FHI MCP Server Security Audit

Working

dev.workers.fhi-llc-1118.polished-truth-c514/fhi-x402-security-toolsv1.4.0 Domain verified

Free payment guide and Base-USDC x402 MCP security, package, domain, and SEC tools.

Security

Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://polished-truth-c514.fhi-llc-1118.workers.dev/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

domain_change_evidence

Stateful DNS, CAA, and certificate-transparency monitoring for a public domain. The first call establishes a baseline; later calls return evidence changes and certificate-expiry signals. ($0.01 USDC on Base)

domainstring, required

This tool isn't marked read-only, so it may change something on the server or in an account you connected.

I understand, run it anyway

Tools (7)

domain_change_evidence

Argument	Type	Description
domain*	string

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1
    }
  },
  "additionalProperties": false
}

mcp_change_evidence

Stateful live remote-MCP monitor for tool-rug-pull and tool-poisoning risk. Establishes an endpoint baseline, then detects added or removed tools, altered tool descriptions, risk-score changes, and newly observed high-risk capability signals before an agent reconnects or pays. Unlike a manifest diff, it fetches the live endpoint and retains the prior observation. ($0.003 USDC on Base)

Argument	Type	Description
serverUrl*	string

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "serverUrl"
  ],
  "properties": {
    "serverUrl": {
      "type": "string",
      "format": "uri"
    }
  },
  "additionalProperties": false
}

mcp_payment_preflight

MCP server security audit before an agent connects or pays: probes initialize and tools/list, then returns an ALLOW, CAUTION, or BLOCK risk score for command, filesystem, or wallet capabilities; prompt-injection or data-exfiltration signals; permissive JSON-schema inputs; missing HSTS; and a large tool surface. Does not execute tools. ($0.01 USDC on Base)

Argument	Type	Description
serverUrl*	string

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "serverUrl"
  ],
  "properties": {
    "serverUrl": {
      "type": "string",
      "format": "uri"
    }
  },
  "additionalProperties": false
}

mcp_vendor_due_diligence

One decision-ready due-diligence dossier before an agent adopts or pays an MCP vendor: live MCP metadata and tool-risk preflight, DNS/CAA/certificate evidence, plus optional SEC material-filing evidence for a public company. Does not execute vendor tools or certify safety. ($0.10 USDC on Base)

Argument	Type	Description
cik	string
since	string
mcpUrl*	string
ticker	string

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "mcpUrl"
  ],
  "properties": {
    "cik": {
      "type": "string"
    },
    "since": {
      "type": "string"
    },
    "mcpUrl": {
      "type": "string",
      "format": "uri"
    },
    "ticker": {
      "type": "string"
    }
  },
  "additionalProperties": false
}

package_install_preflight

npm or PyPI install preflight: blocks missing packages, detects near-name typosquats when an expected name is supplied, and checks OSV advisories. ($0.003 USDC on Base)

Argument	Type	Description
name*	string
version	string
ecosystem*	string
expectedName	string

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "ecosystem",
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "minLength": 1
    },
    "version": {
      "type": "string"
    },
    "ecosystem": {
      "enum": [
        "npm",
        "PyPI"
      ],
      "type": "string"
    },
    "expectedName": {
      "type": "string"
    }
  },
  "additionalProperties": false
}

payment_info

Free guide to the FHI MCP tools, Base-USDC x402 payment flow, and per-tool prices.

No arguments.

Input schema (JSON)

{
  "type": "object",
  "properties": {}
}

sec_material_event_delta

New SEC 8-K, 6-K, and late-filing evidence since a cursor date; accepts a ticker or CIK. ($0.01 USDC on Base)

Argument	Type	Description
cik	string
since*	string
ticker	string

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "since"
  ],
  "properties": {
    "cik": {
      "type": "string"
    },
    "since": {
      "type": "string",
      "minLength": 1
    },
    "ticker": {
      "type": "string"
    }
  },
  "additionalProperties": false
}