FabTally Guard

io.github.zvmzaretsky由 GitHub 账号 zvmzaretsky 发布v1.0.0更新于 Oct 24, 2026

Verify before you act: deps-check, x402-preflight, json-repair & url-read for agents.

发布方自己的服务：FabTally 3D-Print Slicer, Quote & DFM

已验证Streamable HTTP可网页运行网页搜索与抓取开发者工具安全与监控

概览

AI 生成的概览

付费、只读的校验工具，让助手在行动前核查软件包、x402 端点、LLM JSON 和公开网址。

可以做什么
  • 安装前审查软件包：是否存在、版本、弃用/撤回标记、OSV.dev 已知漏洞、与热门名称的仿冒相似度、许可证及年龄与下载量信号，并给出风险结论
  • 付款前预检其他 x402 端点：402 挑战是否有效、报价与资产/网络/收款方是否与其 well-known 文件一致，以及 TLS、可达性和 openapi
  • 把接近正确的 LLM JSON 修复为符合 JSON Schema 的对象，或返回逐字段错误
  • 抓取公开网址并返回干净的 Markdown 与 token 估算，便于 RAG 摄取
适用场景
当助手即将执行代价高或难以撤销的操作时使用，例如安装不熟悉的软件包、向 x402 端点付款、摄取抓取页面，或依赖模型生成的 JSON，可先做一次快速核查。
运行要求
远程 streamable-http 端点 guard.fabtally.com/mcp，或通过 npx 运行 npm 包 fabtally-guard-mcp 的 stdio 方式。所有工具均收费：调用需提供 x_payment 载荷（x402，Base 上的 USDC），HTTP API 也可使用预付的 X-FabTally-Key 额度密钥。可选设置 FABTALLY_GUARD_BASE。需要网络访问。
安装前请注意
每次调用都花钱（Base 上 0.002–0.004 USDC），未付款的调用只返回付款挑战。付款需提供 x_payment 载荷，即需处理支付凭证；服务器本身不持有私钥。结果仅为描述性信息，明确不构成安全保证。url_read 会把所请求的网址发送给第三方服务。

安装

在 SourceWeft 中

  1. 打开 控制台中的 FabTally Guard，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.zvmzaretsky%2Ffabtally-guard/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "fabtally-guard": {
      "type": "http",
      "url": "https://guard.fabtally.com/mcp"
    }
  }
}

README

FabTally Guard — MCP server

De-risk-a-dollar verification checks an AI agent runs before a costly action. Fronts the Guard HTTP API at https://guard.fabtally.com. Holds no private key.

Tools (all paid; a call with no payment returns the decoded x402 402 challenge)

ToolPriceWhat it does
deps_check$0.003Vet a package before installing — OSV.dev CVEs, typosquat similarity, deprecation/yank, SPDX license, age/download signals + a plain-English risk verdict. Args: ecosystem (npm|pypi|crates), name, version?.
x402_preflight$0.002Verify another x402 endpoint before paying it — valid x402 v2 402 challenge? price/asset/network/payTo consistent with its /.well-known/x402? TLS/reachability/openapi? + the parsed price. Args: url.
json_repair$0.002Coerce near-miss LLM JSON to a JSON-Schema-conformant object (fences/commas/quotes/keys/literals/brackets, then type-coerce, defaults, drop extras) — or precise per-field errors. Args: json (string), schema.
url_read$0.004Fetch a public url → clean Markdown + token estimate for RAG. Respects robots.txt, public pages only, nothing stored. Args: url.

Every tool also accepts an optional x_payment (base64 x402 payload) that is forwarded as the X-PAYMENT header to settle the call and return the real result. Humans can instead prepay by card and use an X-FabTally-Key credit key against the HTTP API.

Transports

  • stdio (portable): npx fabtally-guard-mcp (bin: fabtally-guard-mcp)
  • streamable-http (hosted): https://guard.fabtally.com/mcp

Config: FABTALLY_GUARD_BASE (default https://guard.fabtally.com).

Read-only, keyless, stateless, descriptive. Operated by Sunstone Soft (fabtally.com). Not a security guarantee.

来源：README.md，提交 4972377

工具

4

deps_check

Vet a dependency before install (paid $0.003)

PAID $0.003 (x402, USDC on Base). Vet a software package BEFORE installing it. Returns existence, latest-vs-requested, deprecation/yank markers, known CVEs from OSV.dev, typosquat similarity to popular names, SPDX license, and age/download signals with a plain-English risk verdict. Args: ecosystem (npm|pypi|crates), name, version (optional). Without payment returns the x402 challenge; pass x_payment to settle.

输入参数name必填versionecosystem必填x_payment

x402_preflight

Verify an x402 endpoint before paying (paid $0.002)

PAID $0.002 (x402, USDC on Base). Verify another x402 endpoint BEFORE paying it: does an unpaid call return a valid x402 v2 402 challenge? do the quoted amount/asset/network/payTo match the site's /.well-known/x402? is TLS valid, host reachable, openapi present? Returns pass/fail + per-check reasons + the parsed price you would pay. Args: url. Without payment returns the x402 challenge; pass x_payment to settle.

输入参数url必填x_payment

json_repair

Repair near-miss LLM JSON to a schema (paid $0.002)

PAID $0.002 (x402, USDC on Base). Coerce near-miss LLM JSON to a JSON-Schema-conformant object: strip code fences/prose, fix trailing commas/quotes/unquoted keys, normalise Python literals, balance brackets, then coerce types, apply defaults, and drop extraneous keys. Returns the repaired object OR precise per-field errors. Args: json (the raw string), schema (a JSON Schema object). Without payment returns the x402 challenge.

输入参数json必填schema必填x_payment

url_read

Public url -> clean Markdown + token count (paid $0.004)

PAID $0.004 (x402, USDC on Base). Fetch a PUBLIC url and return clean Markdown + a token estimate for RAG ingestion — readability extraction, boilerplate stripped. Respects robots.txt, public pages only, no login/paywall bypass, nothing stored. Args: url. Without payment returns the x402 challenge; pass x_payment to settle.

输入参数url必填x_payment

版本历史

1
  1. v1.0.0最新Sep 16, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

其他 Fabtally 集成

FabTally 3D-Print Slicer, Quote & DFM

com.fabtally官方发布者

远程 MCP 服务器，用真实 FDM 打印机配置切片 3D 模型，返回打印时间、耗材用量、报价与可打印性检查。

Streamable HTTP可网页运行
商业与电商14 个工具Oct 24, 2026