# AgentLedger (remote · aiagentscity.com)

Meter, cap, and block AI agent spend before the provider is charged.

- Trust score: 68/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- remote · `aiagentscity.com`: 68/100 (this document), [markdown](https://verifymcp.io/servers/entradox-agent-ledger/aiagentscity.md), [page](https://verifymcp.io/servers/entradox-agent-ledger/aiagentscity)

## Channel facts

- Endpoint: `https://aiagentscity.com/mcp/`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.4.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (ledger_rotate_secret).
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 81/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1892 tokens (~145/item across 13 items; 12 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 20/100
  - Stability observed for 6 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 96/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 87% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the AgentLedger MCP server?

AgentLedger is a hosted endpoint at https://aiagentscity.com/mcp/, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http entradox-agent-ledger 'https://aiagentscity.com/mcp/'
```

### Cursor

```json
{
  "mcpServers": {
    "entradox-agent-ledger": {
      "url": "https://aiagentscity.com/mcp/"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "entradox-agent-ledger": {
      "type": "http",
      "url": "https://aiagentscity.com/mcp/"
    }
  }
}
```

### Codex

```toml
[mcp_servers.entradox-agent-ledger]
url = "https://aiagentscity.com/mcp/"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "entradox-agent-ledger": {
      "type": "remote",
      "url": "https://aiagentscity.com/mcp/",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add entradox-agent-ledger --url 'https://aiagentscity.com/mcp/' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  entradox-agent-ledger:
    url: "https://aiagentscity.com/mcp/"
```

### Netclaw

```json
{
  "McpServers": {
    "entradox-agent-ledger": {
      "Transport": "http",
      "Url": "https://aiagentscity.com/mcp/"
    }
  }
}
```

### Vellum

```bash
assistant mcp add entradox-agent-ledger -t streamable-http -u 'https://aiagentscity.com/mcp/'
```

### Other

```json
{
  "mcpServers": {
    "entradox-agent-ledger": {
      "type": "http",
      "url": "https://aiagentscity.com/mcp/"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-19 (score 67, 0)

- [functional regression] Schema quality: 1638 → 1892
- [functional] Schema quality: good → excellent
- [functional] New tool “ledger_start”

### 2026-09-18 (score 67, +1)

- [functional] Server version: 4.0.3 → 4.0.5

### 2026-09-17 (score 66, +2)

- [functional] First check of Schema quality: 100
- [functional] Schema quality: excellent → good
- [functional] New resource “agent-ledger”

### 2026-09-15 (score 64, +1)

- [functional improvement] Schema quality: 161 → 141
- [functional improvement] Stability: unverified → 0.03
- [functional] Schema quality: good → excellent
- [functional] New tool “skills_list_tool”
- [functional] New tool “read_skill”

### 2026-09-14 (score 63)

First indexed and scored.

## MCP tools (12)

### `ledger_rotate_secret` (~160 tokens)

Rotate Agent Secret

Mint a NEW agent_secret for an agent_id your workspace already owns, invalidating the old one.

Use this to RECOVER an agent whose secret was lost: the previous credential
stops working immediately. Requires the workspace_key that owns agent_id —
an agent's own agent_secret cannot rotate itself, because a leaked agent
credential must not be able to lock its real owner out. Unlike ledger_track
this never claims a new agent_id: an unknown id returns agent_not_claimed.

The new secret is returned ONCE. Store it before you drop the response.

Returns {"agent_id", "agent_secret", "_note"}, or {"error", "error_code"}.

Input parameters:

- `agent_id` (string, required)
- `workspace_key` (string, required)

### `ledger_revoke_secret` (~129 tokens)

Revoke Agent Secret

Invalidate an agent_id's agent_secret WITHOUT deleting its spend history.

Use when a credential may have leaked, or to stop an agent writing.
Subsequent writes to that agent fail with agent_secret_mismatch until you
rotate a new secret in. The agent_id stays claimed, so no other workspace
can claim it and inherit the ledger. Requires the workspace_key that owns
agent_id.

Returns {"agent_id", "revoked": True, "_note"}, or {"error", "error_code"}.

Input parameters:

- `agent_id` (string, required)
- `workspace_key` (string, required)

### `ledger_track` (~383 tokens)

Track Agent Spend

Record a spend entry for an AI agent on any payment rail, with optional token counts.

Claiming a brand-new agent_id requires your workspace_key (get one via
x402 at POST /v1/billing/x402 — no human, no login — or at /start).
That first call mints an
agent_secret and returns it in the response — save it, every later call
for that same agent_id must pass it back (no workspace_key needed again)
or the write is rejected. Amounts are capped
at $100,000/entry and must be >= 0. If a budget is set for this agent,
an entry that would cross the monthly/daily cap is blocked, not just
logged. Include tokens_in/tokens_out + model on every LLM call so token
burn shows up in the /v1/tokens report.

Input parameters:

- `agent_id` (string, required): unique agent identifier (e.g. "research-agent-v2")
- `agent_secret` (string): required for every call after the first for this agent_id
- `amount_cents` (integer, required): spend amount in cents (100 = $1.00), 0-10000000
- `model` (string): model name (e.g. "gpt-4o") — token burn is reported per model
- `rail` (string, required): payment rail used — one of "mpp", "x402", "api_key", "manual"
- `service` (string, required): what was purchased (e.g. "search_query", "data_export")
- `tokens_in` (integer): prompt tokens consumed (0 if unknown)
- `tokens_out` (integer): completion tokens consumed (0 if unknown)
- `workspace_key` (string): required when claiming a brand-new agent_id; not            needed once the agent_id has been claimed

### `ledger_set_budget` (~304 tokens)

Set Agent Budget

Set spending caps for an agent. Warns at 80%, blocks spend when exceeded
— enforced: a ledger_track call that would cross the cap is rejected.

Dollar caps (monthly_cents/daily_cents) and token caps (monthly_tokens/
daily_tokens) are independent dimensions: dollar caps only cover
non-"tokens" rails, token caps only cover rail="tokens" bookkeeping rows
(tokens_in/tokens_out). Set both if the agent uses both.

Monthly cap is required; the rest are optional (0 = no limit).
Overwrites any existing budget for the agent. Claiming a brand-new
agent_id requires your workspace_key; that first call mints an
agent_secret (returned once — save it); later calls for that agent_id
must pass the agent_secret back (no workspace_key needed again).

Input parameters:

- `agent_id` (string, required): unique agent identifier
- `agent_secret` (string): required for every call after the first for this agent_id
- `daily_cents` (integer): daily spending cap in cents (0 = no daily cap)
- `daily_tokens` (integer): daily token-burn cap (0 = no cap)
- `monthly_cents` (integer, required): monthly spending cap in cents
- `monthly_tokens` (integer): monthly token-burn cap (0 = no cap)
- `workspace_key` (string): required when claiming a brand-new agent_id; not            needed once the agent_id has been claimed

### `ledger_report` (~137 tokens)

Agent Spend Report

Spend report for an agent over a rolling window.

Returns total spend, breakdown by rail and by service, budget status
(ok/warning/exceeded), detected anomalies, and entry count.

Requires a credential: either the agent's own agent_secret or its
workspace's workspace_key (same rule as GET /v1/report).

Input parameters:

- `agent_id` (string, required): unique agent identifier
- `agent_secret` (string): the agent's own secret (either this or workspace_key)
- `days` (integer): report window in days (default 30)
- `workspace_key` (string): the owning workspace's key (either this or agent_secret)

### `ledger_alerts` (~104 tokens)

Agent Budget Alerts

Alert history for an agent: budget warnings (80% threshold) and spending spikes.

Requires a credential: either the agent's own agent_secret or its
workspace's workspace_key (same rule as GET /v1/alerts).

Input parameters:

- `agent_id` (string, required): unique agent identifier
- `agent_secret` (string): the agent's own secret (either this or workspace_key)
- `workspace_key` (string): the owning workspace's key (either this or agent_secret)

### `ledger_list_agents` (~89 tokens)

List Tracked Agents

Owner-only: full cross-tenant listing of every agent ever claimed on
this instance, with totals. Requires the operator's admin_secret — this
is a portfolio-wide view, not a per-agent report (use ledger_report for
that — it requires that agent's agent_secret or its workspace_key).

Input parameters:

- `admin_secret` (string): operator admin secret (not the same as an agent_secret)

### `ledger_start` (~254 tokens)

Start a Workspace

Get a FREE AgentLedger workspace with no credential and no arguments —
the MCP equivalent of opening POST /start in a browser.

Call this FIRST if you have no credentials yet. Every other tool here
(ledger_track, ledger_set_budget, ledger_report, ledger_alerts) needs a
workspace_key or an agent_secret, so a caller arriving with neither must
start here or it has nowhere to go.

Takes NO arguments on purpose: the goal is zero friction. It returns a
\`workspace_key` (shown exactly once — it cannot be re-revealed, so store it
before continuing) which you then send as `workspace_key` on your first
ledger_track for a NEW agent_id. That first write returns the agent's own
\`agent_secret`, which authenticates every write after it.

The free tier includes every rail, enforced budget caps, alerts, reports and
the MCP server, capped at 3 agents per workspace. Minting is rate-limited
per caller IP, the same limit the human door uses.

Prefer to pay? POST /v1/billing/x402 with a wallet-signed payment needs no
human and buys 24h of Pro (unlimited agents).

### `ledger_api_docs` (~97 tokens)

AgentLedger API Docs

Self-serve documentation for AgentLedger — quickstart, MCP tools, REST
endpoints, budget caps, error codes, and idempotency usage, as markdown.

Input parameters:

- `topic` (string): "quickstart" | "mcp" | "rest" | "budget" | "errors" | "idempotency" | "all"    (default "" == "all"). Unknown topics fall back to the full docs.

### `ledger_examples` (~51 tokens)

AgentLedger Recipes

Complete, runnable Python recipe for a common AgentLedger integration
pattern.

Input parameters:

- `pattern` (string, required): "python_tracking" | "budget_enforcement" | "weekly_report" |      "retry_safe_writes"

### `skills_list_tool` (~51 tokens)

Skills List Tool

List this product's skills. Each entry carries the SKILL.md URI,
its name and description, verbatim frontmatter, and a per-file
sha256 manifest. Read a body with `read_skill`.

### `read_skill` (~50 tokens)

Read Skill

Read a product skill file by its skill:// URI.

Input parameters:

- `uri` (string, required): e.g. skill://<product>/<skill-name>/SKILL.md  Get valid URIs from `skills_list_tool`.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/entradox-agent-ledger/aiagentscity#diagnostics

## Score history

- 2026-09-20: 68
- 2026-09-19: 67
- 2026-09-18: 67
- 2026-09-17: 66
- 2026-09-16: 64
- 2026-09-15: 64
- 2026-09-14: 63

## Common questions

### What is the AgentLedger MCP server?

AgentLedger is an MCP server listed in the public MCP registry as io.github.entradox/agent-ledger. Meter, cap, and block AI agent spend before the provider is charged. This page covers its hosted endpoint (https://aiagentscity.com/mcp/).

### Is the AgentLedger MCP server safe to use?

AgentLedger scores 68 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the AgentLedger MCP server expose?

AgentLedger exposes 12 tools: ledger_rotate_secret, ledger_revoke_secret, ledger_track, ledger_set_budget, ledger_report, and 7 more. Their descriptions and schemas cost roughly 1,809 tokens of context every time the server is loaded.

### Does the AgentLedger MCP server require authentication?

No. We connected to AgentLedger without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the AgentLedger MCP server still maintained?

AgentLedger is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://aiagentscity.com/mcp/
- Repository: https://github.com/entradox/agent-ledger
- Website: https://aiagentscity.com/
- Changelog RSS feed: https://verifymcp.io/servers/entradox-agent-ledger/aiagentscity.xml
- Changelog JSON feed: https://verifymcp.io/servers/entradox-agent-ledger/aiagentscity.json
- HTML version of this page: https://verifymcp.io/servers/entradox-agent-ledger/aiagentscity