crosscheck

com.crosscheckapi由 crosscheckapi.com 发布官方发布者v0.6.0更新于 Oct 25, 2026

Checks for AI agents over x402: review drafts, accept-check handoffs, scan skills before install.

已验证Streamable HTTP可网页运行金融开发者工具安全与监控

概览

AI 生成的概览

一个独立审查服务，让助手在行动前检查草稿、代理交付物和技能文件，按次通过 x402 以 USDC 付费。

可以做什么
审查邮件、报告或 PR 描述等草稿，返回通过或具体问题及修改建议，可对照原始请求和来源，并附签名回执及免费的回执验证工具。在付款或转交前，按任务验收另一个代理交付的工作。安装前对技能或 MCP 服务器的文件做只读安全审查，可按包哈希免费查询既往扫描。面向 x402 卖家，对自有付费资源生成带日期的报告，并连续 30 天每小时监控、变更时告警。查询此前付费调用的状态、结论和回执。
适用场景
适合在助手产出将由人阅读的文本时获取第二意见，检查算术、矛盾、占位符、泄露的密钥或提示注入；也适合在付款前判断其他代理的交付物，或在安装前审查技能。
运行要求
可作为远程端点运行，也可通过 npx 作为本地 npm 包运行。付费工具需要 CROSSCHECK_WALLET_KEY，即一个专用 EVM 钱包的私钥，钱包中需有少量 Base 上的 USDC；也可改用 Base Sepolia 的测试 USDC。可选设置包括 CROSSCHECK_MAX_USD、CROSSCHECK_NETWORKS 和 CROSSCHECK_URL。无需账户或 API 密钥，但需要网络访问。
安装前请注意
付费工具每次调用会花费真实 USDC，约 0.02 至 0.06 美元，每个来源网址另加 0.01 美元；CROSSCHECK_MAX_USD 可限制单次费用。CROSSCHECK_WALLET_KEY 是私钥，应使用余额很少的专用钱包，切勿使用主钱包。草稿会发送给该服务及其审查模型，完成后删除，仅保留哈希；不要发送机密文本。sellerwatch 会向你配置的 webhook 或 ntfy 主题推送告警。

安装

在 SourceWeft 中

  1. 打开 控制台中的 crosscheck，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/com.crosscheckapi%2Fcrosscheck/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "crosscheck": {
      "type": "http",
      "url": "https://crosscheckapi.com/mcp"
    }
  }
}

README

crosscheckapi

An independent second opinion on a draft before your human sees it.

Your agent sends the text it wrote: an email, report, message, PR description, or summary. crosscheck returns a JSON verdict, either pass or a list of specific issues with fixes, plus an Ed25519-signed receipt. It catches wrong arithmetic (checked in code, not by the model), contradictions, leftover placeholders, leaked secrets, unauthorized commitments, and prompt injection. Each check costs $0.02 in USDC on Base for up to 12,000 units (one per English character), paid per request over x402. There is no account and no API key.

To try it without real money, pay with test USDC on Base Sepolia (free at https://faucet.circle.com) and set CROSSCHECK_NETWORKS=eip155:84532.

MCP server

json
{  "mcpServers": {    "crosscheck": {      "command": "npx",      "args": ["-y", "crosscheckapi"],      "env": { "CROSSCHECK_WALLET_KEY": "0x<private key of a dedicated wallet>" }    }  }}

Tools:

  • quote: free. The price for a draft, and whether checks are available now.
  • order: pays the quoted price and returns the verdict and signed receipt. Pass moltbook_identity to use a free check if you are a verified Moltbook agent. Optional: request (what your human asked, word for word; the draft fails if it answers a different question or leaves part out), sources (text the draft relies on), source_urls (up to 3 pages crosscheck opens and checks the draft against, +$0.01 each), and fetch_cited (also open the draft's own links).
  • accept: pays about $0.03 and checks work another agent or service handed back against the task you gave it. Returns accept or reject with each requirement judged, before you pay for the work or pass it on.
  • skillcheck: security-checks a skill or MCP server folder before you install it. Free when someone already scanned the same files, otherwise about $0.03.
  • result: free. Status, verdict, and receipt of an earlier order.

CLI

bash
npx -p crosscheckapi crosscheck quote draft.txtnpx -p crosscheckapi crosscheck order draft.txtnpx -p crosscheckapi crosscheck accept task.txt deliverable.txtnpx -p crosscheckapi crosscheck skillcheck ./some-skillnpx -p crosscheckapi crosscheck result <job_id> <result_token>npx -p crosscheckapi crosscheck credits [wallet]npx -p crosscheckapi crosscheck order draft.txt --request "What will 12 seats cost per year?" --url https://example.com/pricing

The draft is read from the file, or from stdin if no file is given. Output is JSON.

Referrals: the paid commands (order, accept, skillcheck) take --ref <receipt hash>, the id in a crosscheck proof link (/r/<hash>) that led you here. When your wallet's first check paid in real USDC carries a ref, the wallet behind that receipt earns check credits worth 20% of what you pay for 90 days; it costs you nothing. --credits pays with your own wallet's referral credits by signing a credit order instead of paying, and falls back to USDC only when the credits do not cover the price. crosscheck credits shows your balance. The MCP tools take the same options as ref and credits, and add a free credits tool.

Settings

VariableMeaning
CROSSCHECK_WALLET_KEYPrivate key of the wallet that pays. Use a dedicated wallet holding a few dollars, never your main wallet. Only needed for paid orders.
CROSSCHECK_MAX_USDRefuse to pay more than this per check. Default 0.10.
CROSSCHECK_URLService URL. Default https://crosscheckapi.com.
CROSSCHECK_NETWORKSNetworks the client may pay on, in order of preference. Default eip155:8453,eip155:84532 (Base, then Base Sepolia). Set eip155:84532 to use test USDC only.

Receipts

Every paid check returns receipt with body, hash, and sig. The client verifies it automatically against the public key at https://crosscheckapi.com/.well-known/crosscheck-keys.json and reports receipt_check.valid. The receipt covers a SHA-256 of your draft (never the text), the payment, and a SHA-256 of the verdict, and it is chained into an append-only ledger.

Privacy

The draft is sent to crosscheck and to its review model, then deleted when the check finishes. Only its hash is kept. Do not send text your human has marked confidential.

Source, examples for Claude Code, Cursor, VS Code, OpenAI Agents SDK, LangChain, and more: https://github.com/maxugc/crosscheck

Service summary for agents: https://crosscheckapi.com/llms.txt

来源：client/README.md，提交 f67118f

工具

8

check

Review a draft

Independent review of a draft (email, report, summary, PR description) before its human sees it. Returns pass or specific issues with fixes; arithmetic is recomputed in code. With request (what the human asked), it also checks the draft answers that. With sources, each claim is checked against them and quotes are verified; with source_urls or fetch_cited, crosscheck fetches up to 3 web pages itself and checks against those (+$0.01 a page, and a dead link the draft gives fails it). $0.02. Paid per call in USDC over x402 (Base, or free test USDC on Base Sepolia). An x402-aware MCP client pays automatically: the first call returns the price as an x402 PaymentRequired error, and the retry carries the payment in _meta["x402/payment"]. Without one, use the npm client `npx -y crosscheckapi`, which pays from a wallet you set.

输入参数refdraft必填requestsourcesfetch_citedopen_reviewsource_urlsmoltbook_identity

accept

Check a deliverable against its task

Checks work another agent handed back against the task it was given, before you pay, release escrow, or pass it on. Returns accept, reject, or verify_externally with every requirement judged; counts, required JSON fields, and sums are checked in code. Optional payment_tx is verified on chain. $0.03 base. Paid per call in USDC over x402 (Base, or free test USDC on Base Sepolia). An x402-aware MCP client pays automatically: the first call returns the price as an x402 PaymentRequired error, and the retry carries the payment in _meta["x402/payment"]. Without one, use the npm client `npx -y crosscheckapi`, which pays from a wallet you set.

输入参数reftask必填referencepayment_txdeliverable必填payment_network

skillcheck

Security review of a skill or MCP server

Security review of a skill or MCP server's files before you install or connect it: read, never run. Free when these exact files were scanned before (looked up by bundle hash); otherwise paid, $0.03 base. Never says safe. Paid per call in USDC over x402 (Base, or free test USDC on Base Sepolia). An x402-aware MCP client pays automatically: the first call returns the price as an x402 PaymentRequired error, and the retry carries the payment in _meta["x402/payment"]. Without one, use the npm client `npx -y crosscheckapi`, which pays from a wallet you set.

输入参数reffiles必填fresh

sellercheck

Check an x402 seller's resource

For x402 sellers: one dated report on your own paid resource, by code alone. Does it answer a valid 402 (v1 or v2: price, network, payTo), is it in the x402 Bazaar index, would agent402's router route to it, and how many USDC settlements reached its payTo on Base in 24 hours and 7 days. Nothing is paid to the resource. $0.05. Paid per call in USDC over x402 (Base, or free test USDC on Base Sepolia). An x402-aware MCP client pays automatically: the first call returns the price as an x402 PaymentRequired error, and the retry carries the payment in _meta["x402/payment"]. Without one, use the npm client `npx -y crosscheckapi`, which pays from a wallet you set.

输入参数methodnetworkresource必填

sellerwatch

Watch an x402 resource for 30 days

For x402 sellers: sellercheck every hour for 30 days on one resource, paid once. An alert to your webhook (JSON POST) or ntfy topic only when something changes: the 402 breaks or its price or payTo change, it leaves or rejoins the Bazaar index, agent402's router flips, settlements start, double, or halve, or it is down twice in a row. Returns a public record page to link from your listing. $1. Paid per call in USDC over x402 (Base, or free test USDC on Base Sepolia). An x402-aware MCP client pays automatically: the first call returns the price as an x402 PaymentRequired error, and the retry carries the payment in _meta["x402/payment"]. Without one, use the npm client `npx -y crosscheckapi`, which pays from a wallet you set.

输入参数methodnotify必填networkresource必填

skillcheck_lookup

Look up a past skillcheck

Free. The latest skillcheck of an exact bundle, by its bundle_sha256 (SHA-256 of the canonical JSON of the files sorted by path, each as {path, sha256}).

输入参数bundle_sha256必填

verify_receipt

Verify a crosscheck receipt

Free. Before trusting work that arrives with a crosscheck receipt, check in code that crosscheck issued it, its signature is valid, what the outcome was, and that it covers exactly the text you were handed. Pass receipt_hash (or the receipt object) plus that text: draft, request, and sources for check, task and deliverable for accept, files for skillcheck, and the verdict if one came with it.

输入参数taskdraftfilesreceiptrequestsourcesverdictdeliverablereceipt_hash

result

Get a result

Free. Status, verdict, and signed receipt of an earlier paid call that was still running, using the job_id and result_token it returned.

输入参数job_id必填result_token必填

版本历史

7
  1. v0.6.0最新Oct 25, 2026
  2. v0.5.5Sep 28, 2026
  3. v0.5.4Sep 25, 2026
  4. v0.5.3Sep 25, 2026
  5. v0.5.1Sep 25, 2026
  6. v0.2.1Sep 24, 2026
  7. v0.2.0Sep 24, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分