Skip to main content
Glama

Server Details

A2A & MCP Pre-Flight Security: SHA-256 tool schema rug-pull detection and liveness grades.

Ownership verified
Status
Healthy
Last Tested
Transport
Streamable HTTP · MCP 2024-11-05
URL

TDQS

A4.4/5.0

Scored across 4 tools

Disambiguation4/5

Each tool has a distinct role (historical ledger query, pre-flight gating, telemetry probe, post-payment verification), and descriptions explicitly cross-reference each other to guide selection. The only mild overlap is between assay_preflight and assay_probe, both of which perform live endpoint probes, but the gating-vs-telemetry distinction is clearly stated.

Naming Consistency5/5

All four tools use a consistent assay_ prefix with snake_case and largely verb_noun structure (get_ledger_policy, preflight, probe, verify_delivery). The pattern is predictable and readable throughout.

Tool Count5/5

Four well-scoped tools map cleanly to the lifecycle of auditing, gating, indexing, and verifying MCP/A2A/x402 endpoints. Each tool earns its place with no redundancy or bloat.

Completeness4/5

The surface covers the core audit lifecycle: pre-flight gating, telemetry probing, ledger policy retrieval, and post-payment verification. Minor gaps exist around writing or updating ledger policies and managing target registrations, but these may be intentionally outside the read-only auditing scope.

Available Tools

4 tools
assay_get_ledger_policyQuery Historical Ledger & Manage Expected Schema HashesA
Idempotent
Inspect

Query historical conformance observations, rug-pull drift events, and canonical SHA-256 tools/list policy hashes (expected_tools_hash) for a target MCP or A2A endpoint. Returns {verdict, reason, receipt, pinned_tools_hash, observations, dossier}. Use to audit historical ledger data or pin expected_tools_hash in mcp-lock.json; for pre-flight allow/deny gating use assay_preflight.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYesPublic HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked.
expected_tools_hashNoOptional 64-char SHA-256 hex digest of the canonical MCP tools/list schema from mcp-lock.json. If set and the live hash differs, verdict is 'deny'.

Output Schema

ParametersJSON Schema
NameRequiredDescription
reasonNo
dossierNo
receiptYes
verdictYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already disclose readOnlyHint=false, idempotentHint=true, destructiveHint=false, openWorldHint=true. The description adds important behavioral context by explaining that setting expected_tools_hash and a mismatch results in verdict 'deny', which is essential for understanding the tool's write-like effect despite no state mutation. However, it doesn't elaborate on how the pinning operation works or what the receipt contains, leaving some gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single dense sentence covering purpose, return shape, and alternatives. No wasted words; key routing information is front-loaded and clearly structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with an output schema and full annotation coverage, the description provides complete guidance: what it does, when to use it, what it returns, and which sibling to use for a related but distinct purpose. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters thoroughly, including formats and constraints. The description mentions expected_tools_hash but adds no meaning beyond what the schema provides. Baseline 3 is appropriate when schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Query historical conformance observations, rug-pull drift events, and canonical SHA-256 tools/list policy hashes'), and explicitly differentiates itself from the sibling assay_preflight by naming what assay_preflight is for (pre-flight allow/deny gating). An agent can clearly distinguish this from the sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states two use cases ('audit historical ledger data or pin expected_tools_hash in mcp-lock.json') and names the alternative tool for the excluded case ('for pre-flight allow/deny gating use assay_preflight'). Clear routing guidance, though it doesn't cover all sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

assay_preflightPre-Flight MCP & A2A Security GateA
Idempotent
Inspect

Evaluate a remote MCP, A2A, or x402 endpoint before calling or paying it. Probes live JSON-RPC reachability, hashes tools/list (SHA-256), checks expected_tools_hash for silent rug-pull drift, and scans for prompt-injection poisoning. Returns {verdict ('allow'|'warn'|'deny'), reason, receipt ('asr_rcpt_...'), dossier}. Use before tool execution or payment; for post-payment disputes use assay_verify_delivery; for raw telemetry indexing use assay_probe. First 5 calls/IP free.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYesPublic HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked.
expected_tools_hashNoOptional 64-char SHA-256 hex digest of the canonical MCP tools/list schema from mcp-lock.json. If set and the live hash differs, verdict is 'deny'.

Output Schema

ParametersJSON Schema
NameRequiredDescription
reasonNo
dossierNo
receiptYes
verdictYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: it discloses the exact probing behavior (live JSON-RPC reachability), the drift comparison against expected_tools_hash that forces a 'deny' verdict, the outcome vocabulary (allow/warn/deny), and a rate-limit/quotient ('First 5 calls/IP free'). Annotations cover safety/idempotency, and the description adds the operational mechanics without contradicting readOnlyHint=false or destructiveHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core purpose in the first sentence, then packs checks, return shape, routing, and quota into a dense paragraph. Every clause is informative, though the run-on structure across three sentences makes it slightly cramped rather than perfectly scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists so return-value documentation is optional, yet the description still previews the verdict payload. Combined with clear usage routing, behavioral mechanics, and the free-tier limit, an agent has everything needed to select and invoke the tool correctly without opening the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3; the description earns above baseline by supplying the rationale for expected_tools_hash ('silent rug-pull drift') that the schema only describes mechanically, plus the endpoint scope (MCP/A2A/x402) for target. It does not, however, add format or syntax detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb (evaluate/inspect) and resource (remote MCP, A2A, or x402 endpoint) and enumerates the concrete checks performed: JSON-RPC reachability, SHA-256 tools/list hashing, drift detection, injection scanning. It also distinguishes itself from siblings by naming assay_verify_delivery and assay_probe as alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use it ('before tool execution or payment') and routes to the alternatives with their own trigger conditions ('post-payment disputes use assay_verify_delivery; for raw telemetry indexing use assay_probe'). Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

assay_probeRecord Live Endpoint Conformance ObservationA
Idempotent
Inspect

Execute a live HTTP, A2A agent-card, and MCP tools/list probe against a target URL and record the observation in the Assay Observatory ledger without pre-flight policy gating. Returns the updated dossier {target, grade ('A+' to 'F'), score (0-100), mcp_tools, tools_hash, rug_pulls, poison_flags, latency_ms, receipt}. Use to index a server or refresh leaderboard telemetry; for allow/deny gating use assay_preflight. First 5 calls/IP free.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYesPublic HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked.

Output Schema

ParametersJSON Schema
NameRequiredDescription
reasonNo
dossierNo
receiptYes
verdictYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover the safety profile (readOnlyHint=false, openWorldHint=true, idempotentHint=true), and the description adds value beyond them: the probe is not policy-gated, it writes an observation to a ledger, it has a per-IP free-call quota ('First 5 calls/IP free'), and it returns latency/receipt metadata. It does not fully describe retry or quota-exceeded behavior, so it falls short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences, front-loaded with the action and record target, followed by routing guidance. The inline enumeration of return fields is partly redundant with the output schema, which costs a little tightness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description need not explain return values, and the scope, gating exclusion, and rate limit are covered. The meaning of 'without pre-flight policy gating' is left slightly implicit for an agent deciding between this and assay_preflight, but overall it is adequate for a one-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single 'target' parameter, including format, length bounds, and the private/loopback block, so the schema does the heavy lifting. The description adds no syntax or format detail beyond the schema; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: executes an HTTP/A2A/MCP probe against a target URL and records it in the Assay Observatory ledger. It also explicitly distinguishes itself from the sibling gating tool ('for allow/deny gating use assay_preflight'), so an agent can route correctly without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('index a server or refresh leaderboard telemetry') and an explicit exclusion with a named alternative ('for allow/deny gating use assay_preflight'). The pre-flight-free behavior is also stated, clarifying it is not the policy-check path.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

assay_verify_deliveryVerify Post-Payment x402 Delivery & Mint SLA ReceiptA
Idempotent
Inspect

Independently probe a paid x402/A2A provider after payment to verify delivery or confirm an SLA breach. Combines reported status_code with a live probe and binds tx_hash into an HMAC-SHA256 receipt. Returns {verdict ('delivery_verified'|'sla_breach_confirmed'), sla_breach, grade, score, sla_receipt ('asr_sla_...')}. Use only after paying a provider; before payment use assay_preflight. First 5 calls/IP free.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYesPublic HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked.
tx_hashNoOn-chain payment transaction hash (0x Base USDC hash or base58 Solana signature) to bind into the signed SLA receipt.
status_codeNoHTTP status code returned by the paid endpoint (e.g. '200', '502', '504'). Codes >= 500 trigger verdict='sla_breach_confirmed'.

Output Schema

ParametersJSON Schema
NameRequiredDescription
reasonNo
dossierNo
receiptYes
verdictYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare the safety profile (non-read-only, non-destructive, idempotent, open-world). The description adds real behavioral context beyond that: it performs a live probe combined with reported status_code and mints an HMAC-SHA256 receipt bound to tx_hash, i.e. it produces a persistent signed artifact and enforces a per-IP rate limit. Not stated: what happens if tx_hash is omitted or how errors/failed probes surface.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, front-loaded with the action and followed by sequencing and return shape; little waste. Slight redundancy between the title and the opening clause about minting an SLA receipt.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 3 params at full schema coverage, an output schema, and clear annotations, the description covers purpose, timing, rate limit, and verdict semantics. It repeats the return shape already covered by the output schema, but nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the 3 baseline applies, but the description adds the causal rule that status_code >= 500 drives verdict='sla_breach_confirmed' and that tx_hash is bound into the receipt, clarifying how the parameters interact rather than restating them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource+scope: 'Independently probe a paid x402/A2A provider after payment to verify delivery or confirm an SLA breach.' It names the sibling it replaces in the pre-payment phase (assay_preflight), so an agent can distinguish it from assay_probe and assay_get_ledger_policy without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit sequencing rule: 'Use only after paying a provider; before payment use assay_preflight.' This gives both the when-to-use condition and the named alternative for the opposite condition, plus a free-tier constraint ('First 5 calls/IP free') that affects invocation strategy.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updates
    • Addedassay_get_ledger_policy
    • Changedassay_preflight1 field changed
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "properties": {
        +    "dossier": {
        +      "type": "object"
        +    },
        +    "reason": {
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "type": "string"
        +    },
        +    "verdict": {
        +      "type": "string"
        +    }
        +  },
        +  "required": [
        +    "verdict",
        +    "receipt"
        +  ],
        +  "type": "object"
        +}
    • Changedassay_probe1 field changed
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "properties": {
        +    "dossier": {
        +      "type": "object"
        +    },
        +    "reason": {
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "type": "string"
        +    },
        +    "verdict": {
        +      "type": "string"
        +    }
        +  },
        +  "required": [
        +    "verdict",
        +    "receipt"
        +  ],
        +  "type": "object"
        +}
    • Changedassay_verify_delivery1 field changed
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "properties": {
        +    "dossier": {
        +      "type": "object"
        +    },
        +    "reason": {
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "type": "string"
        +    },
        +    "verdict": {
        +      "type": "string"
        +    }
        +  },
        +  "required": [
        +    "verdict",
        +    "receipt"
        +  ],
        +  "type": "object"
        +}
  2. 3 tool updates
    • Changedassay_preflight6 fields changed
      • changedInput schema / properties / expected_tools_hash / description
        Previous value: -"expected_tools_hash for assay_preflight"New value: +"Optional 64-char SHA-256 hex digest of the canonical MCP tools/list schema from mcp-lock.json. If set and the live hash differs, verdict is 'deny'."
      • addedInput schema / properties / expected_tools_hash / maxLength
        Added value: +128
      • addedInput schema / properties / expected_tools_hash / minLength
        Added value: +0
      • changedInput schema / properties / target / description
        Previous value: -"target for assay_preflight"New value: +"Public HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked."
      • addedInput schema / properties / target / maxLength
        Added value: +512
      • addedInput schema / properties / target / minLength
        Added value: +8
    • Changedassay_probe3 fields changed
      • changedInput schema / properties / target / description
        Previous value: -"target for assay_probe"New value: +"Public HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked."
      • addedInput schema / properties / target / maxLength
        Added value: +512
      • addedInput schema / properties / target / minLength
        Added value: +8
    • Changedassay_verify_delivery9 fields changed
      • changedInput schema / properties / status_code / description
        Previous value: -"status_code for assay_verify_delivery"New value: +"HTTP status code returned by the paid endpoint (e.g. '200', '502', '504'). Codes >= 500 trigger verdict='sla_breach_confirmed'."
      • addedInput schema / properties / status_code / maxLength
        Added value: +8
      • addedInput schema / properties / status_code / minLength
        Added value: +0
      • changedInput schema / properties / target / description
        Previous value: -"target for assay_verify_delivery"New value: +"Public HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked."
      • addedInput schema / properties / target / maxLength
        Added value: +512
      • addedInput schema / properties / target / minLength
        Added value: +8
      • changedInput schema / properties / tx_hash / description
        Previous value: -"tx_hash for assay_verify_delivery"New value: +"On-chain payment transaction hash (0x Base USDC hash or base58 Solana signature) to bind into the signed SLA receipt."
      • addedInput schema / properties / tx_hash / maxLength
        Added value: +128
      • addedInput schema / properties / tx_hash / minLength
        Added value: +0
  3. 3 tool updates
    • First observedassay_preflight
    • First observedassay_probe
    • First observedassay_verify_delivery

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    F
    maintenance
    MCP server for real-time Solana token risk analysis. Cross-references RugCheck.xyz, DexScreener, and GoPlus Security to generate three-layer reports: machine verdict → LLM analysis → raw on-chain evidence. Live on Solana mainnet with USDC micropayments ($0.02/audit). Give any AI agent the ability to check if a token is safe before trading.
    2
    MIT
Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources