Assay MCP server
io.github.JasonCZMeng/assay·v0.2.0x402 service-quality oracle: check a service's paid-probe quality tier and score before paying it.
0 stars32 downloads/wk
Reviews
Write oneNobody has reviewed Assay yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Assay tools (4)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
check_serviceFast pre-payment check of an x402 service. Returns Assay's quality tier
get_scoreDetailed quality report for an x402 service: composite score (0-100), component
rank_servicesOne call to order a list of candidate x402 services best-first by Assay's quality tier
top_servicesRanked list of x402 services Assay actively probes, best composite score first.
Public scan report
scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it
- Code scan2 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitystatic API keys via environment variables6/15
- Maintenancelast push 46 days ago12/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
How Assay compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 78/100
- higher than 57% of 48,255 servers
- Tools
- 4
- the typical server has 7
- Tools that change things
- 0%
- typical: 0%. Fewer write tools means less an agent can break
- Downloads a week
- 32
- more than 20% of 12,191 servers with a package
What its tools let an agent do: 4 read
Install Assay in Claude Code, Cursor or VS Code
Runs npx -y assay-oracle-mcp on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add assay -- npx -y assay-oracle-mcp
What the publisher says
From the Assay repository's README, as published. We do not edit it. Read it on GitHub
Assay
The quality oracle for the x402 agent economy — x402 being the open protocol that lets machines pay for HTTP APIs with stablecoin micropayments. Assay pays real USDC to probe machine-payable services, verifies what actually comes back, and sells the resulting quality scores — every rating backed by an on-chain payment receipt and a Bitcoin-anchored evidence trail.
Live: assay.nominal-labs.com · Leaderboard · Agent guide (SKILL.md)
The problem
Agents are starting to buy API responses from other machines over x402 — HTTP 402 payment challenges settled in USDC on Base (Coinbase's Ethereum L2), no accounts, no invoices. Tens of thousands of services already advertise themselves in discovery catalogs like the Coinbase x402 Bazaar. But an agent holding a wallet has no way to know which of them actually deliver: whether payment settles, whether the response matches the advertised schema, whether the data is even true. The trust signals that exist score liveness — uptime, latency, payment telemetry. Nobody pays these services and verifies what actually comes back. Paying to find out is the only real test — so that's what Assay does, on a schedule, with its own money, so your agent doesn't have to.
How scoring works
Assay probes a curated set of x402 services several times a day, at randomized times, with real paid requests. Each probe is scored on four independent checks:
Weights renormalize over the components a service has data for. A service's composite score (0–100) is computed over its trailing 30 days of probes and publishes only once it has 20+ probes spread across days — no scores from thin evidence. Tiers: gold ≥ 85, ok ≥ 60, otherwise avoid.
Why the history can't be quietly rewritten
Scores are only as trustworthy as the evidence behind them, so the probe corpus is append-only and publicly anchored:
in a per-day Merkle tree; the root is anchored to Bitcoin via OpenTimestamps (OTS) after a safety lag.
- Every probe row (settlement result, response hash, paid amount, tx hash) becomes a leaf
/api/digests.
- Daily Merkle roots and their OTS proofs are public at
the open in docs/CORPUS-LOG.md.
- Anything that ever touches recorded history — migrations, re-anchoring — is logged in
The accumulating corpus is the point: anyone can copy the code, but nobody can backdate the evidence — the anchors prove when each day's records existed.
Using Assay
HTTP — the oracle itself is an x402 service at https://assay.nominal-labs.com. Paid endpoints answer with an HTTP 402 payment challenge that any x402 client settles automatically:
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Assay: common questions
- Is Assay MCP server safe?
- Mostly: it is graded B (78/100). Read the Assay safety report
- How do I install Assay?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Assay need an API key?
- Yes. The registry entry asks for
ASSAY_WALLET_KEY. - Is Assay maintained?
- The last commit was 88 days ago (2026-08-08). The latest release is v0.2.0.
- How does Assay compare with other MCP servers?
- safety score 78/100 (higher than 57% of 48,255 servers); tools 4 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.