{
  "markdown": "# storefront-guard-mcp-server\n\nAgent-side merchant verification. A shopping agent calls `verify_storefront`\nwith a domain **before** paying, and gets back a trust score built from\nfree public data sources.\n\nThis is the mirror image of merchant-side agent-verification protocols like\nVisa's Trusted Agent Protocol: those let a *merchant* confirm an incoming\n*agent* is legitimate. This tool lets the *agent* confirm the *merchant* is\nlegitimate before committing payment.\n\n## What it checks\n\n- **Domain registration age & recent changes** — via free public RDAP\n  lookups. A domain registered days ago, or one whose registration data\n  changed in the last two weeks, is a red flag.\n- **SSL certificate issuance history** — via free public Certificate\n  Transparency logs (crt.sh). A cert reissued very recently on an\n  otherwise long-established domain can indicate a takeover or hosting\n  change, even when the domain itself looks old and trustworthy.\n- **HTTPS validity** — does the site currently serve a valid cert at all.\n- **Known-scam blocklist** — URLhaus and Google Safe Browsing.\n- **Corporate registration** — US entity lookup via OpenCorporates.\n- **Legal name verification** — GLEIF entity registry cross-check.\n- **Web traffic rank** — Tranco top-1M ranking.\n- **Federal exclusions** — SAM.gov debarment check.\n- **FDA enforcement** — corroborating signal when other risks are present.\n\nEvery deduction from the trust score comes with a plain-English reason in\nthe `reasons` array — this is deliberately an explainable heuristic, not a\nblack-box model.\n\n## Setup\n\nRequires Node.js 18+.\n\n```bash\nnpm install\nnpm run build\n```\n\nCopy `.env.example` to `.env` and fill in your keys.\n\n## Running it\n\n**As a local MCP server (stdio):**\n```bash\nnpm start\n```\n\n**As a remote MCP server (streamable HTTP) with x402 payment:**\n```bash\nnpm run start:http\n# POST http://localhost:3000/mcp\n```\n\n**As a pay-per-call x402 HTTP API:**\n```bash\nnpm run start:x402\n# POST http://localhost:4021/verify   { \"domain\": \"example-shop.com\" }\n```\n\n**As a REST API (API key auth):**\n```bash\nnpm run start:rest\n# POST http://localhost:4022/verify   { \"domain\": \"example-shop.com\" }\n# Header: X-API-KEY: your-key\n```\n\n**All three servers at once:**\n```bash\nnpm run start:all\n# MCP:  http://localhost:3000/mcp\n# x402: http://localhost:4021/verify\n# REST: http://localhost:4022/verify\n```\n\n## Feedback endpoint\n\nSubmit outcome data after a transaction to help build training data for future ML scoring:\n\n```bash\nPOST http://localhost:4022/feedback\nHeader: X-API-KEY: your-key\nBody: { \"domain\": \"example-shop.com\", \"outcome\": \"legit\" | \"scam\" }\n```\n\n## How to use the recommendation field\n\nEvery verification result includes a top-level `recommendation` string alongside the\nnumeric `trustScore`. Agents should branch on it rather than implementing their own\nthreshold logic against the raw score.\n\n| Value | Suggested agent behavior |\n|---|---|\n| `proceed` | Complete the transaction silently. Trust score is low-risk with high confidence. |\n| `pause_for_confirmation` | Stop before paying and show `recommendationReason` to the user. |\n| `do_not_proceed` | Block the transaction and actively notify the user — do not fail silently. |\n\n`recommendationReason` is a one-line plain-English explanation safe to show directly to users.\n\n## Pricing\n\n$0.01/call via x402. Set your wallet address in `PAY_TO_ADDRESS` and network in `X402_NETWORK` (default: `base`).\n\n## Environment variables\n\n| Variable | Required | Description |\n|---|---|---|\n| `PAY_TO_ADDRESS` | Yes (x402) | Your wallet address for USDC payments |\n| `X402_NETWORK` | No | Blockchain network (default: `base`) |\n| `PRICE_USD` | No | Per-call price (default: `0.01`) |\n| `API_KEYS` | Yes (REST) | Comma-separated valid API keys |\n| `GOOGLE_SAFE_BROWSING_API_KEY` | No | Degrades gracefully if unset |\n| `SAM_GOV_API_KEY` | No | Degrades gracefully if unset |\n| `URLHAUS_AUTH_KEY` | No | Degrades gracefully if unset |\n| `FEEDBACK_LOG` | No | Path for feedback JSONL log (default: `feedback.jsonl`) |\n| `MCP_PORT` | No | MCP server port (default: `3000`) |\n| `X402_PORT` | No | x402 server port (default: `4021`) |\n| `REST_PORT` | No | REST API port (default: `4022`) |\n",
  "bytes": 4212,
  "sha": "a3cf75e570924a5900fc1c9c1f5a84205aefb232fdbc2c00a09aa7fda4f40119",
  "repo_slug": "maxigirl123/fortik",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_maxigirl123_storefront_guard_40cc9600/readme"
}