git clone <this-repo>
cd kushbitx-mcp-agent
npm install

node agent.mjs

// e.g. Claude Desktop / Cursor / any MCP-compatible client
{
  "mcpServers": {
    "kushbitx": {
      "command": "node",
      "args": ["/absolute/path/to/kushbitx-mcp-agent/src/server.mjs"]
    }
  }
}

====================================================================
MCP handshake — tools exposed by the server
====================================================================
- kushbitx_preview_token
    Free. Inspect basic Base token market data for an address.
- kushbitx_evaluate_spend
    Free preview. Evaluate a proposed USDC spend against a policy BEFORE any money moves.
- kushbitx_get_payment_challenge
    Discover the x402 payment requirements for a paid KushBitx service.

====================================================================
Step 2 — SpendGuard evaluation (0.25 USDC)
====================================================================
{
  "version": "spendguard-preview-1",
  "agentId": "kushbitx-demo-agent",
  "amount": "0.25",
  "decision": "HUMAN_APPROVAL",
  "findings": [
    { "code": "RISK_REVIEW", "message": "Risk evidence is not a trusted ALLOW signal." }
  ],
  "advisory": true,
  "executionAuthorized": false,
  "note": "This stateless preview does not hold keys, execute a payment or prove that
           caller-supplied policy and risk inputs are trusted. Enforce the decision in a
           separate signer or approval service."
}

====================================================================
Step 3 — x402 payment challenge discovery (no signing, no payment)
====================================================================
{
  "service": "token-risk",
  "path": "/api/token-risk",
  "challenge": {
    "x402Version": 2,
    "error": "Payment required",
    "accepts": [
      {
        "scheme": "exact",
        "network": "eip155:8453",
        "amount": "250000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "payTo": "0x0d68028d06af13379C872FEE032568B4Be712f22",
        "maxTimeoutSeconds": 300,
        "extra": { "name": "USD Coin", "version": "2" }
      }
    ]
  }
}

====================================================================
Summary
====================================================================
1. token preview      : PASS
2. SpendGuard evaluate: PASS
3. x402 challenge     : PASS

No private key was requested, read, or stored. No payment was signed.
SpendGuard output is advisory; enforcement belongs to the signing layer.