# SpendShield (pypi · spendshield)

Authorization layer between AI agents and money: ALLOW/APPROVAL/DENY, budgets, audit.

- Trust score: 62/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- pypi · `spendshield`: 62/100 (this document), [markdown](https://verifymcp.io/servers/felixpg13-glitch-spendshield/spendshield.md), [page](https://verifymcp.io/servers/felixpg13-glitch-spendshield/spendshield)

## Channel facts

- Registry: `pypi`
- Package: `spendshield`
- Version: `0.8.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Supply Chain Security**: 50/100
  - Malware scan not yet available for this package.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it.
  - 0 of 5 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 17 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 78/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1193 tokens (~70/item across 17 items; 17 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 60/100
  - Stability observed for 18 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 96/100
  - 94% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

## Install

### How do I install the SpendShield MCP server?

SpendShield runs locally as a PyPI package, launched with uvx spendshield. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add felixpg13-glitch-spendshield -- uvx spendshield
```

### Cursor

```json
{
  "mcpServers": {
    "felixpg13-glitch-spendshield": {
      "command": "uvx",
      "args": [
        "spendshield"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "felixpg13-glitch-spendshield": {
      "command": "uvx",
      "args": [
        "spendshield"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add felixpg13-glitch-spendshield -- uvx spendshield
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "felixpg13-glitch-spendshield": {
      "type": "local",
      "command": [
        "uvx",
        "spendshield"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add felixpg13-glitch-spendshield --command uvx --arg spendshield
```

### Hermes

```yaml
mcp_servers:
  felixpg13-glitch-spendshield:
    command: "uvx"
    args: ["spendshield"]
```

### Netclaw

```json
{
  "McpServers": {
    "felixpg13-glitch-spendshield": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "spendshield"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add felixpg13-glitch-spendshield -t stdio -c uvx -a spendshield
```

### Other

```json
{
  "mcpServers": {
    "felixpg13-glitch-spendshield": {
      "command": "uvx",
      "args": [
        "spendshield"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 62, +1)

No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-18 (score 61, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-16 (score 60, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-14 (score 59, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-12 (score 58, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-10 (score 57, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-09-02 (score 53)

First indexed and scored.

## MCP tools (17)

### `spend_protect` (~128 tokens)

保护一次花钱操作。走干跑/预算/黑名单/白名单/频率/单次上限闸门。通过返回 ok=true; 被拦返回 ok=false + reason

Input parameters:

- `action` (string, required): 操作名, 如 下单/转账/充值
- `agent` (string): 调用方 Agent 身份 ID(未注册默认拒绝, 建议必填)
- `amount` (number, required): 金额(元)
- `to` (string, required): 收款方, 如 麦当劳/xxx@example.com

### `spend_status` (~28 tokens)

查询当前护栏状态: 预算/已花/剩余/拦截统计

### `spend_audit` (~31 tokens)

最近审计记录(最多 N 条)

Input parameters:

- `limit` (integer): 条数, 默认 10

### `spend_reset` (~27 tokens)

重置本次会话已花金额(新会话/换预算时用)

### `secret_get` (~74 tokens)

从密钥保险库取密钥(过身份+审批闸门, 留审计)。密钥名视为收款方, 可加白名单免问

Input parameters:

- `agent` (string, required): 调用方 Agent 身份 ID
- `name` (string, required): 密钥名(如 mcd_sk)

### `authorize_payment` (~166 tokens)

SpendShield 授权入口(契约 v1): 在付款前判断一笔资金请求。输入 recipient/amount/purpose/agent_id; 返回 status(ALLOW/APPROVAL/DENY) + decision_id + policy_version + 结构化 reason(code/message/current_usage/requested)。ALLOW=可付款; APPROVAL=需人工审批(用 decision_id 调 spend_approve); DENY=拒绝

Input parameters:

- `agent_id` (string): 调用方 Agent 身份 ID(匿名可省)
- `amount` (number, required): 金额
- `purpose` (string): 用途说明(审计可读, 如 '订阅续费' '下单')
- `recipient` (string, required): 收款方(商户/地址/账号)

### `spend_authorize` (~124 tokens)

V2 授权入口: 返回三态决策 ALLOW/DENY/APPROVAL + 命中规则(RuleHit 结构化)。ALLOW=可付款; APPROVAL=需人工审批(拿 approval_id 调 spend_approve); DENY=拒绝

Input parameters:

- `agent` (string): Agent 身份 ID(匿名可省)
- `amount` (number, required): 金额
- `meta` (object): 附加上下文(可带 idempotency_key 防重放)
- `to` (string, required): 收款方

### `spend_approve` (~62 tokens)

批准一笔挂起审批(APPROVAL 状态)。批准后重新评估, 返回最终决策

Input parameters:

- `approval_id` (string, required): spend_authorize 返回的 approval_id
- `by` (string): 批准人标识

### `spend_reject` (~46 tokens)

拒绝一笔挂起审批

Input parameters:

- `approval_id` (string, required): spend_authorize 返回的 approval_id
- `by` (string): 拒绝人标识

### `policy_sim` (~103 tokens)

花钱前模拟(不真花): 评估单笔或金额扫描, 返回决策+命中规则。Agent 在发起支付前先问'这单会不会被拦'

Input parameters:

- `agent` (string): Agent 身份 ID
- `amount` (number): 单笔金额(与 amounts 二选一)
- `amounts` (array): 金额扫描列表(找边界)
- `to` (string, required): 收款方

### `policy_apply` (~73 tokens)

应用/更新策略(宿主管理工具, 仅限受信调用者)。传 policy JSON 生效新规则;无参数返回当前策略摘要。策略变更会审计留痕

Input parameters:

- `policy` (string): V2 policy JSON(可选, 省略=查当前)

### `policy_create` (~71 tokens)

0.8 生命周期: 创建策略草稿(状态=CREATED)。草稿须走 validate/simulate/scan/review 才能 apply

Input parameters:

- `by` (string): 操作者
- `name` (string, required): 草稿名
- `policy` (string, required): V2 policy JSON

### `policy_stage` (~61 tokens)

0.8 生命周期: 一键验证草稿(validate+simulate+scan)。返回校验结果/模拟决策/安全扫描发现

Input parameters:

- `by` (string): 操作者
- `draft_id` (string, required): policy_create 返回的 draft_id

### `policy_review` (~73 tokens)

0.8 生命周期: 人工评审草稿(必须指定审批人)。scan 有 blocker 时无法通过

Input parameters:

- `approve` (boolean): 是否批准, 默认 true
- `by` (string, required): 审批人(必填)
- `draft_id` (string, required): policy_create 返回的 draft_id

### `policy_lifecycle_apply` (~61 tokens)

0.8 生命周期: 上线草稿(必须 REVIEWED)。Apply 是危险边界, 不可跳过评审

Input parameters:

- `by` (string): 操作者
- `draft_id` (string, required): policy_create 返回的 draft_id

### `policy_rollback` (~41 tokens)

0.8 生命周期: 回滚到历史版本

Input parameters:

- `by` (string): 操作者
- `version` (string, required): 目标版本号

### `policy_versions` (~24 tokens)

0.8 生命周期: 列出所有版本(含操作者)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/felixpg13-glitch-spendshield/spendshield#diagnostics

## Score history

- 2026-09-20: 62
- 2026-09-19: 61
- 2026-09-18: 61
- 2026-09-17: 60
- 2026-09-16: 60
- 2026-09-15: 59
- 2026-09-14: 59
- 2026-09-13: 58
- 2026-09-12: 58
- 2026-09-11: 57
- 2026-09-10: 57
- 2026-09-09: 53
- 2026-09-08: 53
- 2026-09-07: 53
- 2026-09-06: 53
- 2026-09-05: 53
- 2026-09-04: 53
- 2026-09-03: 53
- 2026-09-02: 53

## Common questions

### What is the SpendShield MCP server?

SpendShield is an MCP server listed in the public MCP registry as io.github.felixpg13-glitch/spendshield. Authorization layer between AI agents and money: ALLOW/APPROVAL/DENY, budgets, audit. This page covers its PyPI package (spendshield).

### Is the SpendShield MCP server safe to use?

SpendShield scores 62 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the SpendShield MCP server expose?

SpendShield exposes 17 tools: spend_protect, spend_status, spend_audit, spend_reset, secret_get, and 12 more. Their descriptions and schemas cost roughly 1,193 tokens of context every time the server is loaded.

### Is the SpendShield MCP server still maintained?

SpendShield is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the SpendShield MCP server under?

SpendShield declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/spendshield/
- Socket report: https://socket.dev/pypi/package/spendshield
- Repository: https://github.com/felixpg13-glitch/spendshield
- Changelog RSS feed: https://verifymcp.io/servers/felixpg13-glitch-spendshield/spendshield.xml
- Changelog JSON feed: https://verifymcp.io/servers/felixpg13-glitch-spendshield/spendshield.json
- HTML version of this page: https://verifymcp.io/servers/felixpg13-glitch-spendshield/spendshield