{
  "markdown": "# Safe4 — the payment firewall for AI agents, as an MCP server\n\nSafe4 decides whether an AI agent's proposed payment should be allowed, by\ntesting the purchase against the task the agent was actually given.\n\nThe case it exists for is the one budget limits miss: a payment that is inside\nevery budget, in an allowed category, and to an approved counterparty — and is\nstill the wrong purchase, because it does not serve the task.\n\nThis repository is the public manifest and client example for the hosted MCP\nserver. The service itself runs at `api.safe4.ai`; there is no server to\ninstall.\n\n## Connect\n\nStreamable HTTP, no installation:\n\n```json\n{\n  \"mcpServers\": {\n    \"safe4\": {\n      \"type\": \"http\",\n      \"url\": \"https://api.safe4.ai/mcp/\"\n    }\n  }\n}\n```\n\nConnecting and listing tools are free. Only `safe4_authorize` is paid.\n\n## Tools\n\n### `safe4_price` — free\n\nReturns the current price and the payment networks the endpoint accepts, so an\nagent can see the cost before committing to a paid call.\n\n### `safe4_authorize` — paid, settled per call in USDC over x402\n\nReturns an `ALLOW` or `DENY` decision for a proposed payment, with a reason\ncode, the concepts it matched, and a hash-chained audit entry.\n\nCalled without a payment it returns the x402 challenge instead of a decision.\nAn x402-aware client pays and calls again with the resulting payload in the\n`payment` argument.\n\nArguments:\n\n| Argument | Meaning |\n|---|---|\n| `task` | The task the agent was given, as stated by its principal |\n| `purchase` | What is being bought |\n| `purchase_purpose` | Why this purchase serves the task |\n| `amount`, `currency` | The proposed payment |\n| `counterparty` | Who would receive it |\n| `service_category` | Category of the thing being bought |\n| `allowed_service_categories` | Categories the principal permits |\n| `allowed_counterparties` | Optional. Payees the principal permits |\n| `task_id` | Optional. Echoed into the audit entry |\n| `payment` | An x402 payment payload. Omit to receive the price list |\n\nThe task and the two allow-lists are the principal's constraints, not the\nagent's — they are what the purchase is tested against, so an agent that writes\nits own `task` is grading its own homework. Safe4 records every field it was\ngiven and marks the task context as request-supplied, so a substituted\nconstraint is visible in the audit entry afterwards.\n\n## Try it without paying\n\nThe example runs the entire free surface — connect, list tools, read the price,\nfetch the challenge — and stops before signing anything. It needs only `httpx`:\nno key, no funded wallet.\n\n```bash\npython examples/mcp_buyer_demo.py https://api.safe4.ai --dry-run\n```\n\nDrop `--dry-run` and set `SAFE4_BUYER_PRIVATE_KEY` to buy a real decision. That\nsigns an EIP-3009 authorisation for exactly the amount and payee the server\nadvertised, and nothing else; the script holds no custody and Safe4 never sees\nthe key.\n\n## What a decision rests on\n\nFour checks, in order, and a purchase must clear all of them:\n\n1. **Budget and caps** — per-transaction, daily, and agent-scoped limits.\n2. **Service category** — the purchase's category must be one the principal\n   permitted.\n3. **Counterparty** — when the task declares `allowed_counterparties`, payment\n   to anyone else is refused. This is the only check that sees a swapped payee;\n   task text and category are identical in that attack.\n4. **Task-to-purchase match** — the task must account for what the purchase\n   says it is buying, not merely share a word or two with it.\n\nEvery decision is appended to a hash-chained audit log. Each entry carries the\nprevious entry's hash, so the record is tamper-evident and continuous across\nrestarts and redeploys.\n\n## Payment\n\nPriced per call in USDC over [x402](https://x402.org). The endpoint advertises\nits terms in the `402` challenge; buyers pay on whichever advertised network\nsuits them. Safe4 holds no wallet key and takes no custody of buyer funds.\n\n## Links\n\n- API documentation — <https://api.safe4.ai/docs>\n- OpenAPI schema — <https://api.safe4.ai/openapi.json>\n- x402 discovery — <https://api.safe4.ai/.well-known/x402>\n- Site — <https://safe4.ai>\n\n## Security\n\nReporting instructions are in [SECURITY.md](SECURITY.md). Please do not open a\npublic issue containing exploit details.\n\n## License\n\nThe manifest and client examples in this repository are [MIT](LICENSE) licensed.\nThe hosted service they describe is a separate commercial product.\n",
  "bytes": 4436,
  "sha": "5bf6ec82537a02a35d21a22e079133f2cc518cd2246539af3b9417233ced8d8e",
  "repo_slug": "safe4ai/safe4-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_ai_safe4_safe4_7af5fe6c/readme"
}