FabTally Guard

io.github.zvmzaretsky由 GitHub 帳號 zvmzaretsky 發布v1.0.0更新於 Oct 24, 2026

Verify before you act: deps-check, x402-preflight, json-repair & url-read for agents.

發布方自己的服務：FabTally 3D-Print Slicer, Quote & DFM

已驗證Streamable HTTP可網頁執行網頁搜尋與抓取開發者工具安全與監控

概覽

AI 產生的概覽

付費、唯讀的驗證工具，讓助理在行動前檢查套件、x402 端點、LLM JSON 與公開網址。

可以做什麼
  • 安裝前審查套件：是否存在、版本、棄用/撤回標記、OSV.dev 已知漏洞、與熱門名稱的仿冒相似度、授權條款及年齡與下載量訊號，並給出風險結論
  • 付款前預檢其他 x402 端點：402 挑戰是否有效、報價與資產/網路/收款方是否與其 well-known 檔案一致，以及 TLS、可達性與 openapi
  • 把接近正確的 LLM JSON 修復為符合 JSON Schema 的物件，或回傳逐欄位錯誤
  • 抓取公開網址並回傳乾淨的 Markdown 與 token 估算，方便 RAG 匯入
適用情境
當助理即將執行代價高或難以復原的動作時使用，例如安裝不熟悉的套件、向 x402 端點付款、匯入抓取頁面，或依賴模型產生的 JSON，可先做一次快速檢查。
執行需求
遠端 streamable-http 端點 guard.fabtally.com/mcp，或透過 npx 執行 npm 套件 fabtally-guard-mcp 的 stdio 方式。所有工具皆收費：呼叫需提供 x_payment 酬載（x402，Base 上的 USDC），HTTP API 也可使用預付的 X-FabTally-Key 額度金鑰。可選設定 FABTALLY_GUARD_BASE。需要網路存取。
安裝前請注意
每次呼叫都要付費（Base 上 0.002–0.004 USDC），未付款的呼叫只會回傳付款挑戰。付款需提供 x_payment 酬載，也就是要處理付款憑證；伺服器本身不持有私鑰。結果僅為描述性資訊，明確不構成安全保證。url_read 會把所請求的網址傳送給第三方服務。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 FabTally Guard，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.zvmzaretsky%2Ffabtally-guard/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "fabtally-guard": {
      "type": "http",
      "url": "https://guard.fabtally.com/mcp"
    }
  }
}

README

FabTally Guard — MCP server

De-risk-a-dollar verification checks an AI agent runs before a costly action. Fronts the Guard HTTP API at https://guard.fabtally.com. Holds no private key.

Tools (all paid; a call with no payment returns the decoded x402 402 challenge)

ToolPriceWhat it does
deps_check$0.003Vet a package before installing — OSV.dev CVEs, typosquat similarity, deprecation/yank, SPDX license, age/download signals + a plain-English risk verdict. Args: ecosystem (npm|pypi|crates), name, version?.
x402_preflight$0.002Verify another x402 endpoint before paying it — valid x402 v2 402 challenge? price/asset/network/payTo consistent with its /.well-known/x402? TLS/reachability/openapi? + the parsed price. Args: url.
json_repair$0.002Coerce near-miss LLM JSON to a JSON-Schema-conformant object (fences/commas/quotes/keys/literals/brackets, then type-coerce, defaults, drop extras) — or precise per-field errors. Args: json (string), schema.
url_read$0.004Fetch a public url → clean Markdown + token estimate for RAG. Respects robots.txt, public pages only, nothing stored. Args: url.

Every tool also accepts an optional x_payment (base64 x402 payload) that is forwarded as the X-PAYMENT header to settle the call and return the real result. Humans can instead prepay by card and use an X-FabTally-Key credit key against the HTTP API.

Transports

  • stdio (portable): npx fabtally-guard-mcp (bin: fabtally-guard-mcp)
  • streamable-http (hosted): https://guard.fabtally.com/mcp

Config: FABTALLY_GUARD_BASE (default https://guard.fabtally.com).

Read-only, keyless, stateless, descriptive. Operated by Sunstone Soft (fabtally.com). Not a security guarantee.

來源：README.md，提交 4972377

工具

4

deps_check

Vet a dependency before install (paid $0.003)

PAID $0.003 (x402, USDC on Base). Vet a software package BEFORE installing it. Returns existence, latest-vs-requested, deprecation/yank markers, known CVEs from OSV.dev, typosquat similarity to popular names, SPDX license, and age/download signals with a plain-English risk verdict. Args: ecosystem (npm|pypi|crates), name, version (optional). Without payment returns the x402 challenge; pass x_payment to settle.

輸入參數name必填versionecosystem必填x_payment

x402_preflight

Verify an x402 endpoint before paying (paid $0.002)

PAID $0.002 (x402, USDC on Base). Verify another x402 endpoint BEFORE paying it: does an unpaid call return a valid x402 v2 402 challenge? do the quoted amount/asset/network/payTo match the site's /.well-known/x402? is TLS valid, host reachable, openapi present? Returns pass/fail + per-check reasons + the parsed price you would pay. Args: url. Without payment returns the x402 challenge; pass x_payment to settle.

輸入參數url必填x_payment

json_repair

Repair near-miss LLM JSON to a schema (paid $0.002)

PAID $0.002 (x402, USDC on Base). Coerce near-miss LLM JSON to a JSON-Schema-conformant object: strip code fences/prose, fix trailing commas/quotes/unquoted keys, normalise Python literals, balance brackets, then coerce types, apply defaults, and drop extraneous keys. Returns the repaired object OR precise per-field errors. Args: json (the raw string), schema (a JSON Schema object). Without payment returns the x402 challenge.

輸入參數json必填schema必填x_payment

url_read

Public url -> clean Markdown + token count (paid $0.004)

PAID $0.004 (x402, USDC on Base). Fetch a PUBLIC url and return clean Markdown + a token estimate for RAG ingestion — readability extraction, boilerplate stripped. Respects robots.txt, public pages only, no login/paywall bypass, nothing stored. Args: url. Without payment returns the x402 challenge; pass x_payment to settle.

輸入參數url必填x_payment

版本歷史

1
  1. v1.0.0最新Sep 16, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

其他 Fabtally 整合

FabTally 3D-Print Slicer, Quote & DFM

com.fabtally官方發布者

遠端 MCP 伺服器，以真實 FDM 印表機設定切片 3D 模型，回傳列印時間、耗材用量、報價與可列印性檢查。

Streamable HTTP可網頁執行
商業與電商14 個工具Oct 24, 2026