FHI MCP Server Security Audit
Free payment guide and Base-USDC x402 MCP security, package, domain, and SEC tools.
| Endpoint | https://polished-truth-c514.fhi-llc-1118.workers.dev/mcp (streamable-http) |
|---|---|
| Registry version | 1.4.0 |
| Now | 7 tools · grade A (97) · pin ts_cab09384856f88e16e0ec1e475039239 · protocol 2025-06-18 |
| First / last listed | 2026-10-28 04:00 UTC / 2026-10-28 04:00 UTC |
| Grade over time | 2026-10-28: A (97), 7 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: payment_info domain_change_evidence package_install_preflight sec_material_event_delta mcp_payment_preflight mcp_change_evidence mcp_vendor_due_diligence
payment_info | Free guide to the FHI MCP tools, Base-USDC x402 payment flow, and per-tool prices. params: none |
domain_change_evidence | Stateful DNS, CAA, and certificate-transparency monitoring for a public domain. The first call establishes a baseline; later calls return evidence changes and certificate-expiry signals. ($0.01 USDC on Base) params: domain* |
package_install_preflight | npm or PyPI install preflight: blocks missing packages, detects near-name typosquats when an expected name is supplied, and checks OSV advisories. ($0.003 USDC on Base) params: ecosystem*, name*, version, expectedName |
sec_material_event_delta | New SEC 8-K, 6-K, and late-filing evidence since a cursor date; accepts a ticker or CIK. ($0.01 USDC on Base) params: cik, ticker, since* |
mcp_payment_preflight | MCP server security audit before an agent connects or pays: probes initialize and tools/list, then returns an ALLOW, CAUTION, or BLOCK risk score for command, filesystem, or wallet capabilities; prompt-injection or data-exfiltration signals; permissive JSON-schema inputs; missing HSTS; and a large tool surface. Does not execute tools. ($0.01 USDC on Base) params: serverUrl* |
mcp_change_evidence | Stateful live remote-MCP monitor for tool-rug-pull and tool-poisoning risk. Establishes an endpoint baseline, then detects added or removed tools, altered tool descriptions, risk-score changes, and newly observed high-risk capability signals before an agent reconnects or pays. Unlike a manifest diff, it fetches the live endpoint and retains the prior observation. ($0.003 USDC on Base) params: serverUrl* |
mcp_vendor_due_diligence | One decision-ready due-diligence dossier before an agent adopts or pays an MCP vendor: live MCP metadata and tool-risk preflight, DNS/CAA/certificate evidence, plus optional SEC material-filing evidence for a public company. Does not execute vendor tools or certify safety. ($0.10 USDC on Base) params: mcpUrl*, ticker, cik, since |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.