assay
Server Details
A2A & MCP Pre-Flight Security: SHA-256 tool schema rug-pull detection and liveness grades.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP · MCP 2024-11-05
- URL
TDQS
Scored across 4 tools
Each tool has a distinct role (historical ledger query, pre-flight gating, telemetry probe, post-payment verification), and descriptions explicitly cross-reference each other to guide selection. The only mild overlap is between assay_preflight and assay_probe, both of which perform live endpoint probes, but the gating-vs-telemetry distinction is clearly stated.
All four tools use a consistent assay_ prefix with snake_case and largely verb_noun structure (get_ledger_policy, preflight, probe, verify_delivery). The pattern is predictable and readable throughout.
Four well-scoped tools map cleanly to the lifecycle of auditing, gating, indexing, and verifying MCP/A2A/x402 endpoints. Each tool earns its place with no redundancy or bloat.
The surface covers the core audit lifecycle: pre-flight gating, telemetry probing, ledger policy retrieval, and post-payment verification. Minor gaps exist around writing or updating ledger policies and managing target registrations, but these may be intentionally outside the read-only auditing scope.
Available Tools
4 toolsassay_get_ledger_policyQuery Historical Ledger & Manage Expected Schema HashesAIdempotentInspect
Query historical conformance observations, rug-pull drift events, and canonical SHA-256 tools/list policy hashes (expected_tools_hash) for a target MCP or A2A endpoint. Returns {verdict, reason, receipt, pinned_tools_hash, observations, dossier}. Use to audit historical ledger data or pin expected_tools_hash in mcp-lock.json; for pre-flight allow/deny gating use assay_preflight.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | Public HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked. | |
| expected_tools_hash | No | Optional 64-char SHA-256 hex digest of the canonical MCP tools/list schema from mcp-lock.json. If set and the live hash differs, verdict is 'deny'. |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | No | |
| dossier | No | |
| receipt | Yes | |
| verdict | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose readOnlyHint=false, idempotentHint=true, destructiveHint=false, openWorldHint=true. The description adds important behavioral context by explaining that setting expected_tools_hash and a mismatch results in verdict 'deny', which is essential for understanding the tool's write-like effect despite no state mutation. However, it doesn't elaborate on how the pinning operation works or what the receipt contains, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single dense sentence covering purpose, return shape, and alternatives. No wasted words; key routing information is front-loaded and clearly structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with an output schema and full annotation coverage, the description provides complete guidance: what it does, when to use it, what it returns, and which sibling to use for a related but distinct purpose. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters thoroughly, including formats and constraints. The description mentions expected_tools_hash but adds no meaning beyond what the schema provides. Baseline 3 is appropriate when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Query historical conformance observations, rug-pull drift events, and canonical SHA-256 tools/list policy hashes'), and explicitly differentiates itself from the sibling assay_preflight by naming what assay_preflight is for (pre-flight allow/deny gating). An agent can clearly distinguish this from the sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states two use cases ('audit historical ledger data or pin expected_tools_hash in mcp-lock.json') and names the alternative tool for the excluded case ('for pre-flight allow/deny gating use assay_preflight'). Clear routing guidance, though it doesn't cover all sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
assay_preflightPre-Flight MCP & A2A Security GateAIdempotentInspect
Evaluate a remote MCP, A2A, or x402 endpoint before calling or paying it. Probes live JSON-RPC reachability, hashes tools/list (SHA-256), checks expected_tools_hash for silent rug-pull drift, and scans for prompt-injection poisoning. Returns {verdict ('allow'|'warn'|'deny'), reason, receipt ('asr_rcpt_...'), dossier}. Use before tool execution or payment; for post-payment disputes use assay_verify_delivery; for raw telemetry indexing use assay_probe. First 5 calls/IP free.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | Public HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked. | |
| expected_tools_hash | No | Optional 64-char SHA-256 hex digest of the canonical MCP tools/list schema from mcp-lock.json. If set and the live hash differs, verdict is 'deny'. |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | No | |
| dossier | No | |
| receipt | Yes | |
| verdict | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations: it discloses the exact probing behavior (live JSON-RPC reachability), the drift comparison against expected_tools_hash that forces a 'deny' verdict, the outcome vocabulary (allow/warn/deny), and a rate-limit/quotient ('First 5 calls/IP free'). Annotations cover safety/idempotency, and the description adds the operational mechanics without contradicting readOnlyHint=false or destructiveHint=false.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core purpose in the first sentence, then packs checks, return shape, routing, and quota into a dense paragraph. Every clause is informative, though the run-on structure across three sentences makes it slightly cramped rather than perfectly scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists so return-value documentation is optional, yet the description still previews the verdict payload. Combined with clear usage routing, behavioral mechanics, and the free-tier limit, an agent has everything needed to select and invoke the tool correctly without opening the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3; the description earns above baseline by supplying the rationale for expected_tools_hash ('silent rug-pull drift') that the schema only describes mechanically, plus the endpoint scope (MCP/A2A/x402) for target. It does not, however, add format or syntax detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (evaluate/inspect) and resource (remote MCP, A2A, or x402 endpoint) and enumerates the concrete checks performed: JSON-RPC reachability, SHA-256 tools/list hashing, drift detection, injection scanning. It also distinguishes itself from siblings by naming assay_verify_delivery and assay_probe as alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use it ('before tool execution or payment') and routes to the alternatives with their own trigger conditions ('post-payment disputes use assay_verify_delivery; for raw telemetry indexing use assay_probe'). Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
assay_probeRecord Live Endpoint Conformance ObservationAIdempotentInspect
Execute a live HTTP, A2A agent-card, and MCP tools/list probe against a target URL and record the observation in the Assay Observatory ledger without pre-flight policy gating. Returns the updated dossier {target, grade ('A+' to 'F'), score (0-100), mcp_tools, tools_hash, rug_pulls, poison_flags, latency_ms, receipt}. Use to index a server or refresh leaderboard telemetry; for allow/deny gating use assay_preflight. First 5 calls/IP free.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | Public HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked. |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | No | |
| dossier | No | |
| receipt | Yes | |
| verdict | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnlyHint=false, openWorldHint=true, idempotentHint=true), and the description adds value beyond them: the probe is not policy-gated, it writes an observation to a ledger, it has a per-IP free-call quota ('First 5 calls/IP free'), and it returns latency/receipt metadata. It does not fully describe retry or quota-exceeded behavior, so it falls short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences, front-loaded with the action and record target, followed by routing guidance. The inline enumeration of return fields is partly redundant with the output schema, which costs a little tightness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description need not explain return values, and the scope, gating exclusion, and rate limit are covered. The meaning of 'without pre-flight policy gating' is left slightly implicit for an agent deciding between this and assay_preflight, but overall it is adequate for a one-parameter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single 'target' parameter, including format, length bounds, and the private/loopback block, so the schema does the heavy lifting. The description adds no syntax or format detail beyond the schema; baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: executes an HTTP/A2A/MCP probe against a target URL and records it in the Assay Observatory ledger. It also explicitly distinguishes itself from the sibling gating tool ('for allow/deny gating use assay_preflight'), so an agent can route correctly without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('index a server or refresh leaderboard telemetry') and an explicit exclusion with a named alternative ('for allow/deny gating use assay_preflight'). The pre-flight-free behavior is also stated, clarifying it is not the policy-check path.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
assay_verify_deliveryVerify Post-Payment x402 Delivery & Mint SLA ReceiptAIdempotentInspect
Independently probe a paid x402/A2A provider after payment to verify delivery or confirm an SLA breach. Combines reported status_code with a live probe and binds tx_hash into an HMAC-SHA256 receipt. Returns {verdict ('delivery_verified'|'sla_breach_confirmed'), sla_breach, grade, score, sla_receipt ('asr_sla_...')}. Use only after paying a provider; before payment use assay_preflight. First 5 calls/IP free.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | Public HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked. | |
| tx_hash | No | On-chain payment transaction hash (0x Base USDC hash or base58 Solana signature) to bind into the signed SLA receipt. | |
| status_code | No | HTTP status code returned by the paid endpoint (e.g. '200', '502', '504'). Codes >= 500 trigger verdict='sla_breach_confirmed'. |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | No | |
| dossier | No | |
| receipt | Yes | |
| verdict | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare the safety profile (non-read-only, non-destructive, idempotent, open-world). The description adds real behavioral context beyond that: it performs a live probe combined with reported status_code and mints an HMAC-SHA256 receipt bound to tx_hash, i.e. it produces a persistent signed artifact and enforces a per-IP rate limit. Not stated: what happens if tx_hash is omitted or how errors/failed probes surface.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences, front-loaded with the action and followed by sequencing and return shape; little waste. Slight redundancy between the title and the opening clause about minting an SLA receipt.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 3 params at full schema coverage, an output schema, and clear annotations, the description covers purpose, timing, rate limit, and verdict semantics. It repeats the return shape already covered by the output schema, but nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the 3 baseline applies, but the description adds the causal rule that status_code >= 500 drives verdict='sla_breach_confirmed' and that tx_hash is bound into the receipt, clarifying how the parameters interact rather than restating them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource+scope: 'Independently probe a paid x402/A2A provider after payment to verify delivery or confirm an SLA breach.' It names the sibling it replaces in the pre-payment phase (assay_preflight), so an agent can distinguish it from assay_probe and assay_get_ledger_policy without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit sequencing rule: 'Use only after paying a provider; before payment use assay_preflight.' This gives both the when-to-use condition and the named alternative for the opposite condition, plus a free-tier constraint ('First 5 calls/IP free') that affects invocation strategy.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
- Added
assay_get_ledger_policy - Changed
assay_preflight1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "properties": { + "dossier": { + "type": "object" + }, + "reason": { + "type": "string" + }, + "receipt": { + "type": "string" + }, + "verdict": { + "type": "string" + } + }, + "required": [ + "verdict", + "receipt" + ], + "type": "object" +}
- Changed
assay_probe1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "properties": { + "dossier": { + "type": "object" + }, + "reason": { + "type": "string" + }, + "receipt": { + "type": "string" + }, + "verdict": { + "type": "string" + } + }, + "required": [ + "verdict", + "receipt" + ], + "type": "object" +}
- Changed
assay_verify_delivery1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "properties": { + "dossier": { + "type": "object" + }, + "reason": { + "type": "string" + }, + "receipt": { + "type": "string" + }, + "verdict": { + "type": "string" + } + }, + "required": [ + "verdict", + "receipt" + ], + "type": "object" +}
3 tool updates
- Changed
assay_preflight6 fields changed- changed
Input schema / properties / expected_tools_hash / descriptionPrevious value: -"expected_tools_hash for assay_preflight"New value: +"Optional 64-char SHA-256 hex digest of the canonical MCP tools/list schema from mcp-lock.json. If set and the live hash differs, verdict is 'deny'." - added
Input schema / properties / expected_tools_hash / maxLengthAdded value: +128 - added
Input schema / properties / expected_tools_hash / minLengthAdded value: +0 - changed
Input schema / properties / target / descriptionPrevious value: -"target for assay_preflight"New value: +"Public HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked." - added
Input schema / properties / target / maxLengthAdded value: +512 - added
Input schema / properties / target / minLengthAdded value: +8
- Changed
assay_probe3 fields changed- changed
Input schema / properties / target / descriptionPrevious value: -"target for assay_probe"New value: +"Public HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked." - added
Input schema / properties / target / maxLengthAdded value: +512 - added
Input schema / properties / target / minLengthAdded value: +8
- Changed
assay_verify_delivery9 fields changed- changed
Input schema / properties / status_code / descriptionPrevious value: -"status_code for assay_verify_delivery"New value: +"HTTP status code returned by the paid endpoint (e.g. '200', '502', '504'). Codes >= 500 trigger verdict='sla_breach_confirmed'." - added
Input schema / properties / status_code / maxLengthAdded value: +8 - added
Input schema / properties / status_code / minLengthAdded value: +0 - changed
Input schema / properties / target / descriptionPrevious value: -"target for assay_verify_delivery"New value: +"Public HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked." - added
Input schema / properties / target / maxLengthAdded value: +512 - added
Input schema / properties / target / minLengthAdded value: +8 - changed
Input schema / properties / tx_hash / descriptionPrevious value: -"tx_hash for assay_verify_delivery"New value: +"On-chain payment transaction hash (0x Base USDC hash or base58 Solana signature) to bind into the signed SLA receipt." - added
Input schema / properties / tx_hash / maxLengthAdded value: +128 - added
Input schema / properties / tx_hash / minLengthAdded value: +0
3 tool updates
- First observed
assay_preflight - First observed
assay_probe - First observed
assay_verify_delivery
Related MCP Connectors
Crypto market intelligence, token rug-checks, and wallet verification in one MCP server.
Signed, offline-verifiable safety scores for the MCP servers, packages & tools an agent connects to
Memecoin Intelligence MCP — 9 tools: rug check, momentum, whale watch, 80+ chains.
Pre-flight MCP security. Blocks compromised deps + tool drift. HMAC-signed. Dredd judges.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceMCP server for real-time Solana token risk analysis. Cross-references RugCheck.xyz, DexScreener, and GoPlus Security to generate three-layer reports: machine verdict → LLM analysis → raw on-chain evidence. Live on Solana mainnet with USDC micropayments ($0.02/audit). Give any AI agent the ability to check if a token is safe before trading.2MIT
- AlicenseNot gradedqualityDmaintenanceOn-chain Solana token safety MCP — screens SPL / Token-2022 tokens for rug-pull and honeypot patterns (mint/freeze authority, liquidity, holders, sellability), then executes MEV-protected swaps.1MIT
- AlicenseNot gradedqualityCmaintenanceMCP server for a pre-interaction risk check on any EVM contract/token, enabling agents to verify contracts before approving, swapping, or trusting an address.MIT
- AlicenseAqualityDmaintenanceTrust intelligence MCP server for AI agents. 19 tools for identity stamps, reputation scoring (0-100), agent registry, forensic audit trails, ERC-8004 bridge, and A2A passports via x402 USDC micropayments.192Apache 2.0
Glama MCP Gateway
Add one secure layer between your agents and this server.