Is 402Signal MCP server safe?

Findings (3)

• highWrite-action tools reachable without authenticationauth.open-write
• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool check: …Runs the paid pre-flight check on a live paid API endpoint: probes one exact HTTPS url, or the candidates discovered for a need, applies the buyer's price, network and readiness rules, and returns the selected offer with signed evidence of what the seller quoted (price, recipient, asset, network, expiry) before the agent pays the seller. Does not buy the seller's service, hold keys or pay anything for the agent; the agent keeps its wallet and pays the seller separately. Use preview to discover candidates without paying, validate for a free readiness check of one listed URL, and check when a fresh live observation or a signed receipt is needed before a seller payment. Never call check to pay a seller. After billing.settlement_state=unknown, stop and reconcile; never create another authorization. route is the former name of this tool and is still accepted. Cost and outcomes: the first unsigned call answers HTTP 402 with the $0.003 USDC checking-fee terms (Base, Solana or Algorand), which an x402-capable HTTP client pays. The fee settles only when a qualifying live offer is found; a completed miss (HTTP 200, live=false, typed miss_reason) is free; a settled fee is not reversed if the offer later changes. HTTP 503 with binding_error=route_binding_unavailable means the seller answered but no probed candidate could be bound to a signed receipt: a completed unpaid answer, not an outage (the reference wrapExactAuthorize reports state=binding_unavailable with keep_calling_route true). Parameter interactions: need or url is required; with both, url is probed directly and no discovery runs. policy is plain English compiled into the structured fields; an explicit structured field wins over the compiled value, and phrases that do not compile are echoed in unresolved_constraints, never guessed. networks is a hard allowlist judged on the current 402; prefer_network only orders results and never filters. Three independent price bounds: max_price_usd (seller price in USD), max_amount_atomic (atomic units of the seller's asset) and max_total_cost_usd (seller price plus known fees); every bound fails closed when its value is unknown. require_route_binding=true implies require_transparency and may select the next bindable candidate. Defaults: objective best, search_depth standard (up to 7 probes; thorough up to 15; hard ceiling 20), accept_payTo_change false, require_route_binding false. Guide: https://402signal.com/developers#route-binding…

• lowNo source repository listedmaint.no-repo