# MandateShield AI Payment Evidence (remote · mandateshield.com)

Analyzes delegated AI payment authority and exposes supported Stripe/x402 evidence contracts.

- Trust score: 71/100 (medium)
- Change this week: +8
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `mandateshield.com`: 71/100 (this document), [markdown](https://verifymcp.io/servers/com-mandateshield-payment-authority/api-mcp.md), [page](https://verifymcp.io/servers/com-mandateshield-payment-authority/api-mcp)

## Channel facts

- Endpoint: `https://mandateshield.com/api/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.13.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 80/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 58/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (poor).
  - Context-footprint check failed: tool/resource definitions use about 1466 tokens (~122/item across 12 items; 3 tools + 9 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 87/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 56% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).
  - Supports UI / widget rendering.

## Install

### Claude

```bash
claude mcp add --transport http com-mandateshield-payment-authority https://mandateshield.com/api/mcp
```

### Codex

```toml
[mcp_servers.com-mandateshield-payment-authority]
url = "https://mandateshield.com/api/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-mandateshield-payment-authority": {
      "type": "remote",
      "url": "https://mandateshield.com/api/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-mandateshield-payment-authority --url https://mandateshield.com/api/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-mandateshield-payment-authority:
    url: "https://mandateshield.com/api/mcp"
```

### Other

```json
{
  "mcpServers": {
    "com-mandateshield-payment-authority": {
      "type": "http",
      "url": "https://mandateshield.com/api/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-01 (score 70, +4)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 66, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 13. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-28 (score 64, +1)

- [functional] Server version: 1.10.0 → 1.11.0

### 2026-07-27 (score 63, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 63)

First indexed and scored.

## MCP tools (3)

### `check_ai_payment_authority` (~408 tokens)

Check AI Payment Authority

Use before an AI agent buys, subscribes, transfers value, calls a metered API, or accesses a paid resource when the user wants a payment-authority check. Analyze whether the proposed purchase fits supplied policy facts. This v1 entry check is non-executable and always returns enforcement_authorized=false; use the strict cryptographic tool for a production gate. Never send payment credentials or private keys.

Input parameters:

- `agent_id` (string, required): Stable identifier for the acting AI agent.
- `amount` (object, required)
- `asset_id` (string): Exact token or asset identifier; required for atomic X402 payments.
- `checkout_hash` (string): Digest or stable identifier for the exact final checkout.
- `created_at` (string)
- `credential_binding` (string)
- `expires_at` (string)
- `http_request` (object): Optional signed HTTP action projection used by the narrow first-party x402 v2 exact/EIP-3009 Gate adapter.
- `idempotency_key` (string, required): Unique identifier for this intended payment attempt.
- `intent_hash` (string)
- `limits` (object): Sandbox analysis policy. Live v2 ignores caller policy and loads the registered mandate.
- `mandate_id` (string, required): Stable identifier for the user-approved authority.
- `merchant_id` (string, required): Stable identifier for the final seller or payee.
- `network` (string): Exact network or chain identifier; required for atomic X402 payments.
- `payee_identity` (object): Versioned canonical payee identity bound into the signed purchase envelope. The model records exact provider identifiers and verification evidence; it does not independently validate an external regi…
- `protocol` (string, required): Source protocol or CUSTOM for a normalized envelope.
- `purpose` (string): Non-sensitive plain-language purchase purpose.
- `resource` (string): Exact paid resource identifier; required for atomic X402 payments.
- `user_consent` (boolean)

Output parameters:

- `checked_at` (string)
- `controls` (object)
- `decision` (string)
- `enforcement_authorized` (boolean): True only when strict live verification durably creates a trusted, consumable execution reservation. It never permits a direct provider call.
- `error` (string)
- `findings` (array)
- `mode` (string)
- `persisted` (boolean)
- `protocol` (string)
- `receipt` (string)
- `recommended_action` (string)
- `risk` (object)
- `score` (integer): Deterministic control-coverage indicator, not a calibrated probability of fraud or loss.

### `normalize_agent_payment_protocol` (~193 tokens)

Project Agent Payment Fields

Use when an agent encounters an AP2 terminal closed-payment projection, x402 v2 PAYMENT-REQUIRED offer, or explicitly profiled MPP Payment challenge and needs the supported fields projected before an authority check. Map those documented fields into a deterministic MandateShield purchase envelope. X402 requires source-matched network+payTo identity and MPP requires source-matched HTTPS service-origin+method identity; merchant_id alone is insufficient. Evidence references are not independently verified. projection_fields_valid is not full protocol conformance: this tool never verifies delegated authority or a payment credential and always returns enforcement_authorized=false under assurance.

Input parameters:

- `adapter` (string, required)
- `context` (object, required)
- `selection` (object)
- `source` (required): Raw protocol input: AP2 compact SD-JWT, x402 PAYMENT-REQUIRED base64 JSON, MPP WWW-Authenticate Payment challenge, or the documented decoded object.

Output parameters:

- `adapter` (string)
- `adapter_version` (string)
- `assurance` (object)
- `envelope` (object)
- `envelope_digest` (string)
- `next_step` (string)
- `protocol` (string)
- `source_digest` (string)
- `warnings` (array)

### `verify_cryptographic_payment_authority` (~183 tokens)

Verify Cryptographic Payment Authority

Use only for a production pre-payment authority gate after the caller has a registered mandate, pinned issuer key, fresh challenge, VERIFY-scoped key, exact final purchase and supported signed evidence. Fail closed for JWS, an AP2-shaped closed-payment SD-JWT projection with RFC 9901 KB-JWT, or normalized TAP-shaped RFC 9421-style evidence. Full AP2 checkout/delegate-chain and Visa TAP structured-field/trust-store processing remain external. A qualifying live ALLOW creates only a short RESERVED authorization and cumulative-budget allocation. This MCP tool never executes payment and exposes no processor transition: a separate trusted gateway with an audience-bound PROCESSOR key must CONSUME and freshly redeem the provider-bound permit before attempting an idempotent provider operation, then reconcile the outcome.

Input parameters:

- `envelope` (object, required)
- `evidence` (object, required)

Output parameters:

- `assurance` (object)
- `checked_at` (string)
- `controls` (object)
- `decision` (string)
- `enforcement_authorized` (boolean): True only when strict live verification durably creates a trusted, consumable execution reservation. It never permits a direct provider call.
- `error` (string)
- `execution_authorization` (object)
- `findings` (array)
- `mode` (string)
- `persisted` (boolean)
- `protocol` (string)
- `receipt` (string)
- `recommended_action` (string)
- `risk` (object)
- `score` (integer): Deterministic control-coverage indicator, not a calibrated probability of fraud or loss.
- `signed_receipt` (object)
- `transparency` (object)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-mandateshield-payment-authority/api-mcp#diagnostics

## Score history

- 2026-08-03: 71
- 2026-08-02: 71
- 2026-08-01: 70
- 2026-07-31: 66
- 2026-07-30: 65
- 2026-07-28: 64
- 2026-07-27: 63
- 2026-07-26: 63

## Links

- Remote endpoint: https://mandateshield.com/api/mcp
- Website: https://mandateshield.com/connect
- Changelog RSS feed: https://verifymcp.io/servers/com-mandateshield-payment-authority/api-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-mandateshield-payment-authority/api-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-mandateshield-payment-authority/api-mcp