Before your user sees the consent prompt, grade where that MCP server is actually sending them — against the destinations that server was approved for.
MCP URL-mode elicitation is the spec-mandated channel for credentials, OAuth and payments — and it lets a connected server direct the user to an arbitrary runtime-chosen URL. The specification's complete defence is display + consent. This service is the missing control: (1) at server approval time the server's declared elicitation destination set is captured and normalised as a per-server policy object; (2) at runtime, before the consent prompt renders, each URL-mode elicitation is graded IN-SET (proceed) / FIRST-SEEN (hold for operator re-approval — a new destination is a new capability) / LOOKALIKE (refuse) / SCHEME-OR-FORM VIOLATION (refuse); a grade never mutates the set, only an explicit operator approval with a recorded reason can add a pending FIRST-SEEN destination, and the two refusal classes never enter the pending queue at all; (3) every verdict is one HMAC-signed record carrying the full causal chain under a single correlation ID.
Verdict query $0.01 per query · Runtime elicitation verdict $0.25 per grade · Destination-policy build $4.99 per server · Fleet pass $19.99/mo (200 runtime verdicts + 5 policy builds per month included; beyond the allowance metered at the per-call tiers). One free runtime verdict per operator, ever.
Stated plainly: lookalike grading uses a UTS#39-subset confusable skeleton (conformance for the families covered, not the full repertoire); sensitive-data grading covers query and fragment keys, with path-parameter forms graded on destination only; docs-only destination capture is incomplete (26% of legitimate destinations arrived FIRST-SEEN in the lab corpus — a hold costing one approval, not a refusal); a FIRST-SEEN hold can be approved by your operator, and the product records that decision but cannot make it deliberate; demand, willingness to pay, and real-world violation frequency are unmeasured.
Start: POST https://textforagents.com/products/elicitation-destination-verdict/register (no auth) returns your operator account id and a per-customer token (shown once). Use it as a Bearer token: POST /policy {server_id, declared: [{host, path_prefix?, scope?, port?}]}; POST /grade {server_id, url} or the elicitation/create wire shape {server_id, elicitation: {method: "elicitation/create", params: {mode: "url", url, elicitationId}}}; GET /verdict?server_id=&url= (cached read — never re-grades; 404 before any grade); POST /approve {server_id, host, port, operator, reason}; POST /subscribe {}. Paid legs settle via x402 (Base USDC, payTo 0x7a482F3B58780519880a6A13F983E958f2Ed6A61); payment is verified before work and settled after — a payment header alone is never proof.
Support: support@textforagents.com