SpendShield
PYPI · SPENDSHIELD · SCANNED SEP 20
Authorization layer between AI agents and money: ALLOW/APPROVAL/DENY, budgets, audit.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 0 of 5 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 17 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability78
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1193 tokens (~70/item across 17 items; 17 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management60
- Stability observed for 18 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage96
- 94% of tools have a non-trivial description (not blank, and not just the tool's name).Partial
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities20
- Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail
How do I install the SpendShield MCP server?
SpendShield runs locally as a PyPI package, launched with uvx spendshield. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · spendshield
claude mcp add felixpg13-glitch-spendshield -- uvx spendshield
{
"mcpServers": {
"felixpg13-glitch-spendshield": {
"command": "uvx",
"args": [
"spendshield"
]
}
}
} {
"servers": {
"felixpg13-glitch-spendshield": {
"command": "uvx",
"args": [
"spendshield"
]
}
}
} codex mcp add felixpg13-glitch-spendshield -- uvx spendshield
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"felixpg13-glitch-spendshield": {
"type": "local",
"command": [
"uvx",
"spendshield"
],
"enabled": true
}
}
} openclaw mcp add felixpg13-glitch-spendshield --command uvx --arg spendshield
mcp_servers:
felixpg13-glitch-spendshield:
command: "uvx"
args: ["spendshield"] {
"McpServers": {
"felixpg13-glitch-spendshield": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"spendshield"
]
}
}
} assistant mcp add felixpg13-glitch-spendshield -t stdio -c uvx -a spendshield
{
"mcpServers": {
"felixpg13-glitch-spendshield": {
"command": "uvx",
"args": [
"spendshield"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +4
- Stability: unverified → 0.27 ▲ functional
- 2 Sept 26 53
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/spendshield@0.8.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 5 packages
| Packages resolved | 5 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
authorize_payment ~166
SpendShield 授权入口(契约 v1): 在付款前判断一笔资金请求。输入 recipient/amount/purpose/agent_id; 返回 status(ALLOW/APPROVAL/DENY) + decision_id + policy_version + 结构化 reason(code/message/current_usage/requested)。ALLOW=可付款; APPROVAL=需人工审批(用 decision_id 调 spend_approve); DENY=拒绝
| Name | Type | Req | Description |
|---|---|---|---|
| agent_id | string | – | 调用方 Agent 身份 ID(匿名可省) |
| amount | number | yes | 金额 |
| purpose | string | – | 用途说明(审计可读, 如 '订阅续费' '下单') |
| recipient | string | yes | 收款方(商户/地址/账号) |
No output schema declared.
No examples provided.
policy_apply ~73
应用/更新策略(宿主管理工具, 仅限受信调用者)。传 policy JSON 生效新规则;无参数返回当前策略摘要。策略变更会审计留痕
| Name | Type | Req | Description |
|---|---|---|---|
| policy | string | – | V2 policy JSON(可选, 省略=查当前) |
No output schema declared.
No examples provided.
policy_create ~71
0.8 生命周期: 创建策略草稿(状态=CREATED)。草稿须走 validate/simulate/scan/review 才能 apply
| Name | Type | Req | Description |
|---|---|---|---|
| by | string | – | 操作者 |
| name | string | yes | 草稿名 |
| policy | string | yes | V2 policy JSON |
No output schema declared.
No examples provided.
policy_lifecycle_apply ~61
0.8 生命周期: 上线草稿(必须 REVIEWED)。Apply 是危险边界, 不可跳过评审
| Name | Type | Req | Description |
|---|---|---|---|
| by | string | – | 操作者 |
| draft_id | string | yes | policy_create 返回的 draft_id |
No output schema declared.
No examples provided.
policy_review ~73
0.8 生命周期: 人工评审草稿(必须指定审批人)。scan 有 blocker 时无法通过
| Name | Type | Req | Description |
|---|---|---|---|
| approve | boolean | – | 是否批准, 默认 true |
| by | string | yes | 审批人(必填) |
| draft_id | string | yes | policy_create 返回的 draft_id |
No output schema declared.
No examples provided.
policy_rollback ~41
0.8 生命周期: 回滚到历史版本
| Name | Type | Req | Description |
|---|---|---|---|
| by | string | – | 操作者 |
| version | string | yes | 目标版本号 |
No output schema declared.
No examples provided.
policy_sim ~103
花钱前模拟(不真花): 评估单笔或金额扫描, 返回决策+命中规则。Agent 在发起支付前先问'这单会不会被拦'
| Name | Type | Req | Description |
|---|---|---|---|
| agent | string | – | Agent 身份 ID |
| amount | number | – | 单笔金额(与 amounts 二选一) |
| amounts | array | – | 金额扫描列表(找边界) |
| to | string | yes | 收款方 |
No output schema declared.
No examples provided.
policy_stage ~61
0.8 生命周期: 一键验证草稿(validate+simulate+scan)。返回校验结果/模拟决策/安全扫描发现
| Name | Type | Req | Description |
|---|---|---|---|
| by | string | – | 操作者 |
| draft_id | string | yes | policy_create 返回的 draft_id |
No output schema declared.
No examples provided.
policy_versions ~24
0.8 生命周期: 列出所有版本(含操作者)
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
secret_get ~74
从密钥保险库取密钥(过身份+审批闸门, 留审计)。密钥名视为收款方, 可加白名单免问
| Name | Type | Req | Description |
|---|---|---|---|
| agent | string | yes | 调用方 Agent 身份 ID |
| name | string | yes | 密钥名(如 mcd_sk) |
No output schema declared.
No examples provided.
spend_approve ~62
批准一笔挂起审批(APPROVAL 状态)。批准后重新评估, 返回最终决策
| Name | Type | Req | Description |
|---|---|---|---|
| approval_id | string | yes | spend_authorize 返回的 approval_id |
| by | string | – | 批准人标识 |
No output schema declared.
No examples provided.
spend_audit ~31
最近审计记录(最多 N 条)
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | 条数, 默认 10 |
No output schema declared.
No examples provided.
spend_authorize ~124
V2 授权入口: 返回三态决策 ALLOW/DENY/APPROVAL + 命中规则(RuleHit 结构化)。ALLOW=可付款; APPROVAL=需人工审批(拿 approval_id 调 spend_approve); DENY=拒绝
| Name | Type | Req | Description |
|---|---|---|---|
| agent | string | – | Agent 身份 ID(匿名可省) |
| amount | number | yes | 金额 |
| meta | object | – | 附加上下文(可带 idempotency_key 防重放) |
| to | string | yes | 收款方 |
No output schema declared.
No examples provided.
spend_protect ~128
保护一次花钱操作。走干跑/预算/黑名单/白名单/频率/单次上限闸门。通过返回 ok=true; 被拦返回 ok=false + reason
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | 操作名, 如 下单/转账/充值 |
| agent | string | – | 调用方 Agent 身份 ID(未注册默认拒绝, 建议必填) |
| amount | number | yes | 金额(元) |
| to | string | yes | 收款方, 如 麦当劳/xxx@example.com |
No output schema declared.
No examples provided.
spend_reject ~46
拒绝一笔挂起审批
| Name | Type | Req | Description |
|---|---|---|---|
| approval_id | string | yes | spend_authorize 返回的 approval_id |
| by | string | – | 拒绝人标识 |
No output schema declared.
No examples provided.
spend_reset ~27
重置本次会话已花金额(新会话/换预算时用)
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
spend_status ~28
查询当前护栏状态: 预算/已花/剩余/拦截统计
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the SpendShield MCP server?
SpendShield is an MCP server listed in the public MCP registry as io.github.felixpg13-glitch/spendshield. Authorization layer between AI agents and money: ALLOW/APPROVAL/DENY, budgets, audit. This page covers its PyPI package (spendshield).
Is the SpendShield MCP server safe to use?
SpendShield scores 62 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SpendShield MCP server expose?
SpendShield exposes 17 tools: spend_protect, spend_status, spend_audit, spend_reset, secret_get, and 12 more. Their descriptions and schemas cost roughly 1,193 tokens of context every time the server is loaded.
Is the SpendShield MCP server still maintained?
SpendShield is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the SpendShield MCP server under?
SpendShield declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.