{"uid":"cap_1553uZr0Bm7egUcYfqkrt","slug":"mcp-attack-surface-audit-pack-0e93d83a","name":"MCP Attack Surface Audit Pack","description":"400860 Radar is an AI-operated x402 Web3 opportunity network for humans and agents.","url":"https://api.400860.xyz/v1/mcp/attack-surface-audit-pack","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","additionalProperties":true}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"title":{"type":"string"},"nextStep":{"type":"string"},"productId":{"type":"string"},"expectedOutput":{"type":"array","items":{"type":"string"}},"buyerPreparation":{"type":"object","properties":{"payNow":{"type":"string"},"objective":{"type":"string"},"notRevenue":{"type":"array","items":{"type":"string"}},"fundingAction":{"type":"string"},"readinessLoop":{"type":"string"},"revenueSummary":{"type":"string"},"checkoutSession":{"type":"string"},"firstSaleDryRun":{"type":"string"},"paymentRecovery":{"type":"string"},"activationBundle":{"type":"string"},"successCondition":{"type":"string"},"realPaymentCommand":{"type":"string"}},"additionalProperties":true}},"additionalProperties":true}}}}},"responseSchema":{"type":"json","example":{"title":"MCP attack surface audit pack","nextStep":"/v1/agent/security-policy-pack","productId":"mcp_attack_surface_audit_pack","expectedOutput":["threatModel","attackScenarios","policyDecision","blockingPolicy","ciGate","agentAdmissionChecklist","repeatTrigger"],"buyerPreparation":{"payNow":"https://api.400860.xyz/v1/buyer/pay-now?address=0xBUYER_ADDRESS","objective":"Clear funding/readiness before attempting a real x402 payment.","notRevenue":["402 probes","funding-action reads","checkout-session reads","readiness-loop reads","pay-now reads","downloads","manifest views"],"focusedDryRun":"curl -i https://api.400860.xyz/v1/mcp/attack-surface-audit-pack","fundingAction":"https://api.400860.xyz/v1/buyer/funding-action","machinePayNow":{"price":"$0.01","method":"GET","resource":"https://api.400860.xyz/v1/mcp/attack-surface-audit-pack","payNowUrl":"https://api.400860.xyz/v1/buyer/pay-now?channel=bazaar-mcp_attack_surface_audit_pack","productId":"mcp_attack_surface_audit_pack","nextAction":"Run payCommand once from a local buyer runtime with a funded Base USDC wallet, then verify revenueSummary instead of treating discovery, 402 probes, or downloads as revenue.","notRevenue":["manifest reads","payment quote reads","pay-now reads","402 probes","downloads","self-test payments"],"payCommand":"RADAR_TARGET=https://api.400860.xyz/v1/mcp/attack-surface-audit-pack RADAR_METHOD=GET X402_PAY=true X402_PRIVATE_KEY=0xYOUR_FUNDED_X402_PRIVATE_KEY npx --yes --package https://x402.400860.xyz/downloads/400860-x402-client/400860-x402-client-0.1.4.tgz 400860-x402 pay","recoveryUrl":"https://api.400860.xyz/v1/buyer/payment-recovery?address=0xBUYER_ADDRESS&channel=bazaar-mcp_attack_surface_audit_pack","buyerGuideUrl":"https://api.400860.xyz/v1/open-source-agent/buyer-guide","verificationUrl":"https://api.400860.xyz/v1/revenue/summary","successCondition":"eventCount > 0 && hasExternalRevenue === true after a paid protected handler returns for mcp_attack_surface_audit_pack."},"readinessLoop":"https://api.400860.xyz/v1/buyer/readiness-loop?address=0xBUYER_ADDRESS","revenueSummary":"https://api.400860.xyz/v1/revenue/summary","checkoutSession":"https://api.400860.xyz/v1/buyer/checkout-session?address=0xBUYER_ADDRESS","firstSaleDryRun":"curl -i https://api.400860.xyz/v1/mcp/attack-surface-audit-pack","paymentRecovery":"https://api.400860.xyz/v1/buyer/payment-recovery?address=0xBUYER_ADDRESS","activationBundle":"https://api.400860.xyz/v1/buyer/activation-bundle","successCondition":"eventCount > 0 && hasExternalRevenue === true after a paid protected handler returns.","realPaymentCommand":"RADAR_TARGET=https://api.400860.xyz/v1/mcp/attack-surface-audit-pack RADAR_METHOD=GET X402_PAY=true X402_PRIVATE_KEY=0xYOUR_FUNDED_X402_PRIVATE_KEY npx --yes --package https://x402.400860.xyz/downloads/400860-x402-client/400860-x402-client-0.1.4.tgz 400860-x402 pay"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"down","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_2PaNwrPJqoXhSsU1PsX66","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Performs a paid high-difficulty security audit of MCP/agent deployments, detecting tool poisoning, prompt injection, data exfiltration, SSRF, unauthorized payments, and supply-chain drift, then returns a default-deny policy, CI gate, and replayable regression tests.","exampleAgentPrompt":"Can you run the MCP attack surface audit on my agent setup and give me back a default-deny policy, a CI gate config, and regression tests that cover tool poisoning, prompt injection, SSRF, and unauthorized payment risks?","exampleUseCases":null,"resultDescription":"Returns a comprehensive security audit pack including: detected vulnerabilities across tool poisoning, prompt injection, data exfiltration, SSRF/network pivot, unauthorized payment, and supply-chain drift categories; a default-deny security policy ready to apply; a CI gate configuration for automated security checks; and replayable attack regression tests to prevent regressions.","failureModes":["Payment not provided or insufficient USDC balance — returns 402 Payment Required","Invalid or missing required 'type' or 'method' input fields — returns 400 Bad Request","Target MCP endpoint unreachable or misconfigured — returns partial results or error","Rate limiting exceeded — returns 429 Too Many Requests","Service unavailable — returns 503"],"whenToPreferThis":"Choose this endpoint when you need a comprehensive, pre-packaged MCP security audit covering the full attack surface (tool poisoning, prompt injection, SSRF, supply-chain drift, unauthorized payment) in a single call, especially when you also need ready-to-use CI gate configs and regression tests rather than just a vulnerability report. Ideal for agent operators who want actionable security artifacts, not just findings.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-16T12:25:42.065Z","isFirstParty":false}