{"uid":"cap_tyC3uHUNmjnu3sb30suxq","slug":"no-hands-ai-mcp-server-risk-check-a18c63ab","name":"NO HANDS AI MCP Server Risk Check","description":"Assess caller-declared MCP tools, authentication and transport for side-effect risks. Advisory report only; it does not connect to or enforce permissions on the server.","url":"https://nohands-coinbase-bazaar.bytoken2023.workers.dev/v1/x402/agent/mcp-server-risk-check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":[],"properties":{"auth":{"enum":["none","api_key","bearer","oauth","mTLS","unknown"],"type":"string","example":"bearer","description":"Authentication mode exposed by the MCP server."},"tools":{"type":"string","example":"read_file,write_file,send_email","maxLength":2000,"description":"Comma-separated MCP tool names when a manifest URL is unavailable."},"transport":{"enum":["stdio","http","sse","websocket","unknown"],"type":"string","example":"http","description":"MCP transport mode."},"server_url":{"type":"string","example":"https://example.com/mcp","pattern":"^https?://","maxLength":2048,"description":"Public MCP server, manifest, or connector URL."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"server":{"type":"object","properties":{"url":{"type":"string"},"auth":{"type":"string"},"transport":{"type":"string"},"tool_count":{"type":"integer"},"side_effect_tool_count":{"type":"integer"}},"additionalProperties":true},"product":{"type":"string"},"decision":{"type":"string"},"assessment":{"type":"object","properties":{"reasons":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"detail":{"type":"string"},"severity":{"type":"string"}},"additionalProperties":true}},"risk_level":{"type":"string"},"risk_score":{"type":"integer"},"reason_codes":{"type":"array","items":{"type":"string"}},"side_effect_tools":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"generated_at":{"type":"string"},"policy_version":{"type":"string"},"schema_version":{"type":"string"},"pricing_version":{"type":"string"},"connection_guidance":{"type":"string"}},"x-schema-family":"OPERATION_RUNTIME_RESULT","x-schema-authority":"REPRESENTATIVE_RUNTIME_FIXTURE","additionalProperties":true}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.020001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.020001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.020001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.020001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_I8gNS69canNXLHCDog1ta","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.020001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Assess caller-declared MCP server tools, authentication, and transport for side-effect risks and returns an advisory risk report.","exampleAgentPrompt":"Before I wire my agent up to the MCP server at https://example.com/mcp, can you run a risk check on it? It uses bearer auth and HTTP transport, and exposes tools called read_file, write_file, and send_email.","exampleUseCases":[{"title":"Pre-connection safety audit for agent","prompt":"I want to connect my agent to the MCP server at https://tools.mycompany.com/mcp — it uses OAuth and SSE transport and exposes tools like execute_sql and delete_record. Can you run a risk check before I let my agent use it?"},{"title":"Tool side-effect screening before deployment","prompt":"My MCP server at https://dev-mcp.internal.io uses API key auth and stdio transport with tools named read_config, write_config, and send_slack_message. What's the risk score and which tools have side effects?"},{"title":"Unknown server vetting with tool names only","prompt":"I don't have the server URL yet, but the MCP server exposes tools called browse_web, post_tweet, and transfer_funds with no auth and WebSocket transport — can you assess the risk level?"}],"resultDescription":"Returns a structured advisory report including: overall risk level (e.g. LOW/MEDIUM/HIGH), numeric risk score, list of side-effect tools identified, individual reason codes with severity and detail, a decision string, policy and schema version metadata, and connection guidance — all as a read-only assessment with no enforcement actions taken.","failureModes":["Invalid or unreachable server_url returns an error or degraded assessment","Unknown tool names may result in incomplete side-effect detection","Missing required fields (type, method) cause schema validation errors","Truncated tool list (over 2000 chars) may omit tools from analysis","Unrecognized auth or transport enum values default to 'unknown' and may reduce accuracy"],"whenToPreferThis":"Choose this endpoint when an AI agent or orchestrator needs to pre-screen an MCP server before connecting, especially to detect dangerous side-effect tools (e.g. email sending, file writing, financial actions) or weak authentication postures. It is advisory-only and does not enforce permissions, making it safe for preflight checks without side effects. Prefer this over manual inspection when tools are declared as a list or when a manifest URL is available but the agent cannot parse it directly.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-11-02T18:33:16.116Z","isFirstParty":false,"canonicalSlug":"no-hands-ai-mcp-server-risk-check-a18c63ab"}