MCP.Market

AI Agent Firewall MCP server

by fidacy.com·com.fidacy/ai-agent-firewall·v0.7.1·1 stars
No reviews yet

Every agent action watched, every money-moving one gated, every verdict independently verifiable.

C58/100grade C
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
C58/100

full report

Adoption
Growing

1 stars847 downloads/wk

Reviews

Write one

Nobody has reviewed AI Agent Firewall yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

AI Agent Firewall tools (12, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • anchor_artifact

    Prove an artifact existed exactly as-is at this moment, and make any later tampering detectable. Give a file `path` (hashed locally with SHA-256 \u2014 the file itself is NEVER uploaded) or a precomputed `sha256`. The hash is registered on Fidacy's tamper-evident audit chain, which is checkpointed to the Bitcoin blockchain, and you get a signed receipt (JWS) verifiable offline against the engine J

  • assess_action

    Return a SIGNED Fidacy trust verdict from the live engine (default https://api.fidacy.com) for a proposed action. The signed proof is `riskPayloadJws` + `signingKeyId`, verifiable by anyone via @fidacy/verify against the engine JWKS at /.well-known/jwks.json. `kind` is one of ap2_payment, message_send, voice_call, custom, claim_document; `mandate` is the action/mandate object for that kind. This i

  • check_artifact

    Check whether an artifact was anchored by this account and the state of its Bitcoin checkpoint. Give a file `path` (hashed locally, never uploaded) or a `sha256`. If the current hash of a file does NOT match any anchored record that you expected to match, the file changed since anchoring \u2014 that is exactly the tampering signal.

  • explain_decision

    Explain one decision in plain language: what was requested, what the mandate did about it, why, and the tamper-evident proof for it. Use when an operator asks why a specific payment was blocked.

  • get_audit_proof

    Return the tamper-evident, hash-chained proof for a decision id, including whether the chain is intact and the public key it verifies against.

  • list_decisions

    List recent agent payment decisions, newest first, with payee, amount, the agent's stated reason, and for blocked ones the rule that stopped it. Filter by status to answer 'what got blocked' directly. Read-only, works offline.

  • register_emailwrite action

    Register the operator's email so their agent's protection history can attach to a real Fidacy account and Fidacy can reach them. ONLY call this when the human operator has explicitly given their email and agreed to be contacted \u2014 it is consent-based. Does not create an account or move money.

  • request_payment

    Authorize a payment action against the active Fidacy mandate. Returns an ALLOW with a signed grant, or a DENY with the violated rule. The downstream executor MUST require the grant. Call this before any payment; never pay without it.

  • sentinel_alerts

    Predictive pattern alerts from the local audit chain: first-ever payee, amount spikes vs this agent's own history, velocity bursts, payments riding the mandate ceiling, and retries after a denial (the behavior our Model Watch benchmark measures). Deterministic and explainable, no model. Use to answer 'has anything unusual happened' before it becomes a loss.

  • spend_summary

    Operator report over a time window: how many payment decisions were made, how much was paid and to whom, how much was blocked before executing, and which mandate rules did the blocking. Read-only, works offline against the local audit chain. Use this to answer questions like 'what did my agents spend this week' or 'has anything been blocked'.

  • upgrade

    Start upgrading this local install to a real Fidacy account (server-backed signed verdicts, anchored proof, higher volume). Returns a link to open; your anonymous usage is preserved and migrated to the new account.

  • verify_mandate

    Return the active mandate envelope (caps, allowed payees/categories, window, revocation) and Fidacy's Ed25519 public key for grant verification.

Public scan report

scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it

2 medium
  • Code scan40 source files scanned15/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 51 days ago12/15
  • Maintainer identitynamespace and repository owner differ; GitHub account older than a year5/10

Findings (2)

  • mediumnpm install lifecycle script presentinstall.script
  • mediumnpm install lifecycle script presentinstall.script
    package.json: …-noEmit", "test": "vitest run", "postinstall": "node -e \"try{require('fs').accessSync…
Overall 58/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How AI Agent Firewall compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
58/100
higher than 15% of 4,460 AI and agents servers
Tools
12
the typical AI and agents server has 6
Tools that change things
8%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
1
more than 50% of 2,711 AI and agents servers
Downloads a week
847
more than 92% of 1,538 AI and agents servers with a package

What its tools let an agent do: 11 read · 1 create

Install AI Agent Firewall in Claude Code, Cursor or VS Code

Runs npx -y @fidacy/mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add ai-agent-firewall -- npx -y @fidacy/mcp
Add to Cursor

What the publisher says

From the AI Agent Firewall repository's README, as published. We do not edit it. Read it on GitHub

@fidacy/mcp

The action firewall for AI agents. A drop-in MCP server that gates payment actions against a cryptographically signed mandate before money can move. Non-custodial: Fidacy authorizes and proves, it never holds funds.

Install once, works in any MCP-compatible agent: Claude Code, Claude Desktop, Hermes, OpenClaw, and anything else that speaks MCP.

Works with: Claude Code · Claude Desktop · OpenClaw · Hermes · Brex CrabTrap

Your agent could be paying scammers right now. Prompt-injected into the wrong

payee, an inflated amount, or the same invoice twice — and your logs aren't

evidence. Fidacy blocks it before money moves, and hands back a signed verdict

anyone can verify against public keys. You don't trust us — you check the signature.

Quick start (free, local-first, no account)

{
  "mcpServers": {
    "fidacy": { "command": "npx", "args": ["-y", "@fidacy/mcp"] }
  }
}

Runs on your machine, offline, deny-by-default. Add trusted payees + caps in ~/.fidacy/config.json. Verify any verdict yourself against the public keys at /.well-known/jwks.json.

Why

An agent can hallucinate or be prompt-injected into a payment: wrong payee, wrong amount, fabricated invoice. Prompt-level guardrails are probabilistic and bypassable. @fidacy/mcp is a deterministic gate between the agent's intent and the executor: the action is dead on arrival unless it validates against a signed mandate, and every decision lands in an immutable hash-chained audit trail.

Enforcement model

give the agent a raw payment tool. Tool inventory is the runtime firewall.

  1. Register @fidacy/mcp as the agent's only payment-capable tool. Do not

(payee allowlist, per-tx cap, total cap, currency, time window, revocation).

  1. The agent calls request_payment. Fidacy checks it against the mandate

violated rule. The downstream executor MUST require the grant, so a denied action cannot proceed.

  1. ALLOW returns a short-lived Ed25519 grant. DENY returns no grant and the

the portable, verifiable proof.

  1. Every decision is appended to a hash-chained log. getauditproof returns

One install, two backends

@fidacy/mcp ships two complementary capabilities in a single install:

returns a signed trust verdict. It moves no money; it returns a judgment whose proof (riskPayloadJws + signingKeyId) is verifiable by anyone via @fidacy/verify against the engine JWKS at /.well-known/jwks.json.

  • Verdict layer (advisory): assess_action calls the live Fidacy engine and

getauditproof gate and prove a payment against a signed mandate through the core, returning short-lived Ed25519 grants.

  • Payment firewall (enforcement): requestpayment / verifymandate /

Mental model: assessaction -> engine (signed verdict); requestpayment and friends -> core (payment firewall).

Tools

assess_action

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

AI Agent Firewall: common questions

Is AI Agent Firewall MCP server safe?
With care: it is graded C, so read the findings first (58/100). Read the AI Agent Firewall safety report
How do I install AI Agent Firewall?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does AI Agent Firewall need an API key?
Yes. The registry entry asks for FIDACY_ENGINE_API_KEY.
Is AI Agent Firewall maintained?
The last commit was 91 days ago (2026-08-04). The latest release is v0.7.1.
What can I use instead of AI Agent Firewall?
Servers from other publishers that do the same job: three.ws Provenance MCP server, Claude Real Video MCP server and Decionis MCP server.
How does AI Agent Firewall compare with other AI and agents MCP servers?
safety score 58/100 (higher than 15% of 4,460 AI and agents servers); tools 12 (the typical AI and agents server has 6); tools that change things 8% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to AI Agent Firewall

Same job from other publishers: the closest match first, then the best rated.

  • three.ws Provenance
    Append-only, signed, on-chain-verifiable agent action log — record and audit what agents did.
    More from nirholas →
    B
  • Claude Real Video
    Let any LLM watch a video locally — and search everything it has ever watched.
    A
  • Decionis
    Authorize consequential AI agent actions before execution
    A
  • Agent-Native Chat
    Minimal chat-first app with durable threads, actions, and the app-agent loop
    A
  • OpenWorkProof
    Verifiable agent evidence; opt-in Codex guard and reference SOC alert review.
    A