NitroWatch Billing Demo

An intentionally ungoverned MCP server. This is the thing that needs governing.

This is the companion demo target for NitroWatch — a governance layer for MCP.

This server has no safety of its own. Every tool below does exactly what it is told, immediately, for anyone who asks. delete_account will permanently destroy an account and all of its invoices without a single confirmation.

That is the point. It is indistinguishable from thousands of real MCP servers — and that is exactly why NitroWatch exists.

The tools

Five tools, chosen so one lands on each of NitroWatch's risk tiers:

Why archive_customer is the interesting one

Nothing in its name or description reveals that archived accounts here are purged after 30 days and cannot be restored. It reads as recoverable. No classifier — heuristic or LLM — could know otherwise.

That is precisely the case NitroWatch's set_tier exists for: a human who knows the domain corrects the classification, and the override is recorded in the audit trail.

Related MCP server: mcp-trust-demo

Running it

npm install
npm run build
npx nitrostack-cli start --port 3100

⚠️ Use the --port flag. The PORT environment variable is silently ignored — the server binds 3000 regardless, which collides with NitroWatch. This is tested behaviour, not a guess.

When it's up you'll see:

Legacy SDK SSE   http://localhost:3100/sse
Streamable HTTP  http://localhost:3100/mcp

Putting it under governance

From NitroWatch:

register_server({ name: "Billing API", endpoint: "http://localhost:3100/sse" })
discover_capabilities({ serverId: "billing-api" })
classify_tools({ serverId: "billing-api" })

Then try to delete something, and watch it get stopped:

request_action({
  serverId: "billing-api",
  toolName: "delete_account",
  args: { accountId: "acc_991", purgeInvoices: true }
})
// → { decision: "blocked", tier: "irreversible", ... }

Note on deployment: if you run NitroWatch from NitroCloud rather than locally, it cannot reach localhost on your machine — the cloud instance resolves its own localhost. Either run both locally, or deploy this server too and register its public URL.

Seed data

Two accounts and three invoices, held in memory. A restart resets everything — convenient when you have just deleted an account to prove a point.

Built with

NitroStack TypeScript SDK — NitroStack × SRM Hackathon 2026.