MCP.Market

Rail MCP server

by tstockham96·io.github.tstockham96/rail-mcp·v0.1.1
No reviews yet

Budgets, propose-then-approve, and receipts for agents that buy for a human. Dry-run by default.

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Growing

0 stars331 downloads/wk

Reviews

Write one

Nobody has reviewed Rail yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Rail tools (7, 2 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • decide_proposal

    Approve or reject one pending proposal. This is the step a human should confirm. decision=approve settles the purchase: in the default dry-run mode it writes a settled_dry_run receipt, stamps a fake settlement ref (lsrq_dry_…), and decrements the remaining budget, without calling the network. decision=reject spends nothing and writes no receipt. The proposal can be decided only once; repeating the

  • get_budget

    Read the active budget, amount spent, amount remaining, and the count of pending proposals. Does not change the ledger, spend money, or contact Stripe or Link.

  • get_receipts

    Read receipts, newest first, including dry-run settlements and refunds. Does not refund, spend money, or contact Stripe or Link.

  • list_proposals

    Read purchase proposals filtered by status: pending (default), approved, rejected, or all. Does not approve, reject, spend money, or contact Stripe or Link.

  • propose_purchasewrite action

    Record a pending purchase intent only. Moves no money, creates no receipt, approves no card, and does not contact Stripe or Link. Needs a later human approval via decide_proposal before anything settles. When a budget exists and the amount is above what remains, the proposal is stored with over_budget set and still spends nothing.

  • refund_receiptwrite action

    Reverse a settled dry-run receipt and restore that amount to the remaining budget. This is the step a human should confirm. Does not contact Stripe or Link. A receipt can be refunded only once; repeating the call does not refund again. Refuses receipts that are not settled_dry_run.

  • set_budget

    Overwrite the local spend budget. Changes the ledger limit only. Does not spend money, approve a card, settle a purchase, or contact Stripe or Link. Passing the same amount again does not add to the budget.

Public scan report

scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it

no findings
  • Code scan4 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 3 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Rail compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 95% of 48,255 servers
Tools
7
the typical server has 7
Tools that change things
29%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
331
more than 82% of 12,191 servers with a package

What its tools let an agent do: 4 read · 3 change

Install Rail in Claude Code, Cursor or VS Code

Runs npx -y rail-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add rail-mcp -- npx -y rail-mcp
Add to Cursor

What the publisher says

From the Rail repository's README, as published. We do not edit it. Read it on GitHub

Rail MCP

Rail is a budget, approval and receipt layer that agents call when they buy something on a human's behalf, dry-run by default, wrapping Stripe Link for settlement rather than issuing cards.

It is not a marketplace, storefront, or outreach tool. Rail owns the budget, the approval gate, and the receipt ledger.

Quickstart

Requires Node.js 20+. Run the published package with npx -y rail-mcp. Default mode is dry-run: no network and no charges.

Claude Desktop and any other host that takes an mcpServers block:

{
  "mcpServers": {
    "rail": {
      "command": "npx",
      "args": ["-y", "rail-mcp"]
    }
  }
}

Cursor: one-click install (install links). The config value is the base64 of {"command":"npx","args":["-y","rail-mcp"]}.

Install Rail in Cursor

cursor://anysphere.cursor-deeplink/mcp/install?name=rail&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsInJhaWwtbWNwIl19

Grok Bot: add a custom MCP with npx -y rail-mcp.

Do not put Stripe or Link secrets (STRIPESECRETKEY, LINKACCESSTOKEN, or live-spend flags) in this shared snippet. Real charges stay off unless those gates are set on purpose, outside the shared config. See Stripe Link seam.

Ledger files (budget.json, proposals.json, receipts.json) are written to ~/.rail in the user home directory, or to RAILDATADIR when that is set. They are local state, not part of the npm package. The default does not follow the process working directory, so a host that starts the server from / still writes under the home directory.

Example

Set a budget, propose a purchase, have a human approve it, then read the receipt. Dry-run moves no money off the machine.

  1. setbudget → { "amountusd": 50, "note": "week1" }
  2. proposepurchase → { "merchant": "Acme", "amountusd": 12, "rationale": "need widgets" }
  3. getbudget still shows remaining 50.00 and openproposals: 1. The proposal is pending until a human decides.
  4. decideproposal → { "proposalid": "prop_…", "decision": "approve" }
  5. getreceipts returns one settleddryrun receipt with a settlementref. Remaining budget is 38.00.

Rejecting spends nothing. refund_receipt reverses a dry-run settlement and restores the budget.

Tools

Permission model

Proposing a purchase is cheap. Settling one is not. An agent may record intent without moving money. The human should confirm the call that settles a purchase or reverses a receipt.

Hosts should read title, description, and annotations from tools/list. Every hint is set explicitly. The spec defaults (readOnlyHint false, destructiveHint true, openWorldHint true) would otherwise treat every tool as a destructive open-world write. Rail's ledger is local. Default mode is dry-run: no network and no charge.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Rail: common questions

Is Rail MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the Rail safety report
How do I install Rail?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Rail need an API key?
No secret keys are declared. It reads 1 setting from the environment.
Is Rail maintained?
The last commit was 36 days ago (2026-09-29). The latest release is v0.1.1.
How does Rail compare with other MCP servers?
safety score 92/100 (higher than 95% of 48,255 servers); tools 7 (the typical server has 7); tools that change things 29% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.