openfang-rail
REMOTE · HCRB.IN · SCANNED SEP 21
Deterministic banking, LEI, VAT, SWIFT & compliance checks via MCP with signed XDR-1 receipts.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security51
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 63 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS check failed: the endpoint is reachable over plaintext HTTP. See how to fix → View diagnostics → Fail
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability92
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 6473 tokens (~102/item across 63 items; 63 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Tools include usage examples.Pass
Stability & Change Management16
- Stability check failed: schema churn in the 9 days we've observed: 9 tool removals, 0 breaking changes, 0 auth/transport breaks, 7 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 63 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 64 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the openfang-rail MCP server?
openfang-rail is a hosted endpoint at https://hcrb.in/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · hcrb.in
claude mcp add --transport http 89rat-openfang-rail 'https://hcrb.in/mcp'
{
"mcpServers": {
"89rat-openfang-rail": {
"url": "https://hcrb.in/mcp"
}
}
} {
"servers": {
"89rat-openfang-rail": {
"type": "http",
"url": "https://hcrb.in/mcp"
}
}
} [mcp_servers.89rat-openfang-rail] url = "https://hcrb.in/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"89rat-openfang-rail": {
"type": "remote",
"url": "https://hcrb.in/mcp",
"enabled": true
}
}
} openclaw mcp add 89rat-openfang-rail --url 'https://hcrb.in/mcp' --transport streamable-http
mcp_servers:
89rat-openfang-rail:
url: "https://hcrb.in/mcp" {
"McpServers": {
"89rat-openfang-rail": {
"Transport": "http",
"Url": "https://hcrb.in/mcp"
}
}
} assistant mcp add 89rat-openfang-rail -t streamable-http -u 'https://hcrb.in/mcp'
{
"mcpServers": {
"89rat-openfang-rail": {
"type": "http",
"url": "https://hcrb.in/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 9 to 13.
- 19 Sept 26 0
- Tool “calculate_fx_savings” rewrote its description, which is the text the model reads security
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 6.
- 17 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Server version: 1.2.0 → 1.3.0 functional
- New tool “receipt_verify” functional
- 16 Sept 26 +8
- Tool “iban-check” was removed ▼ security
- Tool “lei-check” was removed ▼ security
- Tool “swift-bic-check” was removed ▼ security
- The server rewrote its instructions, which are the text every model session reads security
- The server changed its declared name: juana-identifiers → code402 security
- Schema quality: pass → fail ▼ functional
- Tool coverage: 0% → 100% ▲ functional
- Schema quality: fail → pass ▲ functional
- MCP protocol: fail → pass ▲ functional
- The server now declares the “prompts” capability functional
- The server now declares the “resources” capability functional
- Schema quality: good → excellent functional
- MCP protocol version: 2025-06-18 → 2025-11-25 functional
- Server version: 1.0.0 → 1.2.0 functional
- New tool “aba_routing_check” functional
- New tool “abn_check” functional
- New tool “aci_trust_lookup” functional
- New tool “africa_supplier_check” functional
- New tool “balance_check” functional
- New tool “batch_validate” functional
- New tool “bind_insurance_policy” functional
- New tool “block_info” functional
- New tool “calculate_fx_savings” functional
- New tool “china_supplier_check” functional
- New tool “clean_markdown_scraper” functional
- New tool “cnpj_check” functional
- New tool “company_number_format” functional
- New tool “context_distill” functional
- New tool “create_ap2_pilot” functional
- New tool “create_b2b_invoice” functional
- New tool “crypto_ticker” functional
- New tool “csp_commitment_create” functional
- New tool “dip_file_dispute” functional
- New tool “e164_check” functional
- New tool “ean13_check” functional
- New tool “ein_format_check” functional
- New tool “erc20_balance” functional
- New tool “fx_spot_price_oracle” functional
- New tool “get_b2b_invoice” functional
- New tool “gstin_check” functional
- New tool “gulf_supplier_check” functional
- New tool “iban_check” functional
- New tool “ifsc_check” functional
- New tool “india_supplier_check” functional
- New tool “instant_json_schema_verifier” functional
- New tool “isbn_check” functional
- New tool “isin_check” functional
- New tool “iso20022_to_x402_intent” functional
- New tool “iso20022_validate” functional
- New tool “iso4217_currency_check” functional
- New tool “japan_corp_check” functional
- New tool “japan_supplier_check” functional
- New tool “kra_pin_check” functional
- New tool “latam_supplier_check” functional
- New tool “lei_check” functional
- New tool “list_approved_insurers” functional
- New tool “luhn_check” functional
- New tool “ofac_sdn_check” functional
- New tool “pan_format_check” functional
- New tool “pod_verify_delivery” functional
- New tool “pre_disbursement_guard” functional
- New tool “quote_3rd_party_insurance” functional
- New tool “rent_deposit_guard” functional
- New tool “rental_listing_risk” functional
- New tool “rental_verdict” functional
- New tool “rfc_check” functional
- New tool “sedol_check” functional
- New tool “settlement_history_check” functional
- New tool “simulate_spend_sentinel” functional
- New tool “swift_bic_check” functional
- New tool “tx_activity” functional
- New tool “uae_trn_check” functional
- New tool “upi_vpa_check” functional
- New tool “uscc_check” functional
- New tool “vat_mod97_check” functional
- New tool “vendor_onboarding_pack” functional
- 15 Sept 26 −9
- Stability: 0.07 → fail ▼ security
- Tool “aba_routing_check” was removed ▼ security
- Tool “abn_check” was removed ▼ security
- Tool “aci_trust_lookup” was removed ▼ security
- Tool “autonomous_commercial_pipeline” was removed ▼ security
- Tool “balance_check” was removed ▼ security
- Tool “batch_validate” was removed ▼ security
- Tool “bind_insurance_policy” was removed ▼ security
- Tool “block_info” was removed ▼ security
- Tool “browse_compute_clusters” was removed ▼ security
- Tool “browse_technical_studios” was removed ▼ security
- Tool “browse_top_guilds” was removed ▼ security
- Tool “calculate_fx_savings” was removed ▼ security
- Tool “clean_markdown_scraper” was removed ▼ security
- Tool “cnpj_check” was removed ▼ security
- Tool “company_number_format” was removed ▼ security
- Tool “context_distill” was removed ▼ security
- Tool “create_ap2_pilot” was removed ▼ security
- Tool “create_b2b_invoice” was removed ▼ security
- Tool “crypto_ticker” was removed ▼ security
- Tool “csp_commitment_create” was removed ▼ security
- Tool “dip_file_dispute” was removed ▼ security
- Tool “e164_check” was removed ▼ security
- Tool “ean13_check” was removed ▼ security
- Tool “ein_format_check” was removed ▼ security
- Tool “engine_benchmark” was removed ▼ security
- Tool “erc20_balance” was removed ▼ security
- Tool “fx_spot_price_oracle” was removed ▼ security
- Tool “get_b2b_invoice” was removed ▼ security
- Tool “get_guild_profile” was removed ▼ security
- Tool “get_studio_profile” was removed ▼ security
- Tool “gstin_check” was removed ▼ security
- Tool “iban_check” was removed ▼ security
- Tool “ifsc_check” was removed ▼ security
- Tool “instant_json_schema_verifier” was removed ▼ security
- Tool “isbn_check” was removed ▼ security
- Tool “isin_check” was removed ▼ security
- Tool “iso20022_to_x402_intent” was removed ▼ security
- Tool “iso20022_validate” was removed ▼ security
- Tool “iso4217_currency_check” was removed ▼ security
- Tool “japan_corp_check” was removed ▼ security
- Tool “kra_pin_check” was removed ▼ security
- Tool “lei_check” was removed ▼ security
- Tool “list_approved_insurers” was removed ▼ security
- Tool “luhn_check” was removed ▼ security
- Tool “ofac_sdn_check” was removed ▼ security
- Tool “pan_format_check” was removed ▼ security
- Tool “pod_verify_delivery” was removed ▼ security
- Tool “pre_disbursement_guard” was removed ▼ security
- Tool “quote_3rd_party_insurance” was removed ▼ security
- Tool “quote_compute_slice” was removed ▼ security
- Tool “rent_deposit_guard” was removed ▼ security
- Tool “rental_listing_risk” was removed ▼ security
- Tool “rental_verdict” was removed ▼ security
- Tool “rfc_check” was removed ▼ security
- Tool “sedol_check” was removed ▼ security
- Tool “semantic_service_matchmaker” was removed ▼ security
- Tool “settlement_history_check” was removed ▼ security
- Tool “simulate_spend_sentinel” was removed ▼ security
- Tool “swift_bic_check” was removed ▼ security
- Tool “tx_activity” was removed ▼ security
- Tool “uae_trn_check” was removed ▼ security
- Tool “upi_vpa_check” was removed ▼ security
- Tool “uscc_check” was removed ▼ security
- Tool “vat_mod97_check” was removed ▼ security
- Tool “vendor_onboarding_pack” was removed ▼ security
- The server rewrote its instructions, which are the text every model session reads security
- The server changed its declared name: code402 → juana-identifiers security
- Tool coverage: 100% → 0% ▼ functional
- Schema quality: pass → fail ▼ functional
- MCP protocol: pass → fail ▼ functional
- Schema quality: fail → pass ▲ functional
- The server no longer declares the “prompts” capability functional
- The server no longer declares the “resources” capability functional
- Schema quality: excellent → good functional
- MCP protocol version: 2025-11-25 → 2025-06-18 functional
- Server version: 1.2.0 → 1.0.0 functional
- New tool “iban-check” functional
- New tool “lei-check” functional
- New tool “swift-bic-check” functional
- 13 Sept 26 +1
- Tool “ofac_sdn_check” rewrote its description, which is the text the model reads security
- Schema quality: pass → fail ▼ functional
- Stability: unverified → 0.03 ▲ functional
- 12 Sept 26 65
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Probed https://hcrb.in/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=hcrb.in | CN=WE1,O=Google Trust Services,C=US | 7 Sept 2026 | 6 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | 7cac0e10ba3743ed13c6247a9d3a48b7 |
| SANs: hcrb.in, rail.hcrb.in, *.rail.hcrb.in | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of hcrb.in. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| in. | present | 10094 | 13 | Verified |
| hcrb.in. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains; preload |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=(), browsing-topics=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://hcrb.in/mcp | Verified | 200 | |
| http (plaintext) | http://hcrb.in/mcp | Served over HTTP | 200 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
list_approved_insurers List registered 3rd-party transaction insurers ~119
List underwriters in the open insurance referral directory. The directory ships EMPTY: an underwriter appears only after it self-registers via /api/insurance/register, and self-registration is not vetting — buyers must perform their own due diligence on any listed counterparty.
| Name | Type | Req | Description |
|---|---|---|---|
| coverage_type | string | – | Optional filter: 'smart_contract_execution', 'commercial_trade_credit', 'wire_fraud_bec_defense', or 'subagent_sla_delivery' |
| min_coverage_usdc | number | – | Minimum desired coverage limit in USDC |
| Name | Type | Req | Description |
|---|---|---|---|
| open_access_policy | string | – | – |
| tool | string | – | – |
| total_count | number | yes | – |
| underwriters | array | yes | – |
| valid | boolean | yes | – |
{"coverage_type":"commercial_trade_credit"}luhn_check Luhn Check Digit Verifier ~59
Validate any 12-19 digit number by the Luhn mod-10 algorithm. Never submit real payment card numbers. Returns signed XDR-1 receipt.
| Name | Type | Req | Description |
|---|---|---|---|
| number | string | yes | 12-19 digit number; spaces/dashes allowed. |
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | – |
| normalized | string | – | – |
| reason | string | yes | – |
| scope | string | – | – |
| tool | string | – | – |
| valid | boolean | yes | – |
{"number":"4111111111111111"}ofac_sdn_check OFAC SDN & Sanctions List Edge Screener ~105
Deterministic screen of EVM addresses and jurisdictions against a curated local blocklist of sanctioned addresses and prohibited jurisdictions. Address- and jurisdiction-level only — this is NOT name-based screening and NOT a complete OFAC SDN check. Absence of a match is not a sanctions clearance; use as one informational input alongside your own compliance process.
| Name | Type | Req | Description |
|---|---|---|---|
| subject | string | yes | EVM address (0x...) or ISO 3166-1 country code / jurisdiction name |
| Name | Type | Req | Description |
|---|---|---|---|
| is_sanctioned | boolean | yes | – |
| match_type | string | – | – |
| reason | string | – | – |
| sanction_program | string | – | – |
| scope | string | – | – |
| subject | string | – | – |
| tool | string | yes | – |
| valid | boolean | yes | – |
{"subject":"0x7f367cc41522ce07553e823bf3be79a889debe1b"}pan_format_check India Permanent Account Number (PAN) Format Validator ~70
Deterministic validation of Indian Permanent Account Number (PAN) issued by CBDT / Income Tax Department with 4th-character entity type classification (Individual, Company, Firm, Trust, HUF).
| Name | Type | Req | Description |
|---|---|---|---|
| pan | string | yes | 10-character PAN string (e.g. 'ABCDE1234F') |
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | – |
| entity_code | string | – | – |
| entity_type | string | – | – |
| normalized | string | – | – |
| reason | string | – | – |
| scope | string | – | – |
| tool | string | yes | – |
| valid | boolean | yes | – |
{"pan":"AAACP1234M"}pod_verify_delivery POD-1 Proof-of-Delivery Attestation Verifier ~122
Physical IoT and off-chain service delivery verification using integer E7 point-in-polygon geometry and hardware sensor threshold validation (POD-1). Deterministic integer arithmetic avoids floating-point coordinate drift; verification only, no custody or escrow.
| Name | Type | Req | Description |
|---|---|---|---|
| attestation | object | yes | Signed IoT device delivery attestation with coordinates, counter, and signatures |
| last_seen_counter | number | – | Anti-replay counter from previous delivery attestations |
| mandate | object | yes | Delivery mandate with geofence polygon (lat_e7/lon_e7) and time window |
| Name | Type | Req | Description |
|---|---|---|---|
| attestation_receipt_digest | string | – | – |
| details | object | – | – |
| mandate_id | string | – | – |
| ok | boolean | yes | – |
| standard | string | yes | – |
| verdict | string | yes | – |
| verified | boolean | yes | – |
{"attestation":{"counter":1,"device_id":"DEV-1","device_pubkey":"0x01","geo":{"accuracy_m":10,"lat_e7":377750000,"lon_e7":-122415000},"mandate_id":"mandate-99","scheme":1,"signatures":{"device":"0x01010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101"},"ts":1700001000},"last_seen_counter":0,"mandate":{"geofence":{"ring":[[377749000,-1224194000],[377759000,-1224194000],[377759000,-1224094000],[377749000,-1224094000]],"type":"polygon_e7"},"mandate_id":"mandate-99","max_accuracy_m":50,"order_ref":"ord-99","required_signers":["device"],"window":{"not_after":1700003600,"not_before":1700000000}}}pre_disbursement_guard Pre-Disbursement Due Diligence Guard (Check Before You Send) ~246
MANDATORY COUNTERPARTY DUE DILIGENCE: Verifies counterparty before releasing invoice payments, contractor payouts, or wires. Screens ISO 13616 IBAN checksum, RDAP domain age (<30d = scam), disposable email domains, UK CRN/LEI format, and BEC cross-jurisdiction mismatches. Produces signed XDR-1 receipt for compliance.
| Name | Type | Req | Description |
|---|---|---|---|
| company_number | string | – | Official corporate registration number, e.g. UK Companies House 8 digits/chars (optional). |
| declared_country | string | – | 2-letter ISO country code where vendor claims to be registered (optional, e.g. 'GB', 'US', 'DE'). |
| invoice_amount_usd | number | – | Disbursement transaction amount in USD (optional). |
| lei | string | – | ISO 17442 Legal Entity Identifier (optional). |
| physical_address | string | – | Vendor physical office address (optional). |
| recipient_iban | string | – | Recipient bank IBAN (optional). |
| vat_number | string | – | EU VAT number (optional). |
| vendor_domain | string | – | Vendor website domain or invoicing email address (optional). |
| Name | Type | Req | Description |
|---|---|---|---|
| checks | object | – | – |
| clear_to_disburse | boolean | yes | – |
| decision | string | yes | – |
| flags_triggered | array | – | – |
| inspected_counterparty | object | – | – |
| recommendations | array | – | – |
| risk_level | string | yes | – |
| risk_score | number | yes | – |
| scope | string | – | – |
| summary | string | – | – |
| tool | string | – | – |
{"company_number":"01234567","declared_country":"GB","invoice_amount_usd":4500,"recipient_iban":"GB82WEST12345698765432","vendor_domain":"billing@acme-consulting.co.uk"}quote_3rd_party_insurance Quote 3rd-party transaction & payment insurance ~196
Compare insurance quotes from underwriters registered in the open referral directory (coverage for transaction, smart-contract, trade-credit, and BEC wire-fraud risk). Returns zero quotes until an underwriter has self-registered; this gateway never underwrites risk itself.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | – | Alias for amount_usdc. |
| amount_usdc | number | – | Transaction or invoice settlement amount in USDC (e.g. 50000). |
| counterparty_address | string | – | Counterparty Base EVM wallet address (optional). |
| coverage_type | string | – | Desired coverage type: 'smart_contract_execution', 'commercial_trade_credit', 'wire_fraud_bec_defense', 'subagent_sla_delivery' |
| invoice_id | string | – | Associated invoice identifier (optional). |
| transaction_id | string | – | Transaction identifier (optional). |
| tx_hash | string | – | On-chain transaction hash to insure (optional). |
| Name | Type | Req | Description |
|---|---|---|---|
| amount_usdc | number | yes | – |
| invoice_id | string | – | – |
| plain_english_summary | string | – | – |
| quotes | array | yes | – |
| recommended_underwriter | object | – | – |
| scope | string | – | – |
| tool | string | – | – |
| total_quotes | number | – | – |
| transaction_id | string | – | – |
| tx_hash | string | – | – |
| valid | boolean | yes | – |
{"amount_usdc":50000,"coverage_type":"commercial_trade_credit"}receipt_verify Verify any XDR-1 receipt — free, stateless, any issuer ~133
Verifies a signed XDR-1 receipt from ANY x402 service: recomputes the canonical digest and recovers the signer, then compares it to the declared signer. Free forever — no account, no quota, no storage (stateless). A valid receipt proves the signer signed that tool call at that timestamp; it does NOT prove funds moved or any business claim.
| Name | Type | Req | Description |
|---|---|---|---|
| receipt | string | yes | The full XDR-1 receipt object: v, tool, tool_version, input_hash, output_hash, payer, recipient, amount, nonce, ts, tier, signer, signature (optional successor/stream_state). |
| Name | Type | Req | Description |
|---|---|---|---|
| canonical | string | – | – |
| declared_signer | string | – | – |
| digest | string | – | – |
| scope | string | – | – |
| signer_recovered | string | – | – |
| valid | boolean | – | – |
{"receipt":{"amount":"0","input_hash":"0x…","nonce":"0x…","output_hash":"0x…","payer":"0xc59c85e661d34084a7769f955d17fd38254a6235","recipient":"0xc59c85e661d34084a7769f955d17fd38254a6235","signature":"0x…","signer":"0xa036e2e3e19c6d02f30b3a9eb0acd057e6d9a5c8","tier":"free","tool":"iban-check","tool_version":"1","ts":0,"v":"XDR-1"}}rent_deposit_guard Rental Deposit Safety Guard ~112
CRITICAL ESCROW DEFENSE: Validates rental deposit safety by checking recipient IBAN checksum, matching property/deposit country jurisdiction, and flagging advance pre-viewing payment demands to prevent escrow theft.
| Name | Type | Req | Description |
|---|---|---|---|
| deposit_before_viewing | boolean | – | True if a deposit is demanded before any viewing. |
| deposit_iban | string | yes | IBAN the deposit would be paid to. |
| property_country | string | – | ISO 3166-1 alpha-2 country of the property, e.g. DE. |
| Name | Type | Req | Description |
|---|---|---|---|
| band | string | yes | – |
| flags | array | – | – |
| flags_fired | array | – | – |
| recommendation | string | – | – |
| risk_score | number | yes | – |
| scope | string | – | – |
| tool | string | – | – |
{"deposit_before_viewing":true,"deposit_iban":"GB82WEST12345698765432","property_country":"DE"}rental_listing_risk Rental Listing Risk & Fraud Engine ~183
Explainable tenancy fraud risk score evaluated across irreversible payment demands, off-platform pressure, stolen photos, and advance wire signals. Deterministic rule engine.
| Name | Type | Req | Description |
|---|---|---|---|
| contact_moves_offplatform | boolean | – | Pushed off the listing platform. |
| identity_docs_requested_upfront | boolean | – | Full ID/bank docs demanded upfront. |
| landlord_abroad_cannot_meet | boolean | – | Landlord 'abroad', can't meet in person. |
| no_in_person_viewing | boolean | – | No viewing before payment. |
| payment_irreversible | boolean | – | Paid via crypto/gift-card/wire-only. |
| photos_reverse_image_hit | boolean | – | Listing photos found elsewhere (stolen). |
| price_below_market_pct | number | – | How far below local market the rent is asked, in percent. |
| urgency_pressure | boolean | – | Pressure to secure today. |
| Name | Type | Req | Description |
|---|---|---|---|
| band | string | yes | – |
| flags | array | – | – |
| flags_fired | array | – | – |
| recommendation | string | – | – |
| risk_score | number | yes | – |
| scope | string | – | – |
| tool | string | – | – |
{"no_in_person_viewing":true,"payment_irreversible":true,"price_below_market_pct":45}rental_verdict Tenancy Due-Diligence & Anti-Scam Verdict ~232
INSTITUTIONAL TENANCY SHIELD: Single combined, signed rental due-diligence verdict combining deposit IBAN checksum, cross-border jurisdiction, pre-viewing advance wire flags, landlord entity verification, and listing fraud heuristics. Outputs cover-your-agent verification proof.
| Name | Type | Req | Description |
|---|---|---|---|
| contact_moves_offplatform | boolean | – | Contact pushed off the listing platform. |
| deposit_before_viewing | boolean | – | True if a deposit is demanded before any viewing. |
| deposit_iban | string | yes | Deposit IBAN. |
| landlord_company_no | string | – | Landlord UK company number (optional). |
| landlord_lei | string | – | Landlord LEI (optional). |
| no_in_person_viewing | boolean | – | No in-person or video viewing before payment. |
| payment_irreversible | boolean | – | Payment demanded via crypto/gift-card/wire-only. |
| price_below_market_pct | number | – | How far below local market the rent is asked, in percent. |
| property_country | string | – | Property country, ISO alpha-2. |
| urgency_pressure | boolean | – | Pressure to secure the property today. |
| Name | Type | Req | Description |
|---|---|---|---|
| band | string | – | – |
| components | object | – | – |
| flags | array | – | – |
| risk_score | number | yes | – |
| scope | string | – | – |
| summary | string | – | – |
| tool | string | – | – |
| verdict | string | yes | – |
{"deposit_before_viewing":true,"deposit_iban":"GB82WEST12345698765432","landlord_lei":"529900T8BM49AURSDO55","property_country":"DE"}rfc_check Mexico RFC Check (Registro Federal de Contribuyentes) ~79
Validate Mexican SAT RFC corporate (12-char) or individual (13-char) tax code and homoclave. Required for Mexican contractor invoicing and SPEI cross-border settlements. Returns signed XDR-1 receipt.
| Name | Type | Req | Description |
|---|---|---|---|
| rfc | string | yes | 12 or 13 character Mexican RFC (e.g. BBA830831LJ2). |
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | – |
| normalized | string | – | – |
| reason | string | yes | – |
| scope | string | – | – |
| tool | string | – | – |
| valid | boolean | yes | – |
{"rfc":"BBA830831LJ2"}sedol_check SEDOL Check (UK/Ireland Securities) ~60
Validate a UK/Ireland security identifier by its (1,3,1,7,3,9)-weight mod-10 checksum. Returns signed XDR-1 receipt.
| Name | Type | Req | Description |
|---|---|---|---|
| sedol | string | yes | 7-character SEDOL code. |
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | – |
| normalized | string | – | – |
| reason | string | yes | – |
| scope | string | – | – |
| tool | string | – | – |
| valid | boolean | yes | – |
{"sedol":"B0YBKJ7"}settlement_history_check On-Chain Counterparty Settlement History ~69
ON-CHAIN COUNTERPARTY PROOF: Audit USDC transfers sent and received by any EVM address over the last ~48h of Base blocks. Preflighted so you never pay during an RPC outage.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | EVM address, 0x-prefixed. |
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | – |
| scope | string | – | – |
| tool | string | – | – |
| usdc_received | object | – | – |
| usdc_sent | object | – | – |
| valid | boolean | yes | – |
{"address":"0xc59c85e661d34084a7769f955d17fd38254a6235"}simulate_spend_sentinel Simulate Spend Sentinel policy defense and escrow reversal ~79
Simulate prompt-injection spend halts, hallucinated subagent delivery escrow reversals, and verified bounded spend under AP2 envelopes.
| Name | Type | Req | Description |
|---|---|---|---|
| scenario | string | – | Simulation scenario: 'injection' (prompt attack), 'garbage' (bad subagent output), or 'provable' (verified settlement). Default 'injection'. |
| Name | Type | Req | Description |
|---|---|---|---|
| action_taken | string | – | – |
| actual_wallet_loss_usdc | number | – | – |
| code | string | – | – |
| requested_amount_usdc | number | – | – |
| scenario | string | yes | – |
| scope | string | – | – |
| status | number | – | – |
| telemetry | string | – | – |
| tool | string | – | – |
| valid | boolean | yes | – |
| verdict | string | yes | – |
{"scenario":"injection"}swift_bic_check SWIFT/BIC Structure & Country Code Check ~78
Validate a SWIFT/BIC code by ISO 9362 structure (bank code, ISO country, location, optional branch). Run before foreign wire transfer dispatch to prevent routing rejection. Returns signed XDR-1 receipt.
| Name | Type | Req | Description |
|---|---|---|---|
| bic | string | yes | SWIFT/BIC code, 8 or 11 characters; spaces/dashes allowed. |
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | – |
| normalized | string | – | – |
| reason | string | yes | – |
| scope | string | – | – |
| tool | string | – | – |
| valid | boolean | yes | – |
{"bic":"DEUTDEFF500"}tx_activity Tx Activity & Contract Detection ~52
On-chain activity snapshot: total outbound nonce, bytecode check (is_contract), and funded status on Base. Preflighted before payment.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | EVM address, 0x-prefixed. |
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | – |
| first_funded_heuristic | boolean | – | – |
| is_contract | boolean | – | – |
| scope | string | – | – |
| tool | string | – | – |
| tx_count | number | yes | – |
| valid | boolean | yes | – |
{"address":"0xc59c85e661d34084a7769f955d17fd38254a6235"}uae_trn_check UAE Tax Registration Number (TRN) Format Validator ~60
Deterministic validation of UAE 15-digit Tax Registration Number (TRN) issued by the Federal Tax Authority (FTA) for VAT purposes.
| Name | Type | Req | Description |
|---|---|---|---|
| trn | string | yes | 15-digit UAE TRN string (starts with 100) |
| Name | Type | Req | Description |
|---|---|---|---|
| authority | string | – | – |
| country | string | – | – |
| normalized | string | – | – |
| reason | string | – | – |
| scope | string | – | – |
| tool | string | yes | – |
| trn_type | string | – | – |
| valid | boolean | yes | – |
{"trn":"100123456700003"}upi_vpa_check India UPI Virtual Payment Address (VPA) Validator ~89
Deterministic validation of Indian UPI Virtual Payment Address (VPA / handle) against NPCI guidelines and accredited PSP handle registry (okhdfcbank, okaxis, paytm, ybl, etc.).
| Name | Type | Req | Description |
|---|---|---|---|
| vpa | string | yes | UPI Virtual Payment Address (e.g. 'merchant@okhdfcbank', '9876543210@paytm') |
| Name | Type | Req | Description |
|---|---|---|---|
| accredited_psp | boolean | – | – |
| country | string | – | – |
| handle | string | – | – |
| normalized | string | – | – |
| reason | string | – | – |
| scope | string | – | – |
| tool | string | yes | – |
| username | string | – | – |
| valid | boolean | yes | – |
{"vpa":"merchant@okhdfcbank"}uscc_check China USCC Check (Unified Social Credit Code / 统一社会信用代码) ~86
Validate 18-character Chinese business registration and tax code using GB 32100-2015 ISO 7064 Mod-31-3 checksum. Required for B2B supply chain trade with Chinese manufacturers. Returns signed XDR-1 receipt.
| Name | Type | Req | Description |
|---|---|---|---|
| uscc | string | yes | 18-character Chinese Unified Social Credit Code (e.g. 91330100799655058B). |
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | – |
| normalized | string | – | – |
| reason | string | yes | – |
| scope | string | – | – |
| tool | string | – | – |
| valid | boolean | yes | – |
{"uscc":"91330100799655058B"}vat_mod97_check VAT Check & Tax Invoicing Shield ~82
CRITICAL TAX COMPLIANCE CHECK: Deterministically validates EU/BE VAT identifiers with MOD-97 checksums. Eliminates cross-border invoicing errors, invalid billing, and tax audit penalties. Returns signed XDR-1 receipt for accounting defense.
| Name | Type | Req | Description |
|---|---|---|---|
| vat_number | string | yes | EU VAT id; BE mod-97 checksum (BE prefix optional). |
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | – |
| normalized | string | – | – |
| reason | string | yes | – |
| scope | string | – | – |
| tool | string | – | – |
| valid | boolean | yes | – |
{"vat_number":"BE0417497106"}vendor_onboarding_pack All-in-One Vendor Onboarding & Clearing Shield ~126
INSTITUTIONAL COUNTERPARTY CLEARING: Screens vendor IBAN + LEI + VAT + UK company number in ONE signed call. Saves 50% vs individual checks. Produces an audit-ready compliance report and signed XDR-1 receipt to defend against invoice fraud before funds move.
| Name | Type | Req | Description |
|---|---|---|---|
| company_number | string | – | Vendor UK company number (optional). |
| iban | string | – | Vendor IBAN (optional). |
| lei | string | – | Vendor LEI (optional). |
| vat_number | string | – | Vendor VAT number, BE mod-97 (optional). |
| Name | Type | Req | Description |
|---|---|---|---|
| all_valid | boolean | yes | – |
| checked_count | number | yes | – |
| results | array | – | – |
| scope | string | – | – |
| tool | string | – | – |
| verdict | string | – | – |
{"company_number":"12345678","iban":"GB82 WEST 1234 5698 7654 32","lei":"529900T8BM49AURSDO55","vat_number":"BE0417497106"}What is the openfang-rail MCP server?
openfang-rail is an MCP server listed in the public MCP registry as io.github.89rat/openfang-rail. Deterministic banking, LEI, VAT, SWIFT & compliance checks via MCP with signed XDR-1 receipts. This page covers its hosted endpoint (https://hcrb.in/mcp).
Is the openfang-rail MCP server safe to use?
openfang-rail scores 67 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the openfang-rail MCP server expose?
openfang-rail exposes 63 tools: receipt_verify, simulate_spend_sentinel, create_ap2_pilot, iban_check, lei_check, and 58 more. Their descriptions and schemas cost roughly 6,364 tokens of context every time the server is loaded.
Does the openfang-rail MCP server require authentication?
No. We connected to openfang-rail without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the openfang-rail MCP server still maintained?
openfang-rail is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.