A-

agent-embassy.fly.dev

https://agent-embassy.fly.dev/mcp
92/100 · MCP Trust Grade · checked 2d ago · MCP 2025-06-18

Is the agent-embassy.fly.dev MCP server safe to use?

Independent trust grade A- (92/100). No blocking issues found in the static + spec checks. wmcp.sh continuously watches agent-embassy.fly.dev for tool drift and rug-pulls. The grade is free and identical whether or not the operator pays.

✓ Watched since 2026-10-27 — behavioral baseline locked. We re-check this server's tool surface on a schedule; if it adds, removes, or silently rewrites a tool (rug-pull), we record it.

What it offers — 25 tools · Developer Tools

register_recovery

Escrow an encrypted recovery blob: stored opaquely — we cannot decrypt it — for operator review, signed receipt proving its hash; quorum_rules govern

check_url_custom

Your conditions, one fetch: status, substring, JSON value — signed pass/fail receipt. Default status 200. Public proof: check_url_sealed. Watch: check

check_url_sealed

Proof anyone can verify: one fetch, transcript sealed in a signed receipt — HTTP 200 at that moment, fixed at 200. Your own conditions instead: check_

compute_spot_sealed

GPU price, sealed proof: snapshot, cheapest ask/class, signed receipt. type defaults ondemand; omit gpu = all classes. Raw: compute_spot_prices. POST

trust_report

Buy/don't-buy verdict on an x402 endpoint: probed unpaid, signed PROCEED, VERIFY_FIRST, or DO_NOT_PAY. Terms: trust_preflight. Action gate: trust_assu

trust_preflight

Before paying: who is paid, what's delivered, what changed — signed verdict against your policies. Free quote: dry_run=true. Endpoint verdict: trust_r

compute_history

GPU market memory: cheapest and median asks per class, in a signed receipt. limit defaults to 50. Live: compute_spot_prices. Moves: compute_alerts. PO

compute_alerts

GPU price moves that matter: significant spot moves, in a signed receipt. limit defaults to 25. Live snapshot: compute_spot_prices. Past: compute_hist

research_paper

The research paper: $1.00; $2.00 with the provenance pack — paper plus its proof. bundle defaults to paper; prior receipt: $1.00 upgrade. Licensed to

trust_assurance

Action gate: endpoint, action, amount, permissions probed unpaid — ALLOW, RESTRICT, ASK_HUMAN, or QUARANTINE. Verdict: trust_report. Terms: trust_pref

agentid_issue

Issue an Agent ID: attestation binding a pubkey to a verified principal — unverifiable are refused. validity_days defaults to standard. Verify: agenti

agentid_verify

Agent ID state — valid, revoked, expired, or unknown — chain + envelope included. Unknown IDs: unknown, never error. Issue: agentid_issue; extend: age

agentid_revoke

Retire an Agent ID instantly, with no successor: sign as the revocation_signature field specifies — who signs, and how. Fresh ID, same chain: agentid_

agentid_renew

Renew an Agent ID: fresh ID, same chain; the old retires. Sign like a revocation. validity_days defaults to standard. Retire outright: agentid_revoke.

correct_copy

$1.00 correction pass on your draft: formatting, links verified live, terms confirmed, leaks scanned — corrected copy + signed report. register sets t

give

Support the Embassy. Open-amount USDC gift, $0.01–$222. The signed quote binds your exact amount; receipt: patronage, never for work. POST the tool in

attest_document

Prove a document existed: send its SHA256 hash — we never see it — for a signed, hash-chained attestation. document_name is an optional label. Live UR

diligence_pack

All checks, one call: liveness, content, TLS fingerprint, trust verdict, doc timestamp — one signed receipt. document_hash optional. One check: the to

+7 more tools

Spec conformance20%100
Security (OWASP MCP)30%100
Reliability / performance20%84
Tool hygiene15%100
Transparency / provenance15%70

Observed behavior

No proxied traffic observed for this host yet. Connect it at /connect and its grade gains a measured Reliability score + per-tool behavioral evidence — the half a static scan can't produce.

Findings

No blocking issues found in the static + spec checks.
Grade another server

We re-grade agent-embassy.fly.dev on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.

Run agent-embassy.fly.dev? Claim it (free) to get drift alerts and show an independently-verified trust badge. The grade stays free — claiming just ties it to you.

Share this report card

A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.

MCP Trust report card — agent-embassy.fly.dev grade A-
Share on X Open card image

Embed this grade

A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.

MCP Trust Grade A- · wmcp.sh
[![MCP Trust Grade A-](https://wmcp.sh/mcp/grade/agent-embassy.fly.dev/badge.svg)](https://wmcp.sh/mcp/grade/agent-embassy.fly.dev)
<a href="https://wmcp.sh/mcp/grade/agent-embassy.fly.dev"><img src="https://wmcp.sh/mcp/grade/agent-embassy.fly.dev/badge.svg" alt="MCP Trust Grade A- · wmcp.sh"></a>

Agents: check this before connecting

Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:

https://wmcp.sh/mcp/trust
How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.