PayCheck

io.github.toolweather由 GitHub 帳號 toolweather 發布v1.0.0更新於 Oct 24, 2026

Score merchant domain, https URL, or 0x wallet trust before an agent pays. Does not send payments.

發布方自己的服務:check.tattoo: tattoo size and placement guide

已驗證Streamable HTTP可網頁執行金融安全與監控

概覽

AI 產生的概覽

在 AI 代理付款前,對商家網域、https URL 或 0x 錢包進行收款方信任評分。

可以做什麼
PayCheck 透過串流 HTTP 提供三個工具。check_merchant 對網域、https URL 或 0x 錢包地址回傳確定性的信任評分與建議動作;get_quota 顯示當天剩餘的免費檢查次數;get_api_key 產生免費的 pc_live_ 金鑰。評分從 100 開始,依據允許清單成員資格、來自公開 RDAP 的網域年齡,以及詐騙或仿冒模式扣分。此伺服器不會傳送付款、不會簽署交易,也不持有錢包金鑰。
適用情境
當 AI 代理即將向商家付款、處理發票或轉帳,需要檢查收款方信任度時適用。每次付款前對每個收款方呼叫一次 check_merchant。它不是支出限額工具,也無法推翻 block 判定。
執行需求
遠端串流 HTTP 端點;不需要本機安裝或套件。選用的 Authorization Bearer pc_live_ 金鑰可將免費額度從每天 100 次提高到 1,000 次;金鑰透過 POST /v1/keys 或 get_api_key 工具產生。超出額度的檢查透過 x402 在 Base 上每次花費 0.001 USDC。需要能存取該端點與公開 RDAP 的網路連線。
安裝前請注意
Authorization 標頭攜帶機密 pc_live_ 金鑰;金鑰產生上限為每個 IP 每個 UTC 日 10 個,且僅儲存 SHA-256 雜湊。超出額度的檢查會透過 x402 在 Base 上花費 0.001 USDC,因此已設定的錢包可能被扣款。check_merchant 可能寫入檢查歷史。此伺服器不會傳送付款也不持有金鑰,但同樣無法推翻 block 判定。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 PayCheck,將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable,透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式,或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南,先向你展示發布者、端點和登入方式,經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.toolweather%2Fpaycheck/install.md,並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前,先告訴我它的發布者、端點和登入方式,等我確認。不要把 API 金鑰寫進命令或我會提交的檔案;問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "paycheck": {
      "type": "http",
      "url": "https://paycheck.toolweather.workers.dev/mcp"
    }
  }
}

README

該儲存庫沒有 README。

工具

3

check_merchant

Check merchant

Decide whether an autonomous agent should pay a merchant, host, or wallet. PayCheck returns a deterministic trust score for one target. It does not send money, does not sign transactions, and does not hold wallet keys. Use this immediately before a payment, a checkout redirect, or a transfer to a new 0x address. Pass the payee as a bare domain (api.openai.com), an https URL, or a 0x address with 40 hex characters. Do not use this tool to execute a payment. Do not use it to overturn a block. Do not call it again with a reworded category, purpose, or amount to fish for a better verdict: those fields are ignored and are not stored. Trusted is returned only for the published allowlist of known AI and developer APIs, served over https on port 443. A new or random domain is never trusted. A wallet is never trusted. Scoring v1 does not analyze on-chain history. If the URL contains an embedded 0x address, this scores the host only and will not return trusted; pass the bare address to score the wallet. Arguments: target (required string); amount_usd (optional number, ignored); category (optional string, ignored); api_key (optional pc_live_ key). You may also send Authorization: Bearer or X-API-Key. Omit the key for the anonymous allowance. Returns: score (integer 0-100), verdict (trusted | unknown | suspicious | block), reasons[], recommended_action (proceed | verify_out_of_band | require_human_review | do_not_pay), signals (host, allowlist, domain age, wallet flags, reason_codes; chain_analysis is always not_in_v1), checked_at (ISO-8601), policy_version ("1"). Free tier: 100 checks per UTC day anonymous, 1,000 per UTC day with a free pc_live_ key or a Toolweather bundle client whose x-tw-bundle-client is hex. A bundle client prefixed anon: stays at 100 per day. The same target for the same caller is idempotent for 60 seconds and does not consume a second check. Over the daily cap, each extra check is $0.001 USDC on Base (eip155:8453) via x402 and the PayAI facilitator.

輸入參數target必填api_keycategoryamount_usd

get_quota

Get quota

Show how many free PayCheck merchant checks the current caller has left for the current UTC day. Use this before a batch of check_merchant calls, or after an HTTP 402, to read the remaining free allowance and when it resets. Do not use this to score a payee. It accepts no target and it does not consume a check. Do not pay x402 for this tool. It is always free. Identity matches check_merchant. Anonymous IP: 100/day. pc_live_ api_key (api_key argument, Authorization: Bearer, or X-API-Key): 1,000/day. Toolweather bundle headers x-tw-bundle-secret and x-tw-bundle-client: hex client 1,000/day, anon: prefix 100/day, any other client id 100/day. Returns: subject_kind, limit, used, remaining, resets_at (next UTC midnight, ISO-8601), billed (always false), policy_version. No x402 charge.

輸入參數api_key

get_api_key

Get API key

Mint one free PayCheck API key. The key looks like pc_live_ followed by hex and raises the merchant-check allowance from 100 to 1,000 per UTC day. Use this once when you set up a long-running agent, then store the key and pass it on later check_merchant or get_quota calls. The plaintext key is returned only in this response. PayCheck stores a SHA-256 hash. Do not call this every turn. Do not call it to score a payee or to dodge a block verdict. Minting is free and is not an x402 check, and it is limited to 10 new keys per caller IP per UTC day. A new key does not change any merchant score. Checks above the free daily cap still cost $0.001 USDC on Base via x402. Returns: api_key, token_type (bearer), daily_limit (1000), prefix, note.

無需輸入參數。

版本歷史

1
  1. v1.0.0最新Oct 16, 2026

評分

已滿足適用檢查項的 75%

該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分

    請宣告包含 README 的 GitHub 儲存庫,或在 OAuth 受保護資源後設資料中提供 resource_documentation。

  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。

其他 Check 整合