ExitProof

Check agent purchase

check_agent_purchase

Inspect one autonomous HTTP purchase before the calling agent pays it. This $0.01 machine-payment operation validates a real 402 challenge, compares advertised price/protocol/network/asset/payment destination when supplied, checks x402 v2 exact resource binding when available, and surfaces retry or settled-delivery recovery signals. ExitProof never forwards payment credentials and never sends a live POST, PUT, PATCH, or DELETE probe; for those methods the caller supplies an already-observed 402 challenge. Conflicting, malformed, inaccessible, non-402, or unsafe targets are rejected before ExitProof issues its own payment challenge. Use check_reversibility instead for cancellation/refund terms on a real-world commitment, create_exit_manifest to preserve an eligible exit path, and build_exit_pack when an exit is actually needed. A successful check is not a recommendation, merchant-identity guarantee, delivery guarantee, legal opinion, or authorization to spend.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`operation`	No	Optional caller label for the target operation. This is descriptive only and is included in the check digest.
`advertised`	No	Optional payment facts advertised by discovery metadata. ExitProof compares these to the observed 402 challenge and rejects material conflicts before its own payment challenge.
`live_probe`	No	Whether ExitProof may make one anonymous, credential-free request to target_url. Defaults true for GET/HEAD and false for state-changing methods.
`target_url`	Yes	Public HTTPS endpoint the agent is considering paying. Credentials, localhost, private-address literals, and non-HTTPS URLs are rejected.
`request_method`	No	HTTP method of the contemplated purchase. Live probing is allowed only for GET or HEAD. For state-changing methods supply observed_response instead.	GET
`retry_contract`	No	Optional retry, settled-delivery recovery, and refund/reversal facts advertised by the target. These remain caller-supplied unless independently verified elsewhere.
`observed_response`	No	A 402 response already observed by the calling agent. Required when live_probe is false. Supply payment challenge headers only, never a payment credential.

Output Schema

TableJSON Schema

Name	Required	Description
`checks`	Yes	Individual safety checks. Conflicts reject before payment and therefore never appear as a paid result.
`target`	Yes	Normalized target endpoint and contemplated method.
`evidence`	Yes	Evidence provenance, including whether the 402 challenge was independently observed by ExitProof.
`nextStep`	Yes	Machine-readable status and bounded instruction for the calling agent.
`checkedAt`	Yes	Time the check result was produced.
`advertised`	No	Normalized caller-supplied advertised terms used for consistency checks.
`assessment`	Yes	Bounded pre-payment status. This is not a recommendation to buy.
`checkDigest`	Yes	SHA-256 digest of the normalized target, payment facts, recovery facts, and evidence provenance.
`limitations`	Yes	Boundaries on what the paid result establishes.
`reversibility`	Yes	Published retry, settled-delivery recovery, and reversal metadata supplied for this target.
`schemaVersion`	Yes	Agent purchase check schema version.
`observedPayment`	Yes	Selected machine-payment offer normalized from the observed 402 challenge.
`receiptEnvelope`	Yes	Additive Davisville Receipt Envelope v1. The native ExitProof purchase-check result remains authoritative.
`availablePaymentOffers`	Yes	All parseable x402 or MPP offers found in the observed response.

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedSep 27, 2026

addedOutput schema / properties / receiptEnvelope

Added value: +{
+  "$ref": "https://davisvillelabs.com/agents/davisville-receipt-envelope.v1.schema.json",
+  "description": "Additive Davisville Receipt Envelope v1. The native ExitProof purchase-check result remains authoritative."
+}

changedOutput schema / required

Previous value: -[
-  "schemaVersion",
-  "checkedAt",
-  "assessment",
-  "target",
-  "observedPayment",
-  "availablePaymentOffers",
-  "checks",
-  "reversibility",
-  "evidence",
-  "limitations",
-  "nextStep",
-  "checkDigest"
-]New value: +[
+  "schemaVersion",
+  "checkedAt",
+  "assessment",
+  "target",
+  "observedPayment",
+  "availablePaymentOffers",
+  "checks",
+  "reversibility",
+  "evidence",
+  "limitations",
+  "nextStep",
+  "checkDigest",
+  "receiptEnvelope"
+]

AddedSep 25, 2026

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint=false, destructiveHint=false), the description discloses critical behaviors: it never forwards payment credentials, never sends live POST/PUT/PATCH/DELETE probes, and only probes GET/HEAD. It also states that conflicting/malformed/inaccessible/non-402/unsafe targets are rejected before issuing its own payment challenge, and includes the $0.01 cost and disclaimers about non-guarantees. This is thorough and non-contradictory.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Though longer than average, every sentence is information-dense and earns its place: purpose, cost, exclusions, alternatives, and caveats are logically sequenced with the core purpose front-loaded. There is zero fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description, combined with the rich input schema (7 properties, nested objects) and the presence of an output schema, covers everything an agent needs to decide and invoke correctly: purpose, cost, exclusions, alternative tools, safety limits, and required inputs. The output schema handles return values, so the description need not describe them.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% – every property (including nested objects) has a detailed description. The tool description adds minimal extra parameter meaning beyond reiterating what the schema already says (e.g., 'compares advertised price/protocol/network/asset/payment destination' mirrors the advertised object's fields). Since the schema carries the weight, baseline 3 applies; the description does not degrade it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb+resource: 'Inspect one autonomous HTTP purchase before the calling agent pays it.' It enumerates exact checks (validates 402, compares advertised facts, checks x402 binding, surfaces retry signals) and explicitly differentiates from sibling tools by naming them. This is a model of purpose clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use this tool vs. alternatives: 'Use check_reversibility instead for cancellation/refund terms... create_exit_manifest to preserve an eligible exit path, and build_exit_pack when an exit is actually needed.' It also gives concrete usage conditions for state-changing methods (supply observed_response) and clarifies the cost ('$0.01 operation').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ExitProof tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?