Synthex Forge — x402 Paid Agent Services

Run Authorized Redteam Scan

run_authorized_redteam_scan

Destructive

Redteam Authorized Scan. use it rather than run_agent_security_scan for authorized redteam scan, not agent security scan; an object with 27 fields including algorithm, assessed_at. $0.25 USDC.

Input Schema

Name	Required	Description
`target_url`	No	The target url this operation operates on. See the schema for its type and whether it is required.
`authorized_tests`	No	The authorized tests this operation operates on. See the schema for its type and whether it is required.
`scope_description`	No	The scope description this operation operates on. See the schema for its type and whether it is required.
`authorization_evidence`	No	The authorization evidence this operation operates on. See the schema for its type and whether it is required.

Output Schema

Name	Required	Description
`kind`	No	The `kind` field of the response.
`note`	No	A note on how the answer was produced.
`type`	No	The `type` field of the response.
`detail`	Yes	Human-readable explanation of the verdict.
`sha256`	No	The `sha256` field of the response.
`verdict`	Yes	The decision this tool returned.
`signedBy`	No	The `signedBy` field of the response.
`algorithm`	No	The `algorithm` field of the response.
`ed25519Sig`	No	The `ed25519Sig` field of the response.
`target_url`	No	The `target_url` field of the response.
`assessed_at`	No	The `assessed_at` field of the response.
`evidenceCore`	No	The `evidenceCore` field of the response.
`gate_outcome`	No	The `gate_outcome` field of the response.
`observations`	No	The `observations` field of the response.
`publicKeyHex`	No	The `publicKeyHex` field of the response.
`planned_tests`	No	The `planned_tests` field of the response.
`attestation_id`	No	The `attestation_id` field of the response.
`evidenceDigest`	No	The `evidenceDigest` field of the response.
`canonicalSha256`	No	The `canonicalSha256` field of the response.
`reproducibility`	No	The `reproducibility` field of the response.
`compliance_grade`	No	The `compliance_grade` field of the response.
`hash_proof_count`	No	The `hash_proof_count` field of the response.
`verificationHint`	No	The `verificationHint` field of the response.
`scope_description`	No	The `scope_description` field of the response.
`permit_proof_count`	No	The `permit_proof_count` field of the response.
`authorization_evidence`	No	The `authorization_evidence` field of the response.
`authorized_tests_catalogue`	No	The `authorized_tests_catalogue` field of the response.

Schema Changelog

Changes observed during successful MCP inspections.

Changed29 schema fields changedOct 31, 2026

addedOutput schema / properties / algorithm

Added value: +{
+  "description": "The `algorithm` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / assessed_at

Added value: +{
+  "description": "The `assessed_at` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / attestation_id

Added value: +{
+  "description": "The `attestation_id` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / authorization_evidence

Added value: +{
+  "description": "The `authorization_evidence` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / authorized_tests_catalogue

Added value: +{
+  "description": "The `authorized_tests_catalogue` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / canonicalSha256

Added value: +{
+  "description": "The `canonicalSha256` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / compliance_grade

Added value: +{
+  "description": "The `compliance_grade` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / detail

Added value: +{
+  "description": "Human-readable explanation of the verdict.",
+  "type": "string"
+}

addedOutput schema / properties / ed25519Sig

Added value: +{
+  "description": "The `ed25519Sig` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / evidenceCore

Added value: +{
+  "description": "The `evidenceCore` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / evidenceDigest

Added value: +{
+  "description": "The `evidenceDigest` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / gate_outcome

Added value: +{
+  "description": "The `gate_outcome` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / hash_proof_count

Added value: +{
+  "description": "The `hash_proof_count` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / kind

Added value: +{
+  "description": "The `kind` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / note

Added value: +{
+  "description": "A note on how the answer was produced.",
+  "type": "string"
+}

addedOutput schema / properties / observations

Added value: +{
+  "description": "The `observations` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / permit_proof_count

Added value: +{
+  "description": "The `permit_proof_count` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / planned_tests

Added value: +{
+  "description": "The `planned_tests` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / publicKeyHex

Added value: +{
+  "description": "The `publicKeyHex` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / reproducibility

Added value: +{
+  "description": "The `reproducibility` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / scope_description

Added value: +{
+  "description": "The `scope_description` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / sha256

Added value: +{
+  "description": "The `sha256` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / signedBy

Added value: +{
+  "description": "The `signedBy` field of the response.",
+  "type": "object"
+}

removedOutput schema / properties / status

Removed value: -{
-  "type": "string"
-}

addedOutput schema / properties / target_url

Added value: +{
+  "description": "The `target_url` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / type

Added value: +{
+  "description": "The `type` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / verdict

Added value: +{
+  "description": "The decision this tool returned.",
+  "type": "string"
+}

addedOutput schema / properties / verificationHint

Added value: +{
+  "description": "The `verificationHint` field of the response.",
+  "type": "object"
+}

addedOutput schema / required

Added value: +[
+  "detail",
+  "verdict"
+]

AddedOct 31, 2026

TDQS

C2.6/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare destructiveHint=true, non-idempotent behavior and a closed world, but the description gives no warning that this is a destructive operation or that authorization evidence is a prerequisite. The only genuinely additive note is the $0.25 USDC cost, which is useful but does not cover the risk profile of a destructive scan.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The text is a semicolon-spliced fragment ('use it rather than ... not agent security scan; an object with 27 fields...') that mixes routing, output shape and price into one run-on. The purpose statement is not front-loaded cleanly, and the output-shape clause is wasted space given the tool already has an output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained — yet the description spends words on them anyway. What it omits is the important part: for a destructive, paid scan requiring authorization evidence, it never says what authorization must look like or what the scan may do to the target.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is nominally 100%, so the baseline of 3 applies. The description adds no meaning beyond that, and given that the schema text is generic boilerplate ('The target url this operation operates on'), the description misses the chance to explain what authorized_tests or authorization_evidence must contain.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource ('authorized redteam scan') and names the sibling it replaces, which lets an agent separate it from run_agent_security_scan. But the phrasing is circular and mostly restates the title, so an agent learns little about what the scan actually does or what it inspects.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It does give one explicit routing rule: use this rather than `run_agent_security_scan` for authorized redteam work. However, it never states when a scan qualifies as authorized, what preconditions apply, or when neither scan is appropriate, so the guidance is only partly actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Synthex Forge — x402 Paid Agent Services tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.