Safe4 MCP server
online · 100% uptimeai.safe4/safe4·v1.0.0Tests an AI agent's purchase against the task it was given. Paid per call in USDC via x402.
0 stars
Reviews
Write oneNobody has reviewed Safe4 yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Safe4 tools (2)
write = sends, deletes, buys or postssafe4_authorizeFreeDecide whether a proposed agent payment should proceed. Settled per call in USDC over x402. Called without ``payment`` it returns the price list rather than a decision; call it again with the signed payload to receive one. The task and the two allow-lists are the principal's constraints, not the agent's: they are what the purchase is tested against, so an agent that writes its own ``task`` is grading its own homework. Safe4 records every field it was given in the audit entry and marks the task context as request-supplied, so a substituted constraint is visible afterwards. Args: task: The task the agent was given, as stated by its principal. purchase: What is being bought. purchase_purpose: Why this purchase serves the task. amount: Decimal amount as a string, for example "25.00". currency: Currency of the proposed payment, for example "USDC". counterparty: Who would receive the payment. service_category: Category of the thing being bought. allowed_service_categories: Categories the principal permits. allowed_counterparties: Optional payees the principal permits. When supplied, payment to anyone else is denied. task_id: Optional caller-side task identifier, echoed into the audit. payment: An x402 payment payload for this call. Omit to receive the price list instead of a decision.
safe4_priceFreePrice and accepted payment networks for one Safe4 decision. Free to call. Returns the same x402 terms the HTTP endpoint advertises, so an agent can see the cost before committing to a paid call.
Public scan report
scanner v0.1.10 · 2026-10-30 · same rubric, same numbers if you re-run it
- –Code scanremote-only server, no package to scann/a
- Live reliabilityremote reachable in 454ms20/20
- Tool poisoning2 tool descriptions checked15/15
- Auth qualityopen endpoint, read-only tools10/15
- Maintenancelast push 64 days ago12/15
- Maintainer identityendpoint served from the registry-verified namespace domain8/10
How Safe4 compares
Against every graded Productivity MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 87/100
- higher than 70% of 1,299 Productivity servers
- Tools
- 2
- the typical Productivity server has 7
- Tools that change things
- 0%
- typical: 0%. Fewer write tools means less an agent can break
- Uptime
- 100%
- of our recent checks; the typical remote Productivity server answers 100%
- Response time
- 210 ms
- faster than 64% of 655 Productivity servers
What its tools let an agent do: 2 read
Install Safe4 in Claude Code, Cursor or VS Code
claude mcp add --transport http safe4 https://api.safe4.ai/mcp/
What the publisher says
From the Safe4 repository's README, as published. We do not edit it. Read it on GitHub
Safe4 — the payment firewall for AI agents, as an MCP server
Safe4 decides whether an AI agent's proposed payment should be allowed, by testing the purchase against the task the agent was actually given.
The case it exists for is the one budget limits miss: a payment that is inside every budget, in an allowed category, and to an approved counterparty — and is still the wrong purchase, because it does not serve the task.
This repository is the public manifest and client example for the hosted MCP server. The service itself runs at api.safe4.ai; there is no server to install.
Connect
Streamable HTTP, no installation:
{
"mcpServers": {
"safe4": {
"type": "http",
"url": "https://api.safe4.ai/mcp/"
}
}
}Connecting and listing tools are free. Only safe4_authorize is paid.
Tools
safe4_price — free
Returns the current price and the payment networks the endpoint accepts, so an agent can see the cost before committing to a paid call.
safe4_authorize — paid, settled per call in USDC over x402
Returns an ALLOW or DENY decision for a proposed payment, with a reason code, the concepts it matched, and a hash-chained audit entry.
Called without a payment it returns the x402 challenge instead of a decision. An x402-aware client pays and calls again with the resulting payload in the payment argument.
Arguments:
The task and the two allow-lists are the principal's constraints, not the agent's — they are what the purchase is tested against, so an agent that writes its own task is grading its own homework. Safe4 records every field it was given and marks the task context as request-supplied, so a substituted constraint is visible in the audit entry afterwards.
Try it without paying
The example runs the entire free surface — connect, list tools, read the price, fetch the challenge — and stops before signing anything. It needs only httpx: no key, no funded wallet.
python examples/mcp_buyer_demo.py https://api.safe4.ai --dry-runDrop --dry-run and set SAFE4BUYERPRIVATE_KEY to buy a real decision. That signs an EIP-3009 authorisation for exactly the amount and payee the server advertised, and nothing else; the script holds no custody and Safe4 never sees the key.
What a decision rests on
Four checks, in order, and a purchase must clear all of them:
permitted.
- Budget and caps — per-transaction, daily, and agent-scoped limits.
- Service category — the purchase's category must be one the principal
to anyone else is refused. This is the only check that sees a swapped payee; task text and category are identical in that attack.
- Counterparty — when the task declares allowed_counterparties, payment
says it is buying, not merely share a word or two with it.
- Task-to-purchase match — the task must account for what the purchase
Every decision is appended to a hash-chained audit log. Each entry carries the previous entry's hash, so the record is tamper-evident and continuous across restarts and redeploys.
Payment
Priced per call in USDC over x402. The endpoint advertises its terms in the 402 challenge; buyers pay on whichever advertised network suits them. Safe4 holds no wallet key and takes no custody of buyer funds.
Links
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Safe4: common questions
- Is Safe4 MCP server safe?
- Yes, by our scan: it is graded A (87/100). Read the Safe4 safety report
- How do I install Safe4?
- It runs remotely at api.safe4.ai. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
- Does Safe4 need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Safe4 maintained?
- The last commit was 69 days ago (2026-08-27). The latest release is v1.0.0.
- Is Safe4 up?
- 100% of our last 28 checks got an answer. We check remote servers about four times a day.
- What can I use instead of Safe4?
- Servers from other publishers that do the same job: SvGrid MCP server, Better Notion MCP server and Omnidim MCP server.
- How does Safe4 compare with other Productivity MCP servers?
- safety score 87/100 (higher than 70% of 1,299 Productivity servers); tools 2 (the typical Productivity server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.
Alternatives to Safe4
Same job from other publishers: the closest match first, then the best rated.
SvGridChecks AI-written SvGrid code against the real API, plus version-pinned Svelte 5 grid docs.not reviewedEstablishedA- Better NotionMarkdown-first Notion for AI agents -- pages, databases, blocks, and comments in one call.not reviewedEstablishedB
- OmnidimOfficial MCP server for OmniDimension. Drive voice agents, dispatch calls, and run bulk campaigns.not reviewedGrowingA
- devcoachProgressive in-context technical coaching in your AI agent — one local, free lesson per task.not reviewedGrowingA
