# com.obsmetrics.paygent/agents (remote · paygent.obsmetrics.com)

Pay-per-call safety guards for AI agents: injection, tool-call, signing, secret, x402-trust.

- Trust score: 60/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- remote · `paygent.obsmetrics.com`: 60/100 (this document), [markdown](https://verifymcp.io/servers/com-obsmetrics-paygent-agents/paygent.md), [page](https://verifymcp.io/servers/com-obsmetrics-paygent-agents/paygent)

## Channel facts

- Endpoint: `https://paygent.obsmetrics.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.0.8`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 7 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 34/100
  - AI-judged instruction clarity (fair).
  - Context-footprint check failed: tool/resource definitions use about 1589 tokens (~227/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http com-obsmetrics-paygent-agents https://paygent.obsmetrics.com/mcp
```

### Codex

```toml
[mcp_servers.com-obsmetrics-paygent-agents]
url = "https://paygent.obsmetrics.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-obsmetrics-paygent-agents": {
      "type": "remote",
      "url": "https://paygent.obsmetrics.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-obsmetrics-paygent-agents --url https://paygent.obsmetrics.com/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-obsmetrics-paygent-agents:
    url: "https://paygent.obsmetrics.com/mcp"
```

### Other

```json
{
  "mcpServers": {
    "com-obsmetrics-paygent-agents": {
      "type": "http",
      "url": "https://paygent.obsmetrics.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 60, +2)

- [security improvement] HSTS header: unverified → pass
- [security improvement] Transport: fail → pass
- [security] Authorization: Authorisation not fully verified: no authorisation is required to call this server, and 7 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
- [functional regression] MCP protocol: unverified → fail
- [functional improvement] Endpoint reachability: unreachable → reachable
- [functional improvement] Stability: unverified → 0.30
- [functional improvement] Tool coverage: unverified → 100

### 2026-08-02 (score 58, 0)

- [security regression] Endpoint reachability: reachable → unreachable
- [security regression] HSTS header: pass → unverified
- [security regression] Stability: 0.20 → unverified
- [security regression] Transport: pass → fail
- [security] Authorization: Authorisation not yet verified: we couldn't confirm whether this endpoint requires it.
- [functional regression] Capabilities: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-31 (score 58, +3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 55, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 56, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 55, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 54)

First indexed and scored.

## MCP tools (7)

### `secure-code-review` (~84 tokens)

Security review of a code snippet or diff. Returns structured findings (severity, CWE, location, remediation). [security; up to 75c/call]

Input parameters:

- `code` (string, required): Source code or unified diff to review
- `context` (string): Optional context about the code
- `language` (string): Language hint, e.g. typescript, python

### `pr-summary` (~62 tokens)

Turn a git diff into a clear PR description or release notes. [dev-tools; up to 30c/call]

Input parameters:

- `diff` (string, required): Unified git diff to summarise
- `style` (string): e.g. conventional, changelog, executive

### `x402-trust-audit` (~334 tokens)

Vet an x402 counterparty before settling USDC: scores the advertised payment requirements AND (when supplied) the EIP-3009 authorization you are about to sign. Returns a machine-enforceable trust verdict (per-entry scores, coverage-honest trustScore, spend-constraint + tamper-evident fingerprint) for buyer agents and wallet/spend-policy layers. No endpoint fetch. [security; up to 200c/call]

Input parameters:

- `context` (string): Optional free-form context.
- `endpointUrl` (string): Resource URL being paid (context only; never fetched).
- `expected` (object): Optional caller expectations.
- `paymentPayload`: The UNSIGNED EIP-3009 authorization the buyer is about to sign: { authorization|message: {from,to,value,validAfter,validBefore,nonce}, domain: {name,version,chainId,verifyingContract} }. Lets the aud…
- `paymentRequirements` (required): The x402 payment requirements from the counterparty: the 402 `accepts` array, or a single object.
- `selectedOptionIndex` (number): Index in the accepts array the buyer intends to settle (default 0). The verdict is scoped to it.
- `serverMetadata`: Optional server metadata the caller already holds (context only; not fetched).
- `spendPolicy` (object): Optional buyer spend policy to evaluate against and to pin facilitators.

### `sign-guard` (~327 tokens)

Pre-sign safety oracle for agent wallets: submit the transaction or EIP-712 message you are about to sign and get a machine-enforceable verdict. Decodes the calldata/typed-data, flags the drainer toolkit (unlimited approvals, setApprovalForAll, permit/permit2 + EIP-3009 to an unexpected party, transferFrom draining an unnamed account, ownership transfer, raw ETH to a stranger), and binds the decoded action to your stated intent - only a fully pinned, clean action is auto-sign-safe. Fails closed: an undecodable on-chain call is cautioned and an unrecognized off-chain signature grant is blocked. Deterministic, sub-second, no endpoint fetch. It vouches that the action matches what you said; it does NOT vouch that a counterparty is trustworthy. [security; up to 200c/call]

Input parameters:

- `context` (string): Optional free-form context.
- `expected` (object): Your stated intent. Supplying it lets the verdict BIND the action; only a fully bound, clean action is auto-sign-safe. For an allowance, you MUST supply maxAmount; for a transferFrom, supply `from`.
- `spendPolicy` (object): Optional buyer spend policy (context only).
- `tx` (object): An EVM transaction you are about to sign.
- `typedData` (object): An EIP-712 message you are about to sign (the off-chain drainer surface: permit, Permit2, EIP-3009). { domain, types, primaryType, message }.

### `inject-guard` (~221 tokens)

Untrusted-content guardrail for agents: submit a blob of text you are about to feed to your own LLM (scraped web content, a tool result, another agent's message) and get a machine-enforceable verdict - is this a prompt-injection / jailbreak / data-exfiltration / tool-hijack attempt? Returns a risk level, the detected classes with spans, the unicode obfuscation it found (zero-width, bidi-override, tag-chars, homoglyphs), and a SANITIZED copy safe to feed onward. Hybrid: a deterministic, uninjectable pattern engine (authoritative) plus an LLM classifier that can only raise the risk, never clear a flag. Detection of known injection classes - not a proof of safety. [security; up to 15c/call]

Input parameters:

- `content` (string, required): The untrusted text to scan before you feed it to your LLM.
- `context` (string): Optional: where the content came from (url, tool name, sender) - context only.

### `tool-call-guard` (~295 tokens)

Pre-execution safety oracle for agent actions: submit the tool call you are about to run (shell, http, sql, file, code, env) plus your stated intent, and get a machine-enforceable verdict before you execute it. Decodes what the call does, flags the danger toolkit (rm -rf, reverse shell, curl|sh, SSRF to cloud metadata, credential reads, DROP/DELETE-without-WHERE, path traversal, dynamic eval), and binds it to your intent (allowedHosts/allowedPaths/readOnly/noNetwork) - only a fully pinned, clean, intent-matched call is auto-exec-safe. Hybrid: a deterministic, uninjectable detector engine (authoritative) plus an LLM classifier that can only raise the risk. Fails closed. Detection of known-dangerous patterns, not a proof of safety; it never executes the call. [security; up to 8c/call]

Input parameters:

- `call` (object, required): The tool call you are about to execute.
- `context` (string): Optional: where the task/input came from (untrusted source label).
- `expected` (object): Machine-checkable constraints. Supplying them lets the verdict BIND the call; only a positively-scoped, satisfied call is auto-exec-safe.
- `intent` (string): What this call is for (natural language). Used by the classifier for intent-mismatch.

### `secret-scan` (~222 tokens)

Leaked-credential guardrail for agents: submit a blob you are about to commit, log, post, or hand to another tool (a diff, a config, an .env, an LLM output) and get a machine-enforceable verdict - does it contain a live secret? Detects cloud keys (AWS), VCS tokens (GitHub/GitLab), provider API keys (Stripe, OpenAI, Anthropic, Google, Slack), private-key blocks, JWTs, and credentials embedded in URLs, plus high-entropy key=value assignments. Returns a risk level, the detected classes with a MASKED locator (never the secret itself, so the verdict cannot re-leak), and a REDACTED copy safe to emit onward. Deterministic, sub-second, never fetches. Detection of known secret formats - not a proof of cleanliness. [security; up to 200c/call]

Input parameters:

- `content` (string, required): The text to scan for leaked secrets (diff, config, .env, log line, LLM output).

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-obsmetrics-paygent-agents/paygent#diagnostics

## Score history

- 2026-08-04: 60
- 2026-08-03: 58
- 2026-08-02: 58
- 2026-08-01: 58
- 2026-07-31: 58
- 2026-07-30: 55
- 2026-07-29: 56
- 2026-07-28: 56
- 2026-07-27: 55
- 2026-07-26: 54

## Links

- Remote endpoint: https://paygent.obsmetrics.com/mcp
- Website: https://paygent.obsmetrics.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-obsmetrics-paygent-agents/paygent/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-obsmetrics-paygent-agents/paygent/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-obsmetrics-paygent-agents/paygent