Vets npm packages before installation by checking CVEs, typo-squatting, deprecation/yank status, SPDX license, age, and download signals, providing a plain-English risk verdict.
Vets PyPI packages before installation by checking CVEs, typo-squatting, deprecation/yank status, SPDX license, age, and download signals, providing a plain-English risk verdict.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@FabTally Guard Vet the npm package axios before installing it"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
De-risk-a-dollar verification checks an AI agent runs before a costly action. Fronts the Guard HTTP API at https://guard.fabtally.com. Holds no private key.
Tool | Price | What it does |
| $0.003 | Vet a package before installing — OSV.dev CVEs, typosquat similarity, deprecation/yank, SPDX license, age/download signals + a plain-English risk verdict. Args: |
| $0.002 | Verify another x402 endpoint before paying it — valid x402 v2 402 challenge? price/asset/network/payTo consistent with its |
| $0.002 | Coerce near-miss LLM JSON to a JSON-Schema-conformant object (fences/commas/quotes/keys/literals/brackets, then type-coerce, defaults, drop extras) — or precise per-field errors. Args: |
| $0.004 | Fetch a public url → clean Markdown + token estimate for RAG. Respects robots.txt, public pages only, nothing stored. Args: |
Every tool also accepts an optional x_payment (base64 x402 payload) that is
forwarded as the X-PAYMENT header to settle the call and return the real result.
Humans can instead prepay by card and use an X-FabTally-Key credit key against
the HTTP API.
Related MCP server: guardrails-mcp-server
stdio (portable): npx fabtally-guard-mcp (bin: fabtally-guard-mcp)
streamable-http (hosted): https://guard.fabtally.com/mcp
Config: FABTALLY_GUARD_BASE (default https://guard.fabtally.com).
Read-only, keyless, stateless, descriptive. Operated by Sunstone Soft (fabtally.com). Not a security guarantee.
PAID $0.003 (x402, USDC on Base). Vet a software package BEFORE installing it. Returns existence, latest-vs-requested, deprecation/yank markers, known CVEs from OSV.dev, typosquat similarity to popular names, SPDX license, and age/download signals with a plain-English risk verdict. Args: ecosystem (npm|pypi|crates), name, version (optional). Without payment returns the x402 challenge; pass x_payment to settle.
Inputs: name (required), ecosystem (required), version, x_payment.
PAID $0.002 (x402, USDC on Base). Coerce near-miss LLM JSON to a JSON-Schema-conformant object: strip code fences/prose, fix trailing commas/quotes/unquoted keys, normalise Python literals, balance brackets, then coerce types, apply defaults, and drop extraneous keys. Returns the repaired object OR precise per-field errors. Args: json (the raw string), schema (a JSON Schema object). Without payment returns the x402 challenge.
Inputs: json (required), schema (required), x_payment.
PAID $0.004 (x402, USDC on Base). Fetch a PUBLIC url and return clean Markdown + a token estimate for RAG ingestion — readability extraction, boilerplate stripped. Respects robots.txt, public pages only, no login/paywall bypass, nothing stored. Args: url. Without payment returns the x402 challenge; pass x_payment to settle.
Inputs: url (required), x_payment.
PAID $0.002 (x402, USDC on Base). Verify another x402 endpoint BEFORE paying it: does an unpaid call return a valid x402 v2 402 challenge? do the quoted amount/asset/network/payTo match the site's /.well-known/x402? is TLS valid, host reachable, openapi present? Returns pass/fail + per-check reasons + the parsed price you would pay. Args: url. Without payment returns the x402 challenge; pass x_payment to settle.
Inputs: url (required), x_payment.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 4 tools
Each tool targets a completely different function: dependency vetting, x402 endpoint verification, JSON repair, and URL reading. There is no overlap or potential for confusion between them.
All tool names follow the same lower_snake_case pattern with an object followed by a verb: deps_check, x402_preflight, json_repair, url_read. The convention is uniform and predictable.
With four tools, the server is well-scoped for its purpose. Each tool provides a distinct utility without redundancy, making the set feel intentional and complete.
The tool surface covers a coherent set of guardrail functions: vetting packages, validating payment endpoints, repairing LLM JSON output, and sanitizing URLs for ingestion. There are no obvious missing operations for this domain.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Remote MCP server exposing 330 production AI-agent services for web/data processing, validation, AI utilities, blockchain/crypto utilities, and x402 pay-per-use access.
Guarded MCP server for agent-readable business truth, provenance, readiness, and discovery.
Check before your agent installs, connects or pays. install_check: before installing an npm or PyPI package, a GitHub repo, a skill, an editor extension or an MCP server, it answers allow / hold / block (known malicious packages from OSV, typosquats of official MCP servers, names that do not exist, install scripts, maintainer changes). check_repo_config: before opening a repository someone sent you, it reads its agent configuration (MCP servers, hooks, editor tasks, instruction files) and runs nothing. check_service and verify_tools: live status of any MCP server or x402 endpoint, real price and payTo vs the catalogue listing, OFAC and stablecoin-freeze screening, tool-set changes, an open Trust Score. find_service finds working services. preflight_payment decides allow / hold / block right before an x402 payment is signed; payment_status prevents paying twice; report_purchase records what a paid call delivered. Verdicts are signed into a public transparency log. Free, no account. Every other tool (evidence packs, agent identities, boards, mail) is at https://alalanet.com/mcp/full; install and MCP-server checks alone are at https://alalanet.com/mcp/guard. Claude Code plugin: alalanet-guard.
