Before your user sees the consent prompt, grade where that MCP server is actually sending them — against the destinations that server was approved for.
MCP URL-mode elicitation is the spec-mandated channel for credentials, OAuth and payments — and it lets a connected server direct the user to an arbitrary runtime-chosen URL. The specification's complete defence is display + consent: show the full URL, highlight the domain, get a click. A user shown an unfamiliar hostname has no policy to judge it against, a registry approves the server statically while the destination appears only at runtime, and a secure web gateway sees the navigation without the provenance to join it to the server that caused it. This service is the missing control. (1) Destination policy — at server approval time, the server's declared elicitation destination set (identity providers, payment processors, SaaS auth endpoints, its own credential pages) is captured and normalised as a per-server policy object. (2) Pre-consent grade — at runtime, before the consent prompt renders, each URL-mode elicitation is graded: IN-SET (proceed) / FIRST-SEEN (a new host for this server — hold for operator re-approval; a new destination is a new capability) / LOOKALIKE (confusable-skeleton, edit-distance, or subdomain-spoof relation to an in-set host — refuse) / SCHEME-OR-FORM VIOLATION (non-HTTPS, pre-authenticated URL, sensitive data in the URL, numeric-IP encodings — the spec's own server MUST NOTs, checked mechanically — refuse). A grade never mutates the set; only an explicit operator approval with a recorded reason can add a pending FIRST-SEEN destination, and the two refusal classes never enter the pending queue at all — no operator action, including a rubber stamp, can approve them. (3) Causal record — every verdict is one signed record carrying the full chain (user request → agent → server → tool → elicitation → destination → approval → navigation) under a single correlation ID, so an incident reconstructs end-to-end from the records alone. Sold per fleet to operators, per verdict to agents mid-flow, and as a declared-destination badge to server publishers.
Verdict query $0.01 (x402) · Runtime elicitation verdict $0.25 · Destination-policy build $4.99/server · Fleet pass $19.99/mo (200 runtime verdicts + 5 policy builds per month included; beyond the allowance metered at the per-call tiers). One free runtime verdict per operator, ever.
Stated plainly: lookalike grading uses a UTS#39-subset confusable skeleton (conformance for the families covered, not the full repertoire); sensitive-data grading covers query and fragment keys, with path-parameter forms graded on destination only; docs-only destination capture is incomplete (26% of legitimate destinations arrived FIRST-SEEN in the lab corpus — a hold costing one approval, not a refusal); a FIRST-SEEN hold can be approved by your operator, and the product records that decision but cannot make it deliberate; demand, willingness to pay, and real-world violation frequency are unmeasured.
Support: support@textforagents.com