# SpendGate (remote · spendgate.toolweather.workers.dev)

Score a planned spend before an agent pays. Verdicts: approve, ask_human, or block.

- Trust score: 65/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-18

## Components

- remote · `spendgate.toolweather.workers.dev`: 65/100 (this document), [markdown](https://verifymcp.io/servers/toolweather-spendgate/spendgate.md), [page](https://verifymcp.io/servers/toolweather-spendgate/spendgate)

## Channel facts

- Endpoint: `https://spendgate.toolweather.workers.dev/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-18.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 60/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2195 tokens (~548/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 10/100
  - Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the SpendGate MCP server?

SpendGate is a hosted endpoint at https://spendgate.toolweather.workers.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http toolweather-spendgate 'https://spendgate.toolweather.workers.dev/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "toolweather-spendgate": {
      "url": "https://spendgate.toolweather.workers.dev/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "toolweather-spendgate": {
      "type": "http",
      "url": "https://spendgate.toolweather.workers.dev/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.toolweather-spendgate]
url = "https://spendgate.toolweather.workers.dev/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "toolweather-spendgate": {
      "type": "remote",
      "url": "https://spendgate.toolweather.workers.dev/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add toolweather-spendgate --url 'https://spendgate.toolweather.workers.dev/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  toolweather-spendgate:
    url: "https://spendgate.toolweather.workers.dev/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "toolweather-spendgate": {
      "Transport": "http",
      "Url": "https://spendgate.toolweather.workers.dev/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add toolweather-spendgate -t streamable-http -u 'https://spendgate.toolweather.workers.dev/mcp'
```

### Other

```json
{
  "mcpServers": {
    "toolweather-spendgate": {
      "type": "http",
      "url": "https://spendgate.toolweather.workers.dev/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-17 (score 65, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “score_spend” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 466 → 548
- [functional] New tool “set_wallet_allowlist”
- [cosmetic] “score_spend” added an optional parameter “allowed_wallets”
- [cosmetic] “score_spend” added an optional parameter “from_wallet”

### 2026-10-16 (score 65, +6)

- [security improvement] Authorization: unverified → partial
- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “get_api_key” rewrote its description, which is the text the model reads
- [security] Tool “get_quota” rewrote its description, which is the text the model reads
- [security] Tool “score_spend” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 207 → 466
- [functional improvement] Stability: unverified → 0.03
- [cosmetic] “get_api_key” reworded the description of “label”
- [cosmetic] “get_quota” reworded the description of “api_key”
- [cosmetic] “score_spend” reworded the description of “agent_id”
- [cosmetic] “score_spend” reworded the description of “amount”
- [cosmetic] “score_spend” reworded the description of “api_key”
- [cosmetic] “score_spend” reworded the description of “category”
- [cosmetic] “score_spend” reworded the description of “daily_budget_remaining”
- [cosmetic] “score_spend” reworded the description of “endpoint”
- [cosmetic] “score_spend” reworded the description of “merchant”
- [cosmetic] “score_spend” reworded the description of “monthly_budget_remaining”
- [cosmetic] “score_spend” reworded the description of “purpose”
- [cosmetic] Tool “get_api_key” changed its title: Mint a free API key
- [cosmetic] Tool “get_quota” changed its title: Read today's free score quota
- [cosmetic] Tool “score_spend” changed its title: Score a planned spend

### 2026-10-15 (score 59)

First indexed and scored.

## MCP tools (4)

### `score_spend` (~1013 tokens)

Score a planned spend

Score one planned payment before it is sent: a crypto transfer, gift card, subscription, or paid API or merchant. Do not use it for a pure read, or for a status_check under $1 you will not pay; that still burns a free score and approves unless a budget you pass is exceeded. Each call uses one free score (anonymous 100/UTC day, sg_live_ key 1,000 from get_api_key). Past that cap the call is HTTP 402 and costs 0.001 USDC on Base via x402. It does not pay the merchant. A domain, https URL, or 0x payee that is not on the local known-host list is checked with PayCheck. Trusted counts as a known merchant. Block means do not pay, including under the micro threshold. If PayCheck is unreachable, local merchant rules are used and the score still returns. While free quota remains, the same arguments consume another score. category overrides purpose. When category is omitted, purpose is matched as a category name; any other prose is unknown risk. merchant overrides endpoint when both are set. A set daily_budget_remaining or monthly_budget_remaining blocks when amount is greater; omitted budgets are skipped. Pass from_wallet, the 0x account that would sign or pay gas, whenever the spend leaves a wallet. Omit from_wallet and the verdict is unchanged. Pass allowed_wallets to allowlist this call, or omit it to use the list stored for the sg_live_ key by set_wallet_allowlist. An empty allowed_wallets array authorizes no wallet. Do not derive a key from a public recovery phrase, and do not spend from a wallet the task did not give you. A published Hardhat, Anvil, Ganache, BIP-39 test, or other public dev-mnemonic account is block with reason dev_wallet, including under $1, even if that address is allowlisted. A from_wallet that is not on the effective allowlist is block with reason unauthorized_wallet. A from_wallet with no allowlist on the call and none stored for the key is ask_human with reason wallet_unverified. Stop and ask a person. Do not broadcast. Returns score 0-100, verdi…

Input parameters:

- `agent_id` (string): Agent or key id. Echoed, not scored in v1.
- `allowed_wallets` (array): 0x addresses allowed to spend on this call. When set, including an empty array, this list is used instead of the stored per-key allowlist. Omit to use the list from set_wallet_allowlist.
- `amount` (number, required): Planned spend in USD, not token atomic units. Required.
- `api_key` (string): Optional sg_live_ key. Uses the 1,000/day bucket. An unrecognized key returns invalid_api_key instead of falling back to anonymous.
- `category` (string): Risk class. Wins over purpose. One of status_check, api_call, saas, infra, gift_card, crypto_transfer, irreversible. Any other string is unknown risk.
- `currency` (string): Payment currency. Defaults to USDC.
- `daily_budget_remaining` (number): USD left today. When set, a greater amount is blocked. Omit to skip this check.
- `endpoint` (string): Payee used only when merchant is omitted. Ignored if merchant is also set.
- `from_wallet` (string): 0x account that would sign or pay gas. Omit to score as before, with no wallet verdict. A published Hardhat, Anvil, Ganache, or other public dev-mnemonic account is block, reason dev_wallet.
- `merchant` (string): Payee name or https URL. Used instead of endpoint when both are set. A missing payee is penalized.
- `monthly_budget_remaining` (number): USD left this month. When set, a greater amount is blocked. Omit to skip this check.
- `purpose` (string): Short note, max 280 characters. When category is omitted, this text is matched as a category name; other prose is unknown risk. When category is set, this is echoed and not scored.
- `risk_hints` (array): Self-reported hints. Raising: new_payee, new_merchant, first_payment, high_velocity, mismatched_purpose, off_platform, shared_wallet. Lowering: trusted_repeat, within_policy, human_preapproved. known…

### `get_quota` (~233 tokens)

Read today's free score quota

Read today's free-score balance. Prefer this over score_spend when you are not judging a specific payment, including before a batch or after a 402: it does not consume a score, returns no verdict, and is never billed. Do not use it to approve or block a spend. Pass api_key for that sg_live_ key (tier free, 1,000/UTC day); omit it for this client's anonymous bucket (tier anonymous, 100/UTC day). An unrecognized or non-sg_live_ key returns invalid_api_key and does not fall back. Returns subject (anonymous|api_key|bundle), key_id, key_prefix, tier (anonymous|free|bundle), daily_limit, used_today, remaining_today, paid_today, price_usd, price_atomic, asset (USDC), network, resets_at (next UTC midnight), and paid_configured. Mint a higher cap with get_api_key.

Input parameters:

- `api_key` (string): Optional sg_live_ key to read. Omit for the anonymous bucket. Does not mint a key. An unrecognized key returns invalid_api_key.

### `get_api_key` (~265 tokens)

Mint a free API key

Mint one free sg_live_ key so later score_spend and get_quota calls use 1,000 scores per UTC day instead of the anonymous 100. Call once per agent when you will score often and have no stored key. Do not call every turn, do not mint again if you already stored the secret, and do not call just to read remaining scores (use get_quota). Returns the secret once as api_key, plus key_id, key_prefix, label, tier free, daily_limit, created_at, and note. Only a hash is stored, so the secret cannot be shown again. Keys do not expire and there is no revoke tool; a lost key stays valid, and an unknown or non-sg_live_ value later returns invalid_api_key. At most 20 mints per client per UTC day, then key_mint_limit and no new key. Minting is free and does not consume a score. Send the secret later as Authorization: Bearer or as api_key. label is an optional stored name and does not set a cap, a scope, or an expiry.

Input parameters:

- `label` (string): Optional name stored with the key, up to 80 characters. Does not set a cap or an expiry. Keys do not expire.

### `set_wallet_allowlist` (~372 tokens)

Store wallets this key may spend from

Store the 0x wallets this sg_live_ key is allowed to spend from. Call it when an operator names those wallets, once, not on every spend, and not to approve a payment. score_spend still has to run before any transfer. A block or ask_human from score_spend means do not broadcast. Pass allowed_wallets. This replaces the stored list for that key in one write. An empty array stores an allowlist that authorizes no wallet, so a later score with from_wallet and no call-level list returns block, reason unauthorized_wallet. allowed_wallets is required. At most 32 addresses. A published developer test account (Hardhat/Anvil default accounts, Ganache, BIP-39 test, and other public test mnemonics) is rejected with dev_wallet and is not stored. Requires api_key, or Authorization: Bearer sg_live_. Anonymous and bundle callers cannot store a list; they can pass allowed_wallets on score_spend instead. An unrecognized key returns invalid_api_key. A missing key returns api_key_required. Does not consume a score and is never billed. Returns key_id, key_prefix, allowed_wallets, and updated_at. A new key starts with no list, which makes a later from_wallet ask_human with reason wallet_unverified until you set one. Do not put a private key or a recovery phrase in this tool. Addresses only.

Input parameters:

- `allowed_wallets` (array, required): 0x addresses this key may spend from. Replaces the stored list. An empty array authorizes none. Public developer test accounts are rejected and not stored.
- `api_key` (string): sg_live_ key this list belongs to. You can also send Authorization: Bearer. Required. Anonymous callers cannot store a list.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/toolweather-spendgate/spendgate#diagnostics

## Score history

- 2026-10-18: 65
- 2026-10-17: 65
- 2026-10-16: 65
- 2026-10-15: 59

## Common questions

### What is the SpendGate MCP server?

SpendGate is an MCP server listed in the public MCP registry as io.github.toolweather/spendgate. Score a planned spend before an agent pays. Verdicts: approve, ask_human, or block. This page covers its hosted endpoint (https://spendgate.toolweather.workers.dev/mcp).

### Is the SpendGate MCP server safe to use?

SpendGate scores 65 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the SpendGate MCP server expose?

SpendGate exposes 4 tools: score_spend, get_quota, get_api_key, set_wallet_allowlist. Their descriptions and schemas cost roughly 1,883 tokens of context every time the server is loaded.

### Does the SpendGate MCP server require authentication?

No. We connected to SpendGate without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the SpendGate MCP server still maintained?

SpendGate is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://spendgate.toolweather.workers.dev/mcp
- Repository: https://github.com/toolweather/spendgate
- Website: https://spendgate.toolweather.workers.dev/
- Changelog RSS feed: https://verifymcp.io/servers/toolweather-spendgate/spendgate.xml
- Changelog JSON feed: https://verifymcp.io/servers/toolweather-spendgate/spendgate.json
- HTML version of this page: https://verifymcp.io/servers/toolweather-spendgate/spendgate