Static MCP, source-code and injection-indicator checks with redacted signed receipts.
| Endpoint | https://mcp.viridis-security.com/security-preflight/mcp (streamable-http) |
|---|---|
| Registry version | 1.3.1 |
| Now | 5 tools · grade A (99) · pin ts_d9f1e36102b4f4c73a2c3c7524a5291b · protocol 2025-06-18 |
| First / last listed | 2026-10-27 06:46 UTC / 2026-10-27 06:46 UTC |
| Grade over time | 2026-10-27: A (99), 5 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: security_preflight scan_source screen_injection get_security_receipt describe_agent
security_preflight | Run a $1 static Security Preflight and return a signed receipt.
Direct MCP requires the checkout caller and verified fixed-order session.
The separate x402 HTTP rail retains its existing introductory quote policy.
No deployed endpoint is fetched or tested. Importing the receipt into an
Agent Market profile is a separate, explicit action.
params: agent_id*, manifest*, subject_profile_sha256, policy, sample_inputs, payment_ref, request_id, session_id |
scan_source | $1 bounded inline VulnCanon source scan; indicators, not proven exploits.
Direct MCP requires the checkout caller and verified fixed-order session.
At most 64 KiB, 2000 lines, 4096 characters per line. No model calls,
repository fetching or code execution. Returns a redacted signed receipt.
params: agent_id*, source*, session_id |
screen_injection | $1 batch of 1–20 text samples screened for deterministic injection markers.
Direct MCP requires the checkout caller and verified fixed-order session.
Maximum 64 KiB total. Heuristic indicators, not calibrated probabilities
or a guarantee of safety. No model calls or automatic follow-on purchase.
params: agent_id*, texts*, session_id |
get_security_receipt | Read an unsigned, filtered public view; retain original delivery for signature verification. params: receipt_id* |
describe_agent | Describe scope, evidence boundary, inputs, and outputs. params: none |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.