Security Preflight

io.github.jdhart81由 GitHub 账号 jdhart81 发布v1.3.1更新于 Nov 2, 2026

Static MCP, source-code and injection-indicator checks with redacted signed receipts.

发布方自己的服务：Preflight

已验证Streamable HTTP可网页运行开发者工具安全与监控

服务详情

标识符: io.github.jdhart81/security-preflight
传输: Streamable HTTP
运行时: Web executable
信任: Verified
发布于: Sep 16, 2026

安全提示

MCP 服务会接收对话中的工具调用请求，并可能执行外部操作。启用前请先了解该服务能做什么，并只授予它所需的权限。

注册中心已验证此条目所属的 GitHub 账号 jdhart81。这并不表明该账号就是产品方。

SourceWeft 的检查只涵盖条目是否完整、端点是否响应；不审查服务器的代码，也不审查其工具的行为。

在 README 中添加徽章

向读者展示该 MCP 服务已收录于 SourceWeft，徽章链接到本页。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.jdhart81%2Fsecurity-preflight.svg)](https://sourceweft.com/mcp/io.github.jdhart81%2Fsecurity-preflight?utm_source=readme&utm_medium=badge)

概览

AI 生成的概览

远程 MCP 服务，提供付费的静态安全预检、内联源码扫描与提示注入筛查，并返回签名回执。

可以做什么: 运行静态安全预检并获取签名回执
扫描内联源码中的漏洞指标，返回脱敏的签名回执
批量筛查文本样本中的确定性提示注入标记
读取回执的过滤后公开视图，并查看该代理的范围、输入与输出说明
适用场景: 在采用某段代码或文本前，希望快速、确定性地检查其安全指标，或需要一份可审计的检查回执时使用。适合作为代理工作流中的低成本预检环节，而非完整审计。
运行要求: 远程 streamable HTTP 端点，无需安装软件包。每次检查定价 1 美元；直接使用 MCP 需要结账调用方和经过验证的固定顺序会话，另有独立的 x402 HTTP 支付通道。未声明环境变量或请求头。

安装前请注意

每次工具调用花费 1 美元，反复使用会产生费用。结果只是启发式指标，并非已证实的漏洞或经过校准的安全概率，也不会抓取或测试任何已部署端点。公开视图中的回执未签名且经过过滤，需保留原始交付件以验证签名。源码与文本样本会发送至第三方托管服务。

安装

在 SourceWeft 中

打开控制台中的 Security Preflight，将其添加到工作区。
为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.jdhart81%2Fsecurity-preflight/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "security-preflight": {
      "type": "http",
      "url": "https://mcp.viridis-security.com/security-preflight/mcp"
    }
  }
}

README

Viridis Agent Fleet: open-source agents for the agent economy

Deterministic, auditable MCP agents: trust and settlement rails (identity, trust, escrow, metering, arbitration, notary, surety, provenance, covenant, offsets, compute-ledger) and priced-grade services (tax credits, GHG accounting, construction takeoff, measurement, compliance). Every core is pure Python with no LLM in the serving path, and every result is content-addressed so anyone can re-verify it.

Licensed Apache-2.0. Run any agent yourself, fork it, embed it.

Run an agent locally (free, forever)

bash

pip install -r requirements-dev.txtpython3 agent-escrow-agent/adapters/mcp_server.py          # stdio MCPpython3 run_fleet_tests.py                                 # every agent's invariant tests

pip install -r requirements-dev.txtpython3 agent-escrow-agent/adapters/mcp_server.py          # stdio MCPpython3 run_fleet_tests.py                                 # every agent's invariant tests

Or use the hosted fleet

https://mcp.viridisconservation.com runs all agents as one managed MCP service:

	Self-hosted (this repo)	Hosted by Viridis
Agent logic & verification	✅ identical	✅ identical
Viridis-signed receipts & notary chain	–	✅
Shared trust/reputation network data	–	✅
Maintained rule packs (tax, GHG factors, regs)	snapshot	✅ kept current
Payments (x402, card), seats, SLA	–	✅

Free tier: 10 calls/day per service; the rails (identity, escrow, metering…) are free forever. Verification is always free.

For agents

Agents and LLM tools can start from llms.txt, a generated index of every agent, and AGENTS.md, the rules for using and changing the fleet.

Part of the Viridis open-source commons

Building agents for conservation or energy work? VergeCommon and EnergyAI MCP also expose MCP tools, and ViridisOS serves its decision functions to agents over MCP.

This project is one of a connected set of open tools from Viridis. Each stands on its own; together they run from field evidence to checked decisions.

Conservation commons

VergeCommon: community conservation co-ops with consent-based land mapping, field evidence and group decisions
Dendritic Forest Management (DFM): compare forest-retention options around roads and waterways, with traceable inputs and portable reports
Global Soil Intelligence Project (GSIP): contribute soil observations and explore open soil maps with explicit uncertainty

Verifiable science

Viridis Canon: machine-checked Lean 4 mathematics for ecological decisions, with a DOI for every result
ViridisOS: open reference runtime for DOI-backed decision modules and recomputable results
Viridis Research: the nightly public research record, each claim labeled by what a verifier actually checked
ProofLens: see what a Lean statement means before reading the proof

Agent tools

Viridis Agent Fleet (this repository): open-source MCP agents with deterministic, auditable cores
EnergyAI MCP: energy-planning estimates and incentive sources for AI agents

Browse every project on the Viridis profile. If this one is useful to you, a star helps other people find it.

Boundary

This repo contains agent cores, MCP adapters, tests, standards and self-host tooling. The hosted service layer (gateway, payment and settlement, seats, signing authority, operations, telemetry and customer data) is proprietary and is not in this repo. Please don't open PRs that add it.

"Viridis", "Viridis Conservation" and the Viridis marks are trademarks of Viridis LLC; see TRADEMARKS.md.

来源：README.md，提交 350712c

工具

security_preflight

Static agent manifest assessment

Run a $1 static Security Preflight and return a signed receipt. Direct MCP requires the checkout caller and verified fixed-order session. The separate x402 HTTP rail retains its existing introductory quote policy. No deployed endpoint is fetched or tested. Importing the receipt into an Agent Market profile is a separate, explicit action.

输入参数policyagent_id必填manifest必填request_idsession_idpayment_refsample_inputssubject_profile_sha256

scan_source

Inline source indicator scan

$1 bounded inline VulnCanon source scan; indicators, not proven exploits. Direct MCP requires the checkout caller and verified fixed-order session. At most 64 KiB, 2000 lines, 4096 characters per line. No model calls, repository fetching or code execution. Returns a redacted signed receipt.

输入参数source必填agent_id必填session_id

screen_injection

Text injection indicator screening

$1 batch of 1–20 text samples screened for deterministic injection markers. Direct MCP requires the checkout caller and verified fixed-order session. Maximum 64 KiB total. Heuristic indicators, not calibrated probabilities or a guarantee of safety. No model calls or automatic follow-on purchase.

输入参数texts必填agent_id必填session_id