P

PreFlight Checker · MCP Audit

by PreFlight Checker

GETBase

$0.06

per call · USD Coin on Base

MCP server safety audit: completes a real initialize+tools/list handshake, then statically scans every tool's name/description/schema for hidden unicode (tool-poisoning), prompt-injection-style phrasing, and tools that quietly combine multiple high-privilege capabilities (network+filesystem+exec+credential access). If a GitHub repo is supplied, folds in a real software-supply-chain signal too.

Endpoint

GET https://x402-api-catalog.onrender.com/api/mcp-audit

2

Calls / 30d

1

Unique payers / 30d

Sep 7

Last called

exact

Payment scheme

Call this service

TypeScript · @x402/fetch
import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.PRIVATE_KEY);
const fetchWithPay = wrapFetchWithPayment(fetch, account);

const res = await fetchWithPay("https://x402-api-catalog.onrender.com/api/mcp-audit", {
  method: "GET",
});
const data = await res.json();
cURL
curl -X GET \
  "https://x402-api-catalog.onrender.com/api/mcp-audit?repo=example-org%2Fexample-mcp-server&url=https%3A%2F%2Fmcp.example.com%2Fmcp" \
  -H "X-PAYMENT: <signed x402 payment>"

Example response

{
  "findings": [],
  "score": 90,
  "tools_found": 3,
  "url": "https://mcp.example.com/mcp",
  "verdict": "healthy: no red flags found"
}

Payment details

Pay to0x9041f8a43d0b43209b9227de2c7fb25c9fe3847e
AssetUSD Coin · 0x833589fcd6edb6e08f4c7c32d4f71b54bda02913
NetworksBase
Schemesexact

Is this your API?

Pin it to the top of Developer Tools and the homepage with a featured placement.

Get featured →

More from PreFlight Checker & similar services

P

PreFlight Checker · Trust Check

x402-api-catalog.onrender.com

npm package trust check / risk score / security audit: registry age, weekly downloads, GitHub org/stars, OSV.dev vulnerabilities, typosquat detection.

GETBaseDeveloper Tools
$0.02 / call4 calls / 30d
P

PreFlight Checker · Contract Check

x402-api-catalog.onrender.com

EVM token contract safety check: honeypot detection, mint/blacklist/pausable/self-destruct capability, ownership renouncement, transfer tax, and a real token-impersonation check (does the symbol claim to be USDC/WETH/DAI/cbBTC at the wrong address — the token equivalent of npm typosquatting).

GETBaseOnchain Data
$0.05 / call2 calls / 30d
P

PreFlight Checker · Domain Check

x402-api-catalog.onrender.com

Domain liveness check / verify / audit: DNS resolution (A/MX/NS/TXT records), whether mail routing exists, HTTP reachability.

GETBaseAI & Inference
$0.02 / call2 calls / 30d