crosscheck MCP server

crosscheck

Independent checks for AI agents, paid per call over x402:

• check: a second opinion on your agent's draft before your human sees it. $0.02. Send the sources the draft relies on and each claim is checked against them too.
• accept: a check of work another agent or service hands back, before your agent pays for it, releases escrow, or passes it on. $0.03.
• skillcheck: a security review of a skill or MCP server before your agent installs it. $0.03, free for files someone already scanned.

Agents write emails, reports, client messages, and PR descriptions. The agent that wrote a draft is the worst one to check it. crosscheck is a separate reviewer: your agent sends the text and gets back a verdict, either pass or a list of specific issues with fixes, plus an Ed25519-signed receipt.

Each check costs $0.02 in USDC on Base, paid per request over x402. There is no account, no API key, and no subscription. You can try it for free with test USDC on Base Sepolia, up to 10 checks per wallet per day.

What it catches

• Wrong arithmetic. The model extracts each calculation and code recomputes it, so a wrong total like "640 + 910 = 1,350" is caught by math, not by a guess.
• Contradictions between parts of the draft: dates, names, and amounts that disagree.
• Leftovers: [NAME] placeholders, TODOs, and content the draft promises but does not contain ("the three options below", followed by one).
• Leaked secrets such as API keys and passwords (reported without repeating them).
• Commitments your agent may not be allowed to make: discounts, deadlines, refunds.
• Tone that does not fit the reader.
• Prompt injection: text aimed at an AI reviewer. A draft containing it never passes.

accept: check work another agent hands back

Agents increasingly buy work from other agents: research, data, code, drafts. The buyer needs to know the work meets the task before it pays. Send the task you gave and the deliverable you got back:

{"task": "List 5 competitors of Acme Robotics as a JSON array. Each item needs name, hq (city), and founded (year).",
 "deliverable": "[{\"name\": \"Northwind Robotics\", \"hq\": \"Denver\", \"founded\": 2011}, {\"name\": \"Globex Automation\", \"hq\": \"Austin\"}]"}

You get accept or reject, with every requirement judged:

{"accept": false,
 "summary": "Rejected: 2 of 4 requirements not met. First: List 5 competitors (no).",
 "requirements": [
   {"requirement": "List 5 competitors", "met": "no", "evidence": "Counted 2 items; the task asks for exactly 5 items.", "subjective": false, "blocking": true},
   {"requirement": "Each item needs founded (year)", "met": "partly", "evidence": "Checked all 2 items: \"founded\" is missing in item 2.", "subjective": false, "blocking": true}]}

(The two requirements that passed are left out here.) Counts, required JSON fields, and figures are checked in code, not by the model. A deliverable that claims its own completeness, or tries to talk the checker into accepting, never passes. The signed receipt holds hashes of the task and the deliverable and your optional reference (an order id or transaction hash), so both agents can see exactly what was checked.

skillcheck: scan a skill before you install it

Skills and MCP servers run with your agent's access to files, keys, and money, and malicious ones are common on public registries. skillcheck reads a skill's files (never runs them) and reports what they could do: downloads piped into a shell, reads of SSH keys, cloud credentials, and wallets, environment variables sent over the network, persistence, lookalike (typosquatted) package names, invisible characters, and instructions aimed at your agent or at the scanner. Code rules catch the known patterns; the review model judges intent against what the skill says it does.

npx -p crosscheckapi crosscheck skillcheck ~/.claude/skills/some-skill

Shortened. The full README is on GitHub.