{"uid":"cap_SapiwIYLp5iX_7ilwyezw","slug":"mcp-tool-surface-audit-797061fa","name":"MCP Tool Surface Audit","description":"Machine-buyable infrastructure for autonomous agents: API cost routing, margin optimization, funding-rate data, webpage extraction, result verification, spend controls, retry planning, state, tender search and GitHub bounty intelligence.","url":"https://bounty-engineer-x402-prod.onrender.com/v1/mcp-tool-surface-audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["tools"],"properties":{"tools":{"type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"type":"string"},"annotations":{"type":"object"},"description":{"type":"string"},"inputSchema":{}}},"maxItems":100,"minItems":1},"policy":{"type":"object","properties":{"allow_tools":{"type":"array","items":{"type":"string"}}}}}},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["ok","mode"],"properties":{"ok":{"type":"boolean","const":true},"mode":{"type":"string"}}}}}}},"responseSchema":{"type":"json","example":{"ok":true,"mode":"mcp-tool-surface-audit","counts":{"high":1,"medium":1,"critical":1},"outcome":"manual_review","findings":[{"tool":"execute_shell","index":1,"reason":"potential_side_effect","severity":"high","categories":["exec"]},{"tool":"execute_shell","index":1,"reason":"conflicting_read_only_annotation","severity":"critical"},{"tool":"execute_shell","index":1,"reason":"tool_not_in_caller_allowlist","severity":"medium"}],"assumptions":["Only caller-provided tool declarations were inspected; no MCP server was contacted.","Keyword signals are static heuristics, not a vulnerability scan or a tool-behavior guarantee.","Tool descriptions and readOnly annotations may be inaccurate; enforce authorization outside this report."],"server_called":false,"evaluated_tools":2,"inventory_sha256":"267d493d115327ef684f5515ca6c3e6a6bdd85c6cc28c00f0d0e44592c04a216","charged_downstream":false,"metadata_risk_score":62}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.04","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.04/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.04","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.04","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_qq3i7J0P4VAM5Zyz4XIaG","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.04","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits a list of MCP tool declarations for security risks, side-effect potential, annotation conflicts, and allowlist violations, returning severity-graded findings and a risk score.","exampleAgentPrompt":"Can you audit these MCP tool declarations for me — I've got tools including execute_shell and a few read-only ones — and tell me which ones are high or critical severity risks, what the conflict issues are, and give me an overall risk score?","exampleUseCases":[{"title":"Pre-deployment tool safety check","prompt":"Before I deploy my new agent, audit these MCP tool declarations for me: execute_shell, read_file, and send_email — flag anything that has dangerous side effects or conflicting annotations and tell me if I'm safe to ship."},{"title":"Allowlist enforcement validation","prompt":"I have a caller policy that only allows read_file and query_db — can you run a security audit on my full tool manifest and tell me which tools violate that allowlist so I can lock them down?"},{"title":"Risk scoring for compliance review","prompt":"I need a metadata risk score and severity breakdown for our MCP tool inventory before our security review — here are the 15 tool declarations, please check them for side-effect risks, annotation conflicts, and anything critical."}],"resultDescription":"Returns a JSON object with an ok flag, audit mode label, counts of findings by severity (critical/high/medium), an outcome recommendation (e.g. manual_review), an array of findings each containing the tool name, index, reason code, severity, and categories, a list of audit assumptions, a boolean indicating whether the MCP server was contacted, the number of evaluated tools, an inventory SHA256 hash, a charged_downstream flag, and a numeric metadata_risk_score (0–100).","failureModes":["Empty tools array or more than 100 tools triggers schema validation failure","Missing required body fields (tools, type, method, bodyType) returns 400","Malformed tool declaration objects may be skipped or cause partial results","Payment failure (x402) blocks the request before processing","Tool descriptions and annotations that are absent may reduce finding accuracy"],"whenToPreferThis":"Choose this endpoint when you need a fast, stateless, heuristic-based security audit of MCP tool declarations without contacting any live MCP server. It is ideal for pre-deployment checks, CI/CD gates, compliance reviews, and allowlist enforcement validation. Prefer it over manual review when you have up to 100 tool declarations and need severity-graded findings with a numeric risk score in a single API call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T12:41:22.260Z","isFirstParty":false,"canonicalSlug":"mcp-tool-surface-audit-797061fa"}