# mcp-checkout-guard

Pre-purchase check for shops, payment links and paid APIs — a single-purpose [MCP](https://modelcontextprotocol.io) server for AI agents. No install, no account: it runs as a remote server; this repo also has a zero-dependency stdio bridge.

```
https://angel.oroboros-design.com/mcp/checkout-guard
```

## Use it

**Claude Code**

```bash
claude mcp add --transport http checkout-guard https://angel.oroboros-design.com/mcp/checkout-guard
```

**Claude Desktop, Cursor, Windsurf, VS Code** (remote server)

```json
{ "mcpServers": { "checkout-guard": { "url": "https://angel.oroboros-design.com/mcp/checkout-guard" } } }
```

**Any stdio client** (Node 18+)

```json
{ "mcpServers": { "checkout-guard": { "command": "npx", "args": ["-y", "github:daoudandiaye98-alt/mcp-checkout-guard"] } } }
```

Then ask your agent, for example: *Before paying at https://shop.example.com/checkout, run preflight and stop unless the verdict is pay.*

## Tools

| Tool | Price | What it does |
|---|---|---|
| `preflight` | 3 free calls per agent, then 0.25 USDC | One request to the url: TLS, domain age, look-alike domains, redirects to foreign gateways, payment provider, card fields in the page, http forms, text aimed at agents and, for x402, USDC contract, payTo, EIP-712 domain and price traps. Verdict `pay`, `caution` or `do_not_pay` with every reason. |
| `buy_pack_with_card` | — | Prepaid calls by card (Stripe) when the free calls are used up. |

## Paying

The first 3 paid calls per agent are free (identify your agent with the header `X-API-Key`, or set `ANGEL_API_KEY` for the stdio bridge). After that each call is paid per request in USDC on Base via [x402](https://x402.org) (`params._meta["x402/payment"]`), with a prepaid pack (`bundle_token`) or by card (`buy_pack_with_card`). The 402 answer names the exact amount and the pay-to address before anything is signed.

**Disclosure:** on verdict `pay` for a shop with an affiliate programme (for example Amazon), the answer can include a `partner_link` to the same merchant; Angel may earn a commission if you buy through it, the merchant sets the price, and the checked url is just as safe. Pass `partner_link: false` to leave it out.

## More

- Same checks as a library: `npm i angel-agent-guard` · `pip install angel-agent-guard` ([angel-agent-guard](https://github.com/daoudandiaye98-alt/angel-agent-guard))
- All of Angel's tools in one server: `https://angel.oroboros-design.com/agenten/signal/mcp` · A2A agent card: `https://angel.oroboros-design.com/.well-known/agent.json`
- MCP Registry: `com.oroboros-design.angel/checkout-guard`

Operated by Oroboros Design (Köln, Germany). MIT licence for the code in this repo.