FabTally Guard

io.github.zvmzaretskyPublished by GitHub account zvmzaretskyv1.0.0Updated Oct 24, 2026

Verify before you act: deps-check, x402-preflight, json-repair & url-read for agents.

The publisher's own server: FabTally 3D-Print Slicer, Quote & DFM

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Paid, read-only verification tools that let an assistant vet packages, x402 endpoints, LLM JSON and public URLs before acting.

What you can do
  • Vet a package before installing: existence, version, deprecation/yank, OSV.dev CVEs, typosquat similarity, license and age/download signals with a risk verdict
  • Preflight another x402 endpoint before paying it: challenge validity, price/asset/network/payTo consistency with its well-known file, TLS, reachability and openapi
  • Repair near-miss LLM JSON into a schema-conformant object, or return per-field errors
  • Fetch a public URL and return clean Markdown plus a token estimate for RAG ingestion
When to use it
Use it when an agent is about to take a costly or hard-to-undo step — installing an unfamiliar package, paying an x402 endpoint, ingesting scraped pages, or trusting model-generated JSON — and wants a quick check first.
Requirements
Remote streamable-http endpoint at guard.fabtally.com/mcp, or the npm package fabtally-guard-mcp over stdio via npx. Every tool is paid: calls need an x_payment payload (x402, USDC on Base) or, for the HTTP API, a prepaid X-FabTally-Key credit key. Optional FABTALLY_GUARD_BASE setting. Network access required.
Before you install
Each call costs money ($0.002–$0.004 in USDC on Base) and an unpaid call only returns the payment challenge. Paying requires an x_payment payload, which means handling a payment credential; the server itself holds no private key. Results are descriptive only and explicitly not a security guarantee. url_read sends the requested URL to a third-party service.

Installation

In SourceWeft

  1. Open FabTally Guard in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.zvmzaretsky%2Ffabtally-guard/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "fabtally-guard": {
      "type": "http",
      "url": "https://guard.fabtally.com/mcp"
    }
  }
}

README

FabTally Guard — MCP server

De-risk-a-dollar verification checks an AI agent runs before a costly action. Fronts the Guard HTTP API at https://guard.fabtally.com. Holds no private key.

Tools (all paid; a call with no payment returns the decoded x402 402 challenge)

ToolPriceWhat it does
deps_check$0.003Vet a package before installing — OSV.dev CVEs, typosquat similarity, deprecation/yank, SPDX license, age/download signals + a plain-English risk verdict. Args: ecosystem (npm|pypi|crates), name, version?.
x402_preflight$0.002Verify another x402 endpoint before paying it — valid x402 v2 402 challenge? price/asset/network/payTo consistent with its /.well-known/x402? TLS/reachability/openapi? + the parsed price. Args: url.
json_repair$0.002Coerce near-miss LLM JSON to a JSON-Schema-conformant object (fences/commas/quotes/keys/literals/brackets, then type-coerce, defaults, drop extras) — or precise per-field errors. Args: json (string), schema.
url_read$0.004Fetch a public url → clean Markdown + token estimate for RAG. Respects robots.txt, public pages only, nothing stored. Args: url.

Every tool also accepts an optional x_payment (base64 x402 payload) that is forwarded as the X-PAYMENT header to settle the call and return the real result. Humans can instead prepay by card and use an X-FabTally-Key credit key against the HTTP API.

Transports

  • stdio (portable): npx fabtally-guard-mcp (bin: fabtally-guard-mcp)
  • streamable-http (hosted): https://guard.fabtally.com/mcp

Config: FABTALLY_GUARD_BASE (default https://guard.fabtally.com).

Read-only, keyless, stateless, descriptive. Operated by Sunstone Soft (fabtally.com). Not a security guarantee.

Source: README.md at commit 4972377

Tools

4

deps_check

Vet a dependency before install (paid $0.003)

PAID $0.003 (x402, USDC on Base). Vet a software package BEFORE installing it. Returns existence, latest-vs-requested, deprecation/yank markers, known CVEs from OSV.dev, typosquat similarity to popular names, SPDX license, and age/download signals with a plain-English risk verdict. Args: ecosystem (npm|pypi|crates), name, version (optional). Without payment returns the x402 challenge; pass x_payment to settle.

Parametersnamerequiredversionecosystemrequiredx_payment

x402_preflight

Verify an x402 endpoint before paying (paid $0.002)

PAID $0.002 (x402, USDC on Base). Verify another x402 endpoint BEFORE paying it: does an unpaid call return a valid x402 v2 402 challenge? do the quoted amount/asset/network/payTo match the site's /.well-known/x402? is TLS valid, host reachable, openapi present? Returns pass/fail + per-check reasons + the parsed price you would pay. Args: url. Without payment returns the x402 challenge; pass x_payment to settle.

Parametersurlrequiredx_payment

json_repair

Repair near-miss LLM JSON to a schema (paid $0.002)

PAID $0.002 (x402, USDC on Base). Coerce near-miss LLM JSON to a JSON-Schema-conformant object: strip code fences/prose, fix trailing commas/quotes/unquoted keys, normalise Python literals, balance brackets, then coerce types, apply defaults, and drop extraneous keys. Returns the repaired object OR precise per-field errors. Args: json (the raw string), schema (a JSON Schema object). Without payment returns the x402 challenge.

Parametersjsonrequiredschemarequiredx_payment

url_read

Public url -> clean Markdown + token count (paid $0.004)

PAID $0.004 (x402, USDC on Base). Fetch a PUBLIC url and return clean Markdown + a token estimate for RAG ingestion — readability extraction, boilerplate stripped. Respects robots.txt, public pages only, no login/paywall bypass, nothing stored. Args: url. Without payment returns the x402 challenge; pass x_payment to settle.

Parametersurlrequiredx_payment

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Fabtally integrations

FabTally 3D-Print Slicer, Quote & DFM

com.fabtallyOfficial publisher

Remote MCP server that slices 3D models on real FDM printer profiles to return print time, filament use, cost quotes and printability checks.

Streamable HTTPWeb executable
Business & Commerce14 toolsOct 24, 2026