Back to Browse

Fabtally Guard MCP Server

Developer ToolsModerate5.2MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

Verify before you act: deps-check, x402-preflight, json-repair & url-read for agents.

About

Verify before you act: deps-check, x402-preflight, json-repair & url-read for agents.

Remote endpoints: streamable-http: https://guard.fabtally.com/mcp

Security Report

5.2
Moderate5.2Moderate Risk

FabTally Guard is a well-structured MCP server that fronts a payment-gated verification API. The codebase demonstrates good security practices: no hardcoded credentials, proper error handling, and appropriate input validation via Zod schemas. The server correctly handles payment logic by forwarding x402 challenges without storing keys or sensitive data. Minor code quality observations around broad error handling do not materially impact security. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity).

5 files analyzed · 7 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

FabTally Guard — MCP server

De-risk-a-dollar verification checks an AI agent runs before a costly action. Fronts the Guard HTTP API at https://guard.fabtally.com. Holds no private key.

Tools (all paid; a call with no payment returns the decoded x402 402 challenge)

ToolPriceWhat it does
deps_check$0.003Vet a package before installing — OSV.dev CVEs, typosquat similarity, deprecation/yank, SPDX license, age/download signals + a plain-English risk verdict. Args: ecosystem (npm|pypi|crates), name, version?.
x402_preflight$0.002Verify another x402 endpoint before paying it — valid x402 v2 402 challenge? price/asset/network/payTo consistent with its /.well-known/x402? TLS/reachability/openapi? + the parsed price. Args: url.
json_repair$0.002Coerce near-miss LLM JSON to a JSON-Schema-conformant object (fences/commas/quotes/keys/literals/brackets, then type-coerce, defaults, drop extras) — or precise per-field errors. Args: json (string), schema.
url_read$0.004Fetch a public url → clean Markdown + token estimate for RAG. Respects robots.txt, public pages only, nothing stored. Args: url.

Every tool also accepts an optional x_payment (base64 x402 payload) that is forwarded as the X-PAYMENT header to settle the call and return the real result. Humans can instead prepay by card and use an X-FabTally-Key credit key against the HTTP API.

Transports

  • stdio (portable): npx fabtally-guard-mcp (bin: fabtally-guard-mcp)
  • streamable-http (hosted): https://guard.fabtally.com/mcp

Config: FABTALLY_GUARD_BASE (default https://guard.fabtally.com).

Read-only, keyless, stateless, descriptive. Operated by Sunstone Soft (fabtally.com). Not a security guarantee.

Reviews

No reviews yet

Be the first to review this server!