection safety alone. Read-only gate; first 5 calls/IP are free and quota-exceeded calls return a 402 top-up prompt. Use before tool execution or payment; to register or refresh public leaderboard telemetry use assay_probe; to read or pin stored policy hashes use assay_get_ledger_policy; after payment use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.

Parameterstargetrequiredexpected_tools_hash

assay_probe

Register & Refresh Endpoint Conformance Telemetry

Register a new remote MCP, A2A, or x402 endpoint or refresh its public Assay Observatory dossier by running a live HTTP, agent-card, and JSON-RPC tools/list inspection without policy gating. Target must be a public HTTPS origin (private IPs are rejected with a 400 error); each call appends a timestamped observation and increments rug_pulls if tools_hash drifted since the prior stored observation. Writes to the public ledger; first 5 calls/IP are free and retries are idempotent on steady schemas. Use to onboard or re-index a server; for pre-call allow/deny gating use assay_preflight; for historical observations or hash pinning use assay_get_ledger_policy; for post-payment disputes use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.

Parameterstargetrequired

assay_verify_delivery

Verify Post-Payment x402 Delivery & Mint SLA Receipt

Audit a paid x402 or A2A provider after payment to confirm delivery or prove an SLA breach with an HMAC-SHA256 signed receipt. Passing status_code >= 500 forces verdict='sla_breach_confirmed' even if the live re-probe succeeds, while passing tx_hash cryptographically binds your Base or Solana payment signature into the receipt (omitting tx_hash still verifies liveness and issues a probe-bound receipt). Non-destructive; first 5 calls/IP are free and failed target connections do not throw tool errors. Use only after paying a provider; before payment use assay_preflight; for public indexing use assay_probe; for policy history use assay_get_ledger_policy. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.

Parameterstargetrequiredtx_hashstatus_code

assay_get_ledger_policy

Query Historical Ledger & Pin Expected Schema Hashes

Retrieve historical conformance observations and manage pinned SHA-256 tools/list policy hashes in the Assay ledger for a target endpoint. When expected_tools_hash is provided, it pins that 64-hex digest as the target's baseline policy and compares it against the latest stored observation; when omitted, it returns the stored dossier and last 20 drift observations without network probing unless the target is unindexed. Idempotent; first 5 calls/IP are free. Use to audit historical drift or pin mcp-lock.json hashes; for live pre-execution gating use assay_preflight; for live re-indexing use assay_probe; for post-payment SLA receipts use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.

Parameterstargetrequiredexpected_tools_hash

Version history

1
  1. v0.4.2LatestOct 16, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.

Other X402broker integrations

X402-Broker Global A2A, MCP & x402 Super-Marketplace

com.x402brokerOfficial publisher

Remote marketplace MCP server that lets an assistant search 490+ indexed MCP and x402 tools, run them for a per-call fee, and check its prepaid balance.

Streamable HTTPWeb executable
Developer Tools4 toolsOct 26, 2026

X402-Broker Universal MCP Gateway & Multi-Agent Swarm Router

com.x402brokerOfficial publisher

Remote MCP gateway for browsing a catalog of API passes and credits, managing carts and checkouts, and retrieving order keys.

Streamable HTTPWeb executable
Finance15 toolsNov 4, 2026

X402-Broker Global B2A & A2A Tool Marketplace

com.x402brokerOfficial publisher

X402-Broker Global B2A & A2A Tool Marketplace's hosted MCP server, published by x402broker.com; no sign-in required; Streamable HTTP; 4 tools.

Streamable HTTPWeb executable
4 toolsOct 25, 2026

X402 Broker Mcp

Published by GitHub account robertoyanguas-ops

Single-connection meta-router indexing 500+ MCP servers & A2A tools with 85% token compression and

Streamable HTTPWeb executable
4 toolsOct 24, 2026

Whale Momentum Mcp

Published by GitHub account robertoyanguas-ops

Tracks real-time 1h/24h DEX buy/sell orderflow ratios, whale accumulation signals, and liquidity v

Streamable HTTPWeb executable
2 toolsOct 24, 2026