com.crossingkeyintelligence/crossingkey-mcp
REMOTE · MCP.CROSSINGKEYINTELLIGENCE.COM · SCANNED SEP 20
CrossingKey MCP for agent commerce, x402 payments, deterministic execution, and verifiable receipts.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes. View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability0
- Transport check failed: declared streamable-http, but the endpoint returned HTTP 530. See how to fix → View diagnostics → Fail
Schema Quality & AI Usability0
- Schema not yet verified: we couldn't read the endpoint's schema.Unverified
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
- Tool coverage not yet verified: we couldn't read the endpoint's tools.Unverified
Tool Safety0
- Tool safety not yet verified: we couldn't read the endpoint's tools.Unverified
Capabilities0
- Capabilities not yet verified: we couldn't read the endpoint's capabilities.Unverified
Unverified: 5 categories
Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.
How do I install the com.crossingkeyintelligence/crossingkey-mcp server?
com.crossingkeyintelligence/crossingkey-mcp is a hosted endpoint at https://mcp.crossingkeyintelligence.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.crossingkeyintelligence.com
claude mcp add --transport http com-crossingkeyintelligence-crossingkey-mcp 'https://mcp.crossingkeyintelligence.com/mcp'
{
"mcpServers": {
"com-crossingkeyintelligence-crossingkey-mcp": {
"url": "https://mcp.crossingkeyintelligence.com/mcp"
}
}
} {
"servers": {
"com-crossingkeyintelligence-crossingkey-mcp": {
"type": "http",
"url": "https://mcp.crossingkeyintelligence.com/mcp"
}
}
} [mcp_servers.com-crossingkeyintelligence-crossingkey-mcp] url = "https://mcp.crossingkeyintelligence.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-crossingkeyintelligence-crossingkey-mcp": {
"type": "remote",
"url": "https://mcp.crossingkeyintelligence.com/mcp",
"enabled": true
}
}
} openclaw mcp add com-crossingkeyintelligence-crossingkey-mcp --url 'https://mcp.crossingkeyintelligence.com/mcp' --transport streamable-http
mcp_servers:
com-crossingkeyintelligence-crossingkey-mcp:
url: "https://mcp.crossingkeyintelligence.com/mcp" {
"McpServers": {
"com-crossingkeyintelligence-crossingkey-mcp": {
"Transport": "http",
"Url": "https://mcp.crossingkeyintelligence.com/mcp"
}
}
} assistant mcp add com-crossingkeyintelligence-crossingkey-mcp -t streamable-http -u 'https://mcp.crossingkeyintelligence.com/mcp'
{
"mcpServers": {
"com-crossingkeyintelligence-crossingkey-mcp": {
"type": "http",
"url": "https://mcp.crossingkeyintelligence.com/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 −50
- Endpoint reachability: reachable → not serving MCP ▼ security
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Authorization: partial → unverified ▼ security
- Transport: pass → fail ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- 19 Sept 26 0
- A breaking change shipped without a version bump: still 2.4.0 ▼ security
- Tool “check_requirements” was removed ▼ security
- Tool “crossingkey.describe” was removed ▼ security
- Tool “discover_provider” was removed ▼ security
- Tool “estimate_cost” was removed ▼ security
- Tool “execution_preflight” was removed ▼ security
- Tool “fulfillment.get” was removed ▼ security
- Tool “fulfillment.status” was removed ▼ security
- Tool “get_offer” was removed ▼ security
- Tool “get_request_credit_links” was removed ▼ security
- Tool “list_capabilities” was removed ▼ security
- Tool “list_offers” was removed ▼ security
- Tool “list_request_services” was removed ▼ security
- Tool “payment.verify_onchain” was removed ▼ security
- Tool “preview_result_schema” was removed ▼ security
- Tool “xkey_validate_intake” was removed ▼ security
- Tool “capabilities.list” rewrote its description, which is the text the model reads security
- Tool “capability.quote” rewrote its description, which is the text the model reads security
- Tool “purchase.status” rewrote its description, which is the text the model reads security
- Schema quality: 1872 → 1476 ▲ functional
- New tool “cost.estimate” functional
- New tool “credits.options” functional
- New tool “execution.preflight” functional
- New tool “offers.list” functional
- New tool “payment.verify” functional
- New tool “provider.describe” functional
- New tool “requirements.check” functional
- New tool “result.preview” functional
- New tool “services.list” functional
- New tool “xkey.validate” functional
- 18 Sept 26 +50
- Stability: unverified → fail ▼ security
- Tool “get_fulfillment_status” was removed ▼ security
- Tool “get_stripe_checkout_link” was removed ▼ security
- Tool “list_stripe_offers” was removed ▼ security
- Authorization: unverified → partial ▲ security
- Injection markers: unverified → pass ▲ security
- Transport: fail → pass ▲ security
- Tool “capabilities.list” rewrote its description, which is the text the model reads security
- Tool “capability.get” rewrote its description, which is the text the model reads security
- Tool “capability.quote” rewrote its description, which is the text the model reads security
- Tool “check_requirements” rewrote its description, which is the text the model reads security
- Tool “crossingkey.describe” rewrote its description, which is the text the model reads security
- Tool “discover_provider” rewrote its description, which is the text the model reads security
- Tool “entitlement.inspect” rewrote its description, which is the text the model reads security
- Tool “estimate_cost” rewrote its description, which is the text the model reads security
- Tool “execution_preflight” rewrote its description, which is the text the model reads security
- Tool “fulfillment.get” rewrote its description, which is the text the model reads security
- Tool “fulfillment.status” rewrote its description, which is the text the model reads security
- Tool “get_offer” rewrote its description, which is the text the model reads security
- Tool “get_request_credit_links” rewrote its description, which is the text the model reads security
- Tool “health” rewrote its description, which is the text the model reads security
- Tool “list_capabilities” rewrote its description, which is the text the model reads security
- Tool “list_offers” rewrote its description, which is the text the model reads security
- Tool “list_request_services” rewrote its description, which is the text the model reads security
- Tool “payment.methods” rewrote its description, which is the text the model reads security
- Tool “payment.verify_onchain” rewrote its description, which is the text the model reads security
- Tool “preview_result_schema” rewrote its description, which is the text the model reads security
- Tool “purchase.status” rewrote its description, which is the text the model reads security
- Tool “receipt.verify” rewrote its description, which is the text the model reads security
- Tool “xkey_validate_intake” rewrote its description, which is the text the model reads security
- Schema quality: 32 → 81 ▼ functional
- Endpoint reachability: not serving MCP → reachable ▲ functional
- Tool coverage: 0% → 100% ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Schema quality: good → excellent functional
- Server version: 2.3.0 → 2.4.0 functional
- “capability.get” reworded the description of “name” cosmetic
- “capability.quote” reworded the description of “name” cosmetic
- “check_requirements” reworded the description of “id” cosmetic
- “entitlement.inspect” reworded the description of “id” cosmetic
- “estimate_cost” reworded the description of “id” cosmetic
- “execution_preflight” reworded the description of “id” cosmetic
- “fulfillment.get” reworded the description of “idempotency_key” cosmetic
- “fulfillment.status” reworded the description of “idempotency_key” cosmetic
- “get_offer” reworded the description of “id” cosmetic
- “list_capabilities” reworded the description of “access” cosmetic
- “list_offers” reworded the description of “kind” cosmetic
- “list_offers” reworded the description of “max_price_usd” cosmetic
- “list_offers” reworded the description of “query” cosmetic
- “payment.verify_onchain” reworded the description of “receiptId” cosmetic
- “payment.verify_onchain” reworded the description of “txHash” cosmetic
- “preview_result_schema” reworded the description of “id” cosmetic
- “purchase.status” reworded the description of “idempotency_key” cosmetic
- “receipt.verify” reworded the description of “receipt” cosmetic
- “xkey_validate_intake” reworded the description of “idempotency_key” cosmetic
- “xkey_validate_intake” reworded the description of “raw_intake” cosmetic
- 17 Sept 26 −44
- Endpoint reachability: reachable → not serving MCP ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: 0.03 → unverified ▼ security
- Authorization: partial → unverified ▼ security
- Transport: pass → fail ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- 16 Sept 26 0
- Stability: unverified → 0.03 ▲ functional
- 15 Sept 26 67
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://mcp.crossingkeyintelligence.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=crossingkeyintelligence.com | CN=YE1,O=Let's Encrypt,C=US | 18 Aug 2026 | 16 Nov 2026 | ECDSA 256 | ECDSA-SHA384 | 5a27b7b6cf7539fef9a567fe6bfe7a59d33 |
| SANs: *.crossingkeyintelligence.com, crossingkeyintelligence.com | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.crossingkeyintelligence.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| crossingkeyintelligence.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 530 |
| Header | Value |
|---|---|
| x-frame-options | SAMEORIGIN |
| referrer-policy | same-origin |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.crossingkeyintelligence.com/mcp | HTTP error | 530 | |
| http (plaintext) | http://mcp.crossingkeyintelligence.com/mcp | HTTPS enforced | 301 | https://mcp.crossingkeyintelligence.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
capabilities.list ~55
FREE, read-only x402 capability list. Use this only for deterministic machine-commerce capabilities priced for x402 execution; it does not list the full CrossingKey offer/service catalog and never executes a capability. For public offers use offers.list.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
capability.get ~77
FREE, read-only x402 capability detail lookup. Supply the exact capability name returned by capabilities.list to receive one deterministic capability definition and advertised price; no payment or execution occurs. Use capability.quote when x402 challenge requirements are needed.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Exact deterministic x402 capability name returned by capabilities.list; 1-160 characters. |
No output schema declared.
No examples provided.
capability.quote ~82
FREE, read-only x402 quote/challenge lookup. Supply the exact capability name returned by capabilities.list to receive v1 and v2 payment requirements without execution or settlement. Use capability.get for metadata only and execution.preflight for the cross-domain authorization decision.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Exact deterministic x402 capability name returned by capabilities.list; 1-160 characters. |
No output schema declared.
No examples provided.
cost.estimate Estimate exact known cost ~79
FREE, read-only cross-domain price lookup. Supply an offer or capability identifier to return the currently advertised USD price or request-credit cost; no payment, reservation, or credit consumption occurs. For x402 challenge terms use capability.quote instead.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Exact offer or paid-capability identifier returned by discovery; 1-160 characters. |
No output schema declared.
No examples provided.
credits.options Get request-credit payment links ~53
FREE, read-only prepaid-credit purchase discovery. Returns available request-credit packs and their existing Stripe Payment Links; it does not open a checkout session or spend funds. Use this only when prepaid request credits are the intended payment rail.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
entitlement.inspect ~74
FREE, read-only entitlement inspection. Supply a CrossingKey entitlement identifier to return current entitlement state without granting execution, download access, or paid result content. Use purchase.status when only an idempotency key is available.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | CrossingKey entitlement identifier returned by a successful paid purchase; 1-200 characters. |
No output schema declared.
No examples provided.
execution.preflight Preflight an agent purchase or execution ~97
FREE, read-only final preflight before any paid action. Supply an offer or capability identifier to receive payment method, exact advertised price, readiness, safety warnings, and next action; this tool never charges or executes. Call it after discovery and requirement checks, not as a replacement for paid execution.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Exact offer or paid-capability identifier to evaluate immediately before payment or credit-consuming execution; 1-160 characters. |
No output schema declared.
No examples provided.
health ~52
FREE, read-only MCP readiness check. Returns service, Stripe, machine-commerce, mainnet-gate, and receiver-only wallet readiness flags without contacting payment rails or changing state. Use this for operational readiness, not purchase status.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
offers.list Discover CrossingKey offers ~139
FREE, read-only canonical offer search. Use this to find public digital or service offers by query, kind, or maximum USD price before payment; it returns metadata only and creates no checkout session. Use capability.get only for x402 capability detail; offer details are returned by offers.list.
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | – | Optional offer-kind filter: 'all', 'digital', or 'service'. Defaults to 'all'. |
| max_price_usd | number | – | Optional inclusive maximum advertised USD price, from 0 through 1000000. |
| query | string | – | Optional case-insensitive text search across public offer metadata; 1-160 characters. |
No output schema declared.
No examples provided.
payment.methods ~54
FREE, read-only payment-rail discovery. Returns supported Stripe, prepaid-credit, and x402 rails plus the receiver-only wallet authority boundary; it never signs or spends. Use this when selecting a payment rail before any authorization step.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
payment.verify Verify Base USDC payment on chain ~129
FREE, read-only Base USDC verification. Provide a Base transaction hash, a CrossingKey receipt ID, or both to verify the receiver transfer and optionally reconcile an existing receipt; it never signs, sends, settles, swaps, bridges, or spends funds. Use receipt.verify for local receipt integrity without chain lookup.
| Name | Type | Req | Description |
|---|---|---|---|
| receiptId | string | – | Optional CrossingKey receipt identifier beginning with ck_. Provide receiptId, txHash, or both. |
| txHash | string | – | Optional Base transaction hash in 0x-prefixed 32-byte hexadecimal form. Provide txHash, receiptId, or both. |
No output schema declared.
No examples provided.
provider.describe Discover CrossingKey Intelligence ~72
FREE, read-only provider discovery. Use this first to learn CrossingKey identity, commerce model, payment rails, authority boundaries, and recommended next actions; it never creates a payment or executes paid work. For offer-specific data use offers.list and capability.get, and for x402 terms use capability.get/capability.quote.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
purchase.status ~86
FREE, read-only x402 purchase-status lookup. Supply the original idempotency key to retrieve purchase state and integrity identifiers without revealing paid result content or changing state. The response includes purchase, entitlement, and result-integrity identifiers when available.
| Name | Type | Req | Description |
|---|---|---|---|
| idempotency_key | string | yes | Original client-generated idempotency key used for the paid x402 purchase; 8-160 characters. |
No output schema declared.
No examples provided.
receipt.verify ~77
FREE, read-only receipt integrity verification. Supply a CrossingKey receipt object to recompute and compare its deterministic result hash; this performs no payment, entitlement mutation, or network settlement. A true result verifies integrity only, not external payment finality.
| Name | Type | Req | Description |
|---|---|---|---|
| receipt | object | yes | Complete CrossingKey receipt object whose deterministic integrity binding should be recomputed. |
No output schema declared.
No examples provided.
requirements.check Check purchase or execution requirements ~78
FREE, read-only prerequisite check. Supply an offer or capability identifier to receive payment, authorization, fulfillment, and idempotency requirements without creating a payment. Use execution.preflight for the final machine-readable go/no-go decision.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Exact offer or paid-capability identifier whose prerequisites should be checked; 1-160 characters. |
No output schema declared.
No examples provided.
result.preview Preview result or fulfillment schema ~86
FREE, read-only result preview. Supply an offer or capability identifier to see the expected fulfillment or output shape without exposing paid content or executing work. Use this after offers.list or capabilities.list when an agent needs to evaluate the result contract before authorization.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Exact offer or paid-capability identifier whose result or fulfillment shape should be previewed; 1-160 characters. |
No output schema declared.
No examples provided.
services.list List paid request services ~49
FREE, read-only service catalog. Returns only request services explicitly approved by the server's safety process and may legitimately be empty; it creates no order or payment. Use this when evaluating approved request-service availability.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
xkey.validate Validate structured XKEY intake ~137
PAID bounded intake validation. Requires an authenticated prepaid-credit principal, an 8-160 character idempotency key, and 2-100000 characters of raw intake; one credit is committed only on verified success, while safe validation failures release the reservation. Do not call speculatively; use requirements.check and execution.preflight first.
| Name | Type | Req | Description |
|---|---|---|---|
| idempotency_key | string | yes | Unique client-generated key for safe retry/deduplication; 8-160 characters. Reuse only when retrying the same intake. |
| raw_intake | string | yes | Raw intake text to validate and normalize; 2-100000 characters. |
No output schema declared.
No examples provided.
What is the com.crossingkeyintelligence/crossingkey-mcp server?
com.crossingkeyintelligence/crossingkey-mcp is listed in the public MCP registry as com.crossingkeyintelligence/crossingkey-mcp. CrossingKey MCP for agent commerce, x402 payments, deterministic execution, and verifiable receipts. This page covers its hosted endpoint (https://mcp.crossingkeyintelligence.com/mcp).
Is the com.crossingkeyintelligence/crossingkey-mcp server safe to use?
com.crossingkeyintelligence/crossingkey-mcp scores 23 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.crossingkeyintelligence/crossingkey-mcp server expose?
com.crossingkeyintelligence/crossingkey-mcp exposes 18 tools: provider.describe, offers.list, cost.estimate, result.preview, requirements.check, and 13 more. Their descriptions and schemas cost roughly 1,476 tokens of context every time the server is loaded.
Does the com.crossingkeyintelligence/crossingkey-mcp server require authentication?
No. We connected to com.crossingkeyintelligence/crossingkey-mcp without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the com.crossingkeyintelligence/crossingkey-mcp server still maintained?
com.crossingkeyintelligence/crossingkey-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.