@agentutility/mcp-prooflayer

Trust + risk scanners for AI-built apps.

AI builds apps fast. Prooflayer verifies they're safe to ship — secrets, deploys, migrations, dependencies, prompt-injection, supply chain.

Pricing: pay-per-call in USDC on Base. No subscriptions, no API keys. See per-tool prices below.

Install — Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "agentutility-prooflayer": {
      "command": "npx",
      "args": ["-y", "@agentutility/mcp-prooflayer"],
      "env": { "X402_PRIVATE_KEY": "0xYOUR_PRIVATE_KEY_HEX" }
    }
  }
}

Restart Claude Desktop. 17 tools appear in the tool palette.

Install — Cursor

Add to .cursor/mcp.json:

{
  "mcpServers": {
    "agentutility-prooflayer": {
      "command": "npx",
      "args": ["-y", "@agentutility/mcp-prooflayer"],
      "env": { "X402_PRIVATE_KEY": "0x..." }
    }
  }
}

Funding

Send any amount of USDC on Base mainnet to the address derived from your X402_PRIVATE_KEY. The MCP server uses it to pay for tool calls automatically.

USDC on Base contract: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Tools (17)

| Tool | Description | |---|---| | ai-content-detector | (0.03 USDC/call) Detect AI-generated writing with a calibrated probability score. Returns a 0-1 likelihood, a verdict, suspicious phrases, and per-axis style signals (em-dash overuse, hedge phrases, formulaic transitions). Works as an AI content detector, GPT detector, or ChatGPT-text checker. | | ai-image-detector | (0.02 USDC/call) AI-generated image detector: send an image URL and get back a calibrated probability that the image is AI-generated or synthetic, plus the vision signals behind the score — anatomical artifacts (hands, teeth, eyes), garbled pseudo-text, over-smooth texture, lighting/shadow inconsistency, background incoherence, and an over-stylized 'AI look'. This is a vision-model heuristic, not a forensic or watermark-level detector, calibrated to never inflate a verdict just because a caller wants one. Verdict buckets: likely_real below 0.4, uncertain 0.4-0.65, likely_ai at 0.65+. A failed or unparseable vision call returns an error instead of a guess. Use it as an AI image detector, synthetic image checker, AI-generated picture screen, or image slop filter. | | app-store-rejection-explain | (0.02 USDC/call) Explains App Store and Google Play rejections and turns them into a resubmission plan. Parses rejection text and app metadata, identifies likely policy areas, extracts deadlines, and returns a policy-clean resubmission checklist plus reviewer-note outline. Does not promise approval or recommend platform-policy evasion. Use it for Google Play rejection triage or as a mobile app review policy checklist. | | brand-clearance | (0.25 USDC/call) Screens a candidate brand name across trademark, domain, and web-presence checks in a single composite signal. Runs four checks in parallel (in-process, no x402 self-billing): USPTO TM name search, domain availability across requested TLDs (default .com .ai .dev .io .co), Wikipedia presence, and a Hacker News mention scan. Returns risk_level (clear|soft|moderate|hard), risk_score 0-100, sub-scores per signal, the raw hits, and a one-line recommendation. Designed for AI agents self-screening project, product, or startup names before committing. Screening tool only, not legal advice. Use it as a brand clearance aggregator, name screening tool, product-name vetting step, or startup-brand pre-flight. | | cve | (0.005 USDC/call) Looks up a CVE and returns the full NIST NVD vulnerability record. Short alias of cve-lookup: CVSS v3.1 + v2 vectors, severity, CWE class, affected CPE list, references, public-exploit indicator with reference URLs, and a bounded exploitability summary. Federal public data. Use it as a vulnerability lookup, NVD record fetch, CVSS scorer, vuln advisory fetch, exploit-known check, or patch-priority triage for Log4Shell-style records. | | cve-lookup | (0.005 USDC/call) Looks up a CVE and returns its canonical NIST NVD record: description, CVSS v3.1 and v2 vectors plus numeric scores, severity bucket, CWE class, affected CPE list, NVD references, and a public-exploit-known boolean with reference URLs. Takes a CVE-YYYY-NNNNN identifier and includes a bounded plain-English exploitability summary. Federal public data. Use it as a vulnerability database, NVD record fetcher, CVSS scorer, Log4Shell-style advisory inspector, known-exploit checker, CISA KEV adjacent tool, patch-priority triage aid, or CWE classifier. | | db-migration-risk | (0.02 USDC/call) Audits database migrations for risky SQL before deploy. Walks migrations/, prisma/migrations/, db/migrate/, supabase/migrations/, and alembic/versions/ and flags destructive DDL, lock-heavy ALTER TABLE, NOT NULL without DEFAULT, plain CREATE INDEX (vs CONCURRENTLY), unbounded TRUNCATE/DELETE, and FK validation without NOT VALID. Returns 0-100 score, per-finding kind/severity/path/line/evidence/recommendation, and a Venice plain-English verdict. Dual input: {repo: 'owner/name'} for public GitHub or {files: [{path, content}, ...]} for private / agent-workspace use. Use it as a SQL migration safety check, DROP COLUMN detector, unsafe ALTER TABLE detector, Postgres CREATE INDEX CONCURRENTLY check, Alembic op.drop_* detector, TRUNCATE/DELETE WHERE detector, foreign key NOT VALID check, or pre-deploy DB gate. | | dep-risk-summary | (0.03 USDC/call) Scores dependency risk for a whole repo from its manifests and lockfiles. Best-effort scan of package.json, pnpm-lock.yaml, package-lock.json, yarn.lock, bun.lock (JS); requirements.txt, pyproject.toml, poetry.lock (Python); go.mod, go.sum (Go). Samples 10 alphabetically-first direct deps via npm/PyPI registry for deprecation + install-script signals. Returns 0-100 score, per-finding kind/severity/path/evidence/recommendation, and a Venice plain-English verdict. Dual input: {repo: 'owner/name'} or {files: [{path, content}, ...]}. Use it as a package.json + lockfile vetter, unpinned dep detector, transitive dep counter, requirements.txt audit, pyproject dep risk check, deprecated dep detector, install-script dep detector, or Snyk-adjacent repo-level supply-chain risk score. | | deploy-config-risk | (0.02 USDC/call) Audits deploy configuration files for production risks. Fetches Dockerfile, wrangler.toml, vercel.json, netlify.toml, fly.toml, docker-compose.yml, and serverless.yml and flags open CORS with credentials, exposed admin ports (22/5432/6379/etc), plaintext secrets in inline env, dev/debug mode left enabled, and missing healthchecks. Returns 0-100 score, per-finding kind/severity/path/line/redacted-evidence/recommendation, and a Venice plain-English verdict. Dual input: {repo: 'owner/name'} for public GitHub or {files: [{path, content}, ...]} for private / agent-workspace use. Use it as a Dockerfile lint, vercel.json hardening pass, wrangler.toml review, docker-compose.yml safety check, fly.toml secrets check, netlify deploy gate, open CORS detector, exposed admin port detector, plaintext-secret-in-env detector, or production-readiness deploy gate. | | github-repo-health | (0.03 USDC/call) Score how healthy and maintained an open-source GitHub repo is. Send a repo (owner/name) and it pulls public GitHub REST API data on commit recency, 30-day commit volume, star count, contributor count, README/tests/CI presence, and license, rolling it into a 0-100 score and a grade (abandoned, stale, okay, healthy, or thriving), plus a short LLM verdict explaining the rating. No auth needed for public repos. Use it as a GitHub repo health checker, open-source maintainability score, repo activity checker, or dependency-vetting tool before you adopt or depend on a library. | | package-risk-npm | (0.03 USDC/call) Scores supply-chain risk for an npm package before you install it. Pulls registry metadata + download stats for the package (and optional version) and checks maintainer count, weekly downloads, install / postinstall script hooks, dependency tree depth, deprecation flag, package age, last-publish recency, and edit-distance to popular package names (typosquat). Returns a 0-10 score, risk_level bucket, contributing factors, typosquat candidate list, and a Venice plain-English summary. Use it as an npm supply-chain scanner, typosquat detector, postinstall-script flagger, npm install pre-flight audit, package.json + pnpm-lock.yaml vetter, or Snyk-adjacent / Socket.dev-adjacent pre-install safety gate. | | production-readiness-score | (0.10 USDC/call) Composite: one call runs secrets-exposure-check, deploy-config-risk, db-migration-risk, dep-risk-summary, and prompt-injection-surface in parallel and rolls the results into one production-readiness verdict for a repo. Send either {repo: 'owner/name'} or {files: [{path, content}]}, with optional weights (each component in [0, 0.5], normalized) and max_findings (default 10, cap 50) to tune the output. Returns a composite score 0-100, a production_grade (production-ready, needs-review, risky, or do-not-ship), per-component sub-scores, deduped findings ranked by severity and score_contribution, and a plain-English summary naming the most acute risks. Use it as an AI app deploy gate, one-call repo audit, pre-deploy risk scan, or vibe-coded app safety check before shipping code an LLM wrote. | | prompt-injection-detect | (0.02 USDC/call) Prompt injection detector for untrusted inbound text — a webpage, an email, a tool result, or a message an agent is about to read. Two layers run on every call: a deterministic pattern layer (pure code) matching known injection shapes — instruction override, system-prompt exfiltration, role hijack / jailbreak phrasing ('act as DAN', 'developer mode'), fake delimiter blocks, tool abuse, and covert manipulation — plus a calibrated LLM judge layer scoring overall injection likelihood 0-1, never inflated to please a caller. Returns which pattern families hit, matched snippets, the judge's reasoning, and a combined verdict. If the LLM leg fails, the deterministic layer alone is still a valid, billable result. Use it as a prompt injection detector, jailbreak detector, untrusted text screen, or LLM input firewall. | | prompt-injection-surface | (0.03 USDC/call) Scans AI app source code for prompt injection risk at LLM call sites. Walks .ts/.tsx/.js/.jsx/.py/.mjs/.cjs source files, locates LLM SDK call sites (anthropic, openai, @ai-sdk/, google generative), and flags user input flowing into prompts without sanitization, calls without max_tokens caps, system/user prompt mixing, and LLM output used unvalidated in fetch/exec/eval. Returns 0-100 score, per-finding kind/severity/path/line/evidence/recommendation, and a Venice plain-English verdict. Dual input: {repo: 'owner/name'} (tree-walk, capped 500 files) or {files: [{path, content}, ...]}. Use it as an LLM call-site audit, unsanitized-user-input-in-prompts detector, system-message mixing flag, unbounded completion detector, AI app safety scan, or pre-deploy AI risk gate. | | pypi-package-risk | (0.01 USDC/call) Scores the supply-chain risk of a PyPI package before you install it. Pulls metadata + release history from pypi.org for a package (and optional version), evaluating age, recent download volume, maintainer count, post-install hook presence, dependency depth, deprecation flags, last-update recency, and string-distance to popular packages (typosquat). Returns a numeric score (0-10), risk_level bucket, contributing factor list, and an AI-written plain-English risk summary from Venice. Use it as a Python supply-chain scanner, pip dependency vetter, typosquat detector, pre-install audit, Python-package safety check, pyproject.toml / requirements.txt vetter, or poetry + uv pre-install gate. | | secrets-exposure-check | (0.02 USDC/call) Scans project config files for hardcoded secrets before you deploy. Fetches top-level config files (.env, wrangler.toml, vercel.json, next.config.*, package.json, etc.) and scans for hardcoded AWS/OpenAI/Anthropic/Stripe/GitHub keys, private keys, DB URLs with passwords, JWT secrets, weak values in .env.example, and server-only env vars accidentally exposed via NEXT_PUBLIC_. Returns 0-100 score, per-finding kind/severity/path/line/redacted-evidence/recommendation, and a Venice plain-English verdict. Dual input: {repo: 'owner/name'} for public GitHub or {files: [{path, content}, ...]} for private / agent-workspace use. Use it as a secrets exposure scan, hardcoded API key detector, .env-committed-key audit, Next.js client env leak detector, or pre-deploy secret gate. | | vendor-questionnaire-draft | (0.08 USDC/call) Drafts vendor security questionnaire answers from evidence you supply. Takes questionnaire text plus evidence snippets and drafts only evidence-supported answers; unsupported questions are marked needs_evidence instead of invented. Useful for founders and agents answering customer security reviews without leaking private repo data or making unsupported compliance claims. Use it as a security questionnaire answerer, SOC 2 evidence answer helper, or vendor due diligence response builder. |

How it works

1. Agent calls a tool (e.g. ai-content-detector).
2. MCP server POSTs to https://x402.agentutility.ai/ai-content-detector.
3. The endpoint responds HTTP 402 with payment instructions.
4. The MCP server signs an EIP-3009 USDC transfer authorization with X402_PRIVATE_KEY and retries.
5. CDP facilitator settles on Base.
6. The endpoint returns the actual response.

The agent never sees the payment flow — it just gets the result.

Links

• Cluster overview: https://agentutility.ai/prooflayer/
• All MCP packages: https://mcp.agentutility.ai/
• Source: https://github.com/rooz21/x402/tree/main/packages/mcp-prooflayer

Version: 0.3.3 · License: MIT