Checkout Guard — pre-purchase check for shops, payment links and paid APIs

Pre-purchase check for any shop, checkout link, payment page, API or x402 endpoint

preflight

Read-only

Before an agent buys, pays or calls an unknown endpoint: one unpaid request to any https shop, checkout or payment link (Stripe, Shopify, PayPal and others), API or x402 endpoint. Checks TLS, domain age, look-alike domains, redirects to foreign gateways, the payment provider, card fields in the page, http forms, text aimed at agents in the page and, for x402, USDC contract, payTo, EIP-712 domain and price traps. Verdict pay, caution or do_not_pay, risk_score, merchant_signals. 0.25 USDC base (new payers 0.25, >10 payments 0.175; 5 pack calls). After: input-guard on the page text you will act on, gas-window before you settle on Base (the result's next field has the exact call).

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "url": "<url>"
    },
    "name": "preflight"
  }
}

Input Schema

Name	Required	Description
`url`	Yes	the shop, checkout or payment link, API or x402 endpoint to check (public https domain, port 443)
`method`	No
`payment_tx`	No	Hash of a USDC transfer on Base to payTo (≥ the price, ≤ 72 h old) instead of an x402 signature.
`bundle_token`	No	Token from buy_signal_pack, buy_subscription (pro/desk) or buy_enterprise instead of paying per call.
`partner_link`	No	default true: on verdict pay for a shop with an affiliate program, the answer adds partner_link (same merchant, disclosed: Angel may earn a commission, merchant sets the price); false omits it
`max_price_usd`	No
`payer_address`	No	Wallet you pay from: the payment-required error quotes your tier (0 payments base price (new-payer surcharge paused), 1-10 base, >10 -30 %) and, from the third payment, an upgrade with your own spend.

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 14, 2026

TDQS

A4.3/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint and openWorldHint; the description adds substantial behavior beyond them — the call is unpaid (it does not itself transact), it costs 0.25 USDC base with tiered pricing and a 5-call pack option, and it discloses that the partner_link field may carry an affiliate commission. It also explains the payment-required error behavior in the payer_address parameter, which is exactly the kind of operational context annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then checks, then outputs, then cost, then follow-up chaining — a logical order with no filler sentences. The pricing clause is compressed to the edge of readability ('0.25 USDC base (new payers 0.25, >10 payments 0.175; 5 pack calls)'), which slightly hurts scannability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With seven parameters, no output schema, and a paid open-world call, the description carries the right load: it names the return fields, the verdict vocabulary, the cost model, and the recommended next tools. Gaps are modest — it does not explain how to interpret or act on risk_score/merchant_signals, nor expected latency for the live request.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 71%, so most parameters are already documented, and the description mainly reinforces pricing/tier context that bears on payer_address and max_price_usd. Two parameters (method, max_price_usd) have no schema description and get no explanation in the description either, and payment_tx/bundle_token are only gestured at via the pricing sentence.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific mechanism (one unpaid HTTPS request to a shop, checkout link, API or x402 endpoint) and enumerates what it inspects: TLS, domain age, look-alike domains, redirects, payment provider, card fields, http forms, agent-targeted text, and x402 USDC/payTo/EIP-712 details. It also names the concrete outputs (pay/caution/do_not_pay, risk_score, merchant_signals), so an agent can distinguish it from siblings like input_guard or token_risk without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The trigger is explicit: 'Before an agent buys, pays or calls an unknown endpoint.' It also routes the agent forward with 'After: input-guard on the page text you will act on, gas-window before you settle on Base,' naming two siblings and the sequencing. It stops short of stating exclusions (e.g. when a merchant is already trusted, or that the target must be a public https host on port 443, which only appears in the schema).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Checkout Guard — pre-purchase check for shops, payment links and paid APIs tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.