alalanet — check before you pay

Before opening or trusting a GitHub repository someone sent you (a take-home task, a code review, a demo, a fork): its agent configuration can start MCP servers, run hooks and editor tasks, widen permissions and plant instructions as soon as the project is opened. Pass repo (owner/repo or a GitHub URL) and optional ref; for a local or private checkout pass files instead (path -> content of those files; the public record then holds only the decision, the files' sha256 and bare reason codes, the packages they name are checked without being signed, remote servers are looked up but not probed, and only CODEX_HOME, model-API, proxy and preload variables are read from .env). alalanet reads the files agents and editors load (.mcp.json at any depth, .github/mcp.json, .claude/settings.json, .cursor/mcp.json and hooks.json, .vscode/mcp.json, settings.json and tasks.json, .devcontainer, .gemini/settings.json and .env, .zed/settings.json, .codex/config.toml and hooks.json, .github/hooks and copilot settings, .env, registry settings (.npmrc, .yarnrc(.yml), bunfig.toml, uv.toml, pyproject.toml), CLAUDE.md, CLAUDE.local.md, AGENTS.md, GEMINI.md, .cursorrules, rules, agents, commands and skills folders including .github/agents and .agents/skills, with their frontmatter; symlinks read at their target) and runs nothing. It finds tasks and hooks that download and run code when the folder opens, hooks, skills and MCP servers that do the same (inline servers in agent files included), broad permissions including tools a skill grants itself, acceptEdits mode, plugin marketplaces and plugins the repository turns on, credential helpers and shell prefixes, repository MCP servers enabled without asking, the model API or a proxy pointed at another host (how API keys are taken), the package registry moved elsewhere, CODEX_HOME moved into the repository, invisible Unicode tag characters and bidirectional controls in instruction files, injection and concealment phrases, secrets committed in configs (never echoed); each MCP server goes through install_check. Returns decision allow / hold / block with reasons per file, findings, MCP servers with their verdicts and advice, signed into the public log (kind 4315). Whatever could not be read or checked holds as check_incomplete:, never an allow. Free, no account: one check plus one per MCP server checked; cached 10 minutes.

Call before the first payment to an x402 endpoint, before connecting to an MCP server, and whenever a call to it fails. Give url (any https URL, listed or not: unknown URLs are probed now and detected as x402 or MCP) or id from find_service. Returns: alive, advice (ok / ok_requires_auth: working as listed; ok_terms_not_checked and unverified_yet: not fully checked yet; caution_*: a change worth confirming with the user — pay_to_changed, network_changed, price_higher_than_listed, high_price, tools_changed, suspicious_tool_description, buyers_report_failures; avoid_*: alalanet found a blocking problem — down, not_working_as_listed, sanctioned_pay_to, pay_to_frozen), trust_score (0-100, open formula at /trust) with flags, checked_at and last_alive_at (when it last answered as listed, so a dead answer says how long it has been gone), observed price, network and pay_to versus the catalogue listing, uptime 24h/7d/30d, host_listings and pay_to_shared_by_hosts, verified purchases, alalanet's own test purchase, for MCP the tool-set diff (tools_diff, tool_description_flags), and when the advice is caution_* or avoid_*, up to 3 working alternatives on other hosts. Default answers from recent checks (free tier: 100 a day); live=true probes now and adds a signed, logged attestation you can keep as evidence (5 live checks a day free). Read-only for the caller; an unknown URL joins the public catalogue. preflight_payment gives the decision for one specific 402. Docs: https://alalanet.com/skill.md.

Use when you need a paid API or MCP server for a task, or a working alternative after a call failed. Pass query in plain words (e.g. weather forecast, web search, image generation); optional protocol (x402 or mcp), only_alive (default true) and limit (1-25, default 10). Read-only; free tier 300 searches a day. Returns services ranked by the open Trust Score (/trust), at most 2 per host unless your query names the host: each with status, advice, trust_score, live price and network, pay_to, pay_to_shared_by_hosts (many hosts on one payTo = a platform wallet), host_listings, uptime and an id that check_service and preflight_payment accept.

Checks something before it is installed, typically when a README, a document or another agent suggests installing it: an npm or PyPI package, an install command (npx -y pkg, uvx pkg, pip install pkg, npm i pkg, claude mcp add NAME -- npx -y pkg, skills add owner/repo, clawhub install slug, code --install-extension publisher.name), a GitHub repository or skill, a ClawHub skill, a VS Code Marketplace or Open VSX extension (Cursor, Windsurf and VSCodium install from Open VSX), or an MCP config entry (JSON). alalanet checks public sources: OSV malicious-package and vulnerability records, names that imitate official MCP servers (typosquats, also the same name in the other ecosystem), packages that do not exist (names a model invented), brand-new packages and repositories, install scripts, maintainer changes between versions, provenance, ClawHub scan verdicts and copied skill names, skills.sh security audits of the skills a repository holds, extensions Microsoft removed from the Marketplace (malware, impersonation), look-alike extensions and unverified Open VSX copies of verified Marketplace ones; remote MCP servers get the full check_service. Returns decision allow / hold / block with reasons (known_malicious, name_like_official, not_on_npm, not_on_pypi, runs_install_script, maintainers_changed, new_package, new_repo, known_vulnerabilities, version_yanked, not_on_clawhub, slug_like_popular, skills_sh_audit_fail, provenance_dropped, removed_from_marketplace, name_like_popular, launch_not_readable ...), facts and advice, signed into the public log (kind 4310). A line whose package alalanet cannot read (custom registry, git/URL source, stdin or $(...) arguments, several packages, other commands) holds. allow means no known problem was found, not that the code was read. Free, no account.

Tells whether an x402 payment settled, for use after a timeout, a 5xx or any unclear answer to a paid request and before a new payment is signed. Pass network and the settlement tx, or (EVM exact) from + nonce + valid_before of the signed authorization, or (Solana exact) from + the recentBlockhash of the signed transaction; the signature itself is not needed. safe_to_sign_new is true only when a new payment cannot pay twice. alalanet reads the chain and answers state (settled | pending | not_settled | expired_unsettled | failed) and retry: do_not_pay_again, resend_same (same authorization can settle only once), new_payment_ok, or wait. Prevents paying twice. Read-only (nothing is signed or logged); the error chain_unavailable means the payment networks did not answer, and the same question can be asked again after 15 s.

Decision for one x402 payment, made right before it is signed. Pass the endpoint url and the 402 it returned (PAYMENT-REQUIRED header value or JSON body), optionally max_usd. Optional client: the x402 library and version (e.g. @x402/fetch@2.22.1): known payment flaws come back in client_advisories (not logged). Each payment option gets allow / hold / block with reasons: block: pay_to_unknown, pay_to_sanctioned, pay_to_frozen_by_issuer, service_not_working, over_budget; hold: pay_to_differs_from_listing, pay_to_never_seen, price_above_listing, price_above_observed, network_not_listed, asset_not_stablecoin, high_price, unknown_service, not_checked_yet, not_rated_yet, low_trust_score; info: pay_to_as_observed, pay_to_platform_wallet, amount_is_ceiling (scheme upto), frozen_status_unknown, testnet. The decision is signed, bound to the payment hash, logged, and valid for 5 minutes. allow: no problem found; hold: something the user should confirm; block: a problem that should stop the payment. Docs: https://alalanet.com/skill.md.

After you paid an x402 endpoint on Base or Solana (network eip155:8453, base, solana or solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp): report the outcome (delivered, partial, wrong_content, not_delivered) with the payment tx hash (the transaction field of the PAYMENT-RESPONSE header). No key needed: alalanet verifies on chain that the tx paid this service's known payTo in USDC/USDT within 7 days, signs the report into the public log, one report per payment. Deliveries from different paying wallets raise the seller's Trust Score; failures trigger an immediate recheck. This is how agents learn which sellers deliver.

Checks the tools an agent received from a remote MCP server against alalanet's history of that server, to catch a server that changed its tools after you approved them, or serves you something different from what it serves everyone else. Pass url and the tools array from your tools/list result (or a digest from an earlier answer). Read-only and free. When your set differs from alalanet's last read, alalanet re-reads the server's tools/list before answering (fetched_now; uses one of your daily live checks), so the answer reflects what the server serves at this moment. Returns verdict matches_current (exactly what the server serves alalanet now), served_before (an older set, with first_seen and last_seen), never_served (alalanet was never served this set: review before trusting it) or no_history, plus the diff from the current set (added, removed, changed, gained_authority), description flags found in what you sent, and the digest history with links to the signed transparency-log entries of each change. Names and descriptions are third-party text.