Tag

#audit

85 results found

MarketNow — Trust Layer for Agent Commerce (MCP Marketplace)
@Edison Flores

The trust layer for agent commerce. 8,560 MCP-compatible skills with Sentinel L2 security audits, x402 payments (HTTP 402 + USDC on Base), and AP2 delegated mandates with human-in-the-loop by default. NOT another discovery registry — discovery is solved (MCP Registry, Smithery, Glama). MarketNow solves TRUST: every skill carries a Sentinel security report, declared permissions, and an honest review_status (auto-scanned | human-reviewed | maintainer-verified). ## What's different - 🔒 Sentinel L2: real-time security audit on every skill (18 Semgrep rules + Docker sandbox + OSV dependency check) - 💳 x402 + USDC on Base: HTTP 402 Payment Required, on-chain verifiable - 🛡️ AP2 mandates: agents buy autonomously, but human-in-the-loop is the DEFAULT (not opt-out) - 📜 Audit log = git commits: every mandate transaction is a public commit in the GitHub repo - 🌍 5 languages: EN, ES, ZH, PT, FR - 💰 $0.99–$9.99 one-time, 43 free skills, NO subscriptions - 🏢 Built by AliceLabs LLC (Wyoming, USA, 2025), solo founder Edison Flores, no investors ## MCP Tools - search_skills: Search by query, category, price, language - get_skill: Get full details (system prompt, sentinel, setup) - list_categories: 58 categories with counts - get_manifest: Marketplace metadata - get_install_command: Get npx install command ## Server Config { "mcpServers": { "marketnow": { "url": "https://marketnow.site/api/mcp" } } } ## Stats (live) - 8,560 MCP skills indexed - 58 categories - 43 free skills - 5 languages - License: MNNC-1.0 (source-available, non-commercial) ## Links - Website: https://marketnow.site - Trust roadmap: https://marketnow.site/trust - Standards: https://marketnow.site/standards - Source: https://github.com/edgarfloresguerra2011-a11y/marketnow - npm: https://www.npmjs.com/package/marketnow-mcp - OpenAPI: https://marketnow.site/api/openapi.json Built for autonomous agents. Every skill has a Sentinel security report, a ready-to-use system prompt, and auto-configured install. What you pay for is trust, curation, and integration — not the code (which is open source).

16 days ago
Verify Action
@Armada735

Verify AI agent tool calls with content-addressed, HMAC-attested receipts. Free third-party verification API for AI agents. Call verify_action(claim, evidence) to get an independent integrity check on whether your claimed action matches the actual evidence. Useful for catching silent failures: incorrect SQL operations, file-op mismatches, API call inconsistencies, and code-diff scope creep. Five specialized verifier kinds: - code_diff: verb / path / identifier coherence with unified diff - db_op: row delta + SQL operation + ID match - file_op: existence state + line/size delta - api_call: request body and response status coherence - generic: conservative fallback Returns: - aar_verdict: verified | contradicted | insufficient_evidence | unsafe_to_verify - verdict: ok | mismatch | uncertain (legacy 3-value alias) - reasoning, confidence - receipt: verify_action_receipt.v0 with HMAC-SHA256 signature, content-addressed via SHA-256 hashes of claim and evidence Cross-vendor: works with Claude Code, Cursor, Cline, Codex, Codeium, and any MCP-compatible harness. Stateless, per-request, no API key, no registration. Pure Python stdlib (no pip install). Anonymized telemetry only — no PII, no model fingerprint, no raw claim/evidence retention. Honest scope: this is a small reference implementation, not a canonical inter-vendor standard. v0 receipts use HMAC-SHA256 (symmetric, single-issuer); v1 with ed25519 + multi-issuer is on the roadmap. The hosted endpoint has no SLA — self-host for stability (git clone && ./start.sh). 90-day probe with explicit kill criteria. If adoption appears, v1 schema work begins. If response is null, the null is itself a publishable data point.

2 months ago