Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@attest-mcp Scan https://api.example.com/paid-resource for safety before paying"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Trust scanning for agent payments — right inside your AI agent.
attest-mcp is a Model Context Protocol server that lets any MCP-compatible agent (Claude, Cursor, Windsurf, VS Code, and more) scan an agent payment endpoint and get back a letter grade A–F with a clear safety verdict before authorizing a single cent.
It covers the agentic payment protocols in use today: x402, MPP, AP2, L402, and HTTP 402.
Powered by Attest. The scoring engine runs entirely on Attest's servers — this package is a thin client that relays requests, so installing it never exposes any proprietary grading logic.
Autonomous agents are starting to pay for things on their own. A single malicious or misconfigured endpoint can drain funds through impersonation, a blocklisted payout wallet, bait-and-switch pricing, or a broken payment handshake. attest-mcp gives your agent a fast, deterministic safety check it can run as a step in its payment loop.
Related MCP server: Vouch
Tool | What it does |
| Runs a full scan on a payment endpoint URL and returns a grade (A–F), a composite score (0–100), a verdict, danger flags, price, and a link to the full report. Call this before paying an unfamiliar endpoint. |
| Fast lookup of the most recent grade for a host that has already been scanned. Good for a quick pre-check. |
Node.js 18 or newer
Any MCP-compatible client
No API key required.
Run it directly with npx (no install needed):
npx attest-mcpThe server speaks MCP over stdio, so you normally don't run it by hand — you point your MCP client at it using one of the configs below.
Edit claude_desktop_config.json (Settings → Developer → Edit Config):
{
"mcpServers": {
"attest": {
"command": "npx",
"args": ["-y", "attest-mcp"]
}
}
}Add to ~/.cursor/mcp.json (or Settings → MCP → Add new server):
{
"mcpServers": {
"attest": {
"command": "npx",
"args": ["-y", "attest-mcp"]
}
}
}Add to ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"attest": {
"command": "npx",
"args": ["-y", "attest-mcp"]
}
}
}Add to .vscode/mcp.json in your workspace:
{
"servers": {
"attest": {
"command": "npx",
"args": ["-y", "attest-mcp"]
}
}
}Use the command npx -y attest-mcp with the stdio transport.
Prefer not to install anything? Attest also runs a hosted MCP server you can connect to over Streamable HTTP:
https://attestagent.org/api/mcpPoint any remote-MCP-capable client at that URL.
Once connected, just ask your agent in natural language:
"Before you pay, scan
https://api.example.com/paid-resourcewith Attest."
The agent calls attest_scan and gets back something like:
{
"host": "api.example.com",
"grade": "A",
"composite": 95,
"danger": false,
"verdict": "Valid endpoint, established host.",
"priceHuman": "0.01 USDC",
"reportUrl": "https://attestagent.org/r/abc-123"
}Environment variable | Default | Description |
|
| Override the Attest API base URL. Only needed for self-hosting or testing. |
No secrets, no accounts, no API keys. The server holds no credentials.
No proprietary logic ships here. Grading happens server-side; this package only relays requests and formats responses.
Inputs are validated before any request is made.
Outbound only. The server makes HTTPS requests to the Attest API and speaks MCP over stdio — it opens no inbound ports.
Scanned URLs and results are logged to Attest's public directory. Do not scan endpoints whose URL or response contains private or sensitive information. See attestagent.org/legal.
Website: attestagent.org
Developer docs: attestagent.org/developers
Methodology: attestagent.org/methodology
X / Twitter: @Attestagent
Issues and pull requests are welcome — see CONTRIBUTING.md.
MIT © Attest
Quickly look up the most recent Attest grade for a host that has already been scanned. Useful for a fast pre-check. If the host has never been scanned, use attest_scan instead.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | The hostname to look up, e.g. api.example.com (a full URL is also accepted). |
| Name | Required | Description |
|---|---|---|
| host | Yes | |
| slug | No | |
| grade | Yes | |
| danger | Yes | |
| composite | Yes | |
| scannedAt | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions the operation is quick, but does not disclose additional behavioral traits such as whether the host must exist, what happens if not found, or any side effects. Since it is a read operation, the basic purpose is clear, but more detail would improve transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the main action, no extraneous words. Efficient and to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool is simple (1 parameter, output schema exists), the description sufficiently covers purpose and usage. It could optionally mention the output format, but the output schema likely handles that. Slight room for improvement.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter, with the schema already explaining the parameter well. The tool description adds no extra meaning beyond what the schema provides, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool looks up the most recent Attest grade for a host that has been scanned, using specific verb (look up) and resource (host grade). It distinguishes from the sibling tool attest_scan, which is for hosts that haven't been scanned.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use this tool ('fast pre-check') and when not to ('host has never been scanned, use attest_scan instead'), providing clear guidance on alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Scan an agent payment endpoint (x402 / MPP / AP2 / L402 / HTTP 402) and return a letter grade A–F with a safety verdict. Call this BEFORE authorizing a payment to an unfamiliar endpoint to check for impersonation, blocklisted payout wallets, bait-and-switch pricing, and protocol problems.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The full URL of the payment endpoint to scan, e.g. https://api.example.com/resource |
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| host | Yes | |
| grade | Yes | |
| danger | Yes | |
| verdict | Yes | |
| composite | Yes | |
| reportUrl | Yes | |
| priceHuman | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It accurately describes the tool's action (scanning) and output (letter grade, safety verdict). However, it omits details like making a network request, potential latency, or side effects. Still, the core behavior is clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, each essential: first defines what the tool does, second provides usage guidance. No wasted words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has one parameter and an output schema (though not shown), the description covers the purpose, input, and output. Could mention whether the scan is synchronous or if there are side effects, but overall adequate for a focused tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (1 param 'url' with description). The description reinforces that the URL should be a payment endpoint and provides example protocols. It adds meaningful context beyond the schema's generic 'uri' format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool scans a payment endpoint (listing protocols like x402, MPP) and returns a letter grade with safety verdict. It distinguishes from the sibling 'attest_grade' by implying this tool performs the scan, while the sibling likely reads an existing result.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises calling this tool 'BEFORE authorizing a payment to an unfamiliar endpoint,' listing specific risks to check (impersonation, blocklisted wallets, bait-and-switch pricing, protocol problems). Provides clear when-to-use context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.0.0attest_gradeattest_scanThe two tools are clearly distinct: attest_scan performs a full scan of an endpoint and returns a grade, while attest_grade retrieves a previously cached grade. There is no ambiguity about which to use.
Both tools follow the consistent verb_noun pattern 'attest_scan' and 'attest_grade', using the same prefix and a clear action word.
With only two tools, the set is minimal but focused. It covers the core scan-and-check workflow without unnecessary bloat. A third tool for listing or managing hosts would be nice but is not essential.
The two tools cover the primary use case of scanning and retrieving grades, but there are missing operations like listing all scanned hosts, deleting a host, or forcing a rescan. The surface is somewhat incomplete for lifecycle management.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Verify x402 payment endpoints before an AI agent pays: scam scan, on-chain checks, trust scores.
Pay-per-call safety checks for AI agents: screen a crypto address or URL before you transact.
Check if a counterparty is safe to pay: trust/risk score for AI agents. Scam/phishing screen.
Scan any website for AI agent readiness, payment protocols, and discovery endpoints
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/attestagents/Install-attest-agent'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
