{"name": "MCP OAuth remediation verification", "provider": "TextForAgents LLC", "version": "1.0.0", "what_it_does": "Verifies, per MCP client, that the OAuth credential leak fixed in the official SDKs is actually closed: (1) SDK version at/above the fixed floor (Python mcp >=1.30.0, TypeScript SDK >=1.31.0), (2) every OAuth provider construction carrying issuer= / expectedIssuer, (3) every stored registration carrying an issuer binding (metadata-only inspection), proven behaviourally against a hosted hostile test server naming a canary authorization server, dummy credentials only. Returns a per-client verdict and a remediation receipt naming the exact missing leg.", "verdicts": ["VULNERABLE-VERSION", "UNBOUND-PROVIDER", "UNBOUND-STORAGE", "LEAKS", "BOUND", "UNKNOWN"], "prices": {"per_client_verification": "$0.25 per client per run (x402, Base USDC)", "fleet": "$5/mo per operator \u2014 up to 200 clients; scheduled static + storage scans, live canary leg on change and on new-server onboarding; extra live re-verifications $0.25/client/run", "one_off_fleet_audit": "$49 per audit \u2014 one full three-leg + live-canary pass over up to 200 clients, full receipt set, no subscription", "trial": "first 10 client verifications free, one time per operator account"}, "pay_to": "0x7a482F3B58780519880a6A13F983E958f2Ed6A61", "how_to_start": "POST /register {\"operator\": \"your-name\"} -> token (shown once); POST /trial with the Bearer token claims the one-time free grant; POST /verify with the token (trial/Fleet) or with an x402 payment; POST /subscribe {\"plan\": \"fleet\"|\"audit\"} is x402-gated at the plan price.", "endpoints": {"verify": "POST /verify", "verify_fleet": "POST /verify-fleet", "register": "POST /register", "trial": "POST /trial", "subscribe": "POST /subscribe", "receipts": "GET /receipts", "receipt": "GET /receipts/{id}", "tokens_revoke": "POST /tokens/revoke", "schedules": "POST /schedules (Fleet: register scheduled scans); GET /schedules; DELETE /schedules/{id}", "canary_token": "POST /canary/token", "hostile_metadata": "GET /hostile/.well-known/oauth-protected-resource", "canary_metadata": "GET /canary/.well-known/oauth-authorization-server", "mcp": "POST /mcp", "openapi": "GET /openapi.json", "llms_txt": "GET /llms.txt", "x402_discovery": "GET /.well-known/x402", "health": "GET /health"}, "limits": ["v1 covers Python + TypeScript only; Rust rmcp clients verdict UNKNOWN with an explicit out-of-scope reason, never BOUND.", "Dummy credentials and binding metadata only: a submission carrying a real credential value is rejected at the boundary and never logged or stored.", "Storage inspection reads only the issuer binding key; credential values never appear in any output.", "Per-file source limit 1 MB (leg verdict TOO-LARGE); fleet passes cover up to 200 clients.", "Scheduled scans (Fleet, opt-in): the submitted client set is stored under your account so the scheduler can re-scan it on schedule; delete the schedule to remove it. One-off submissions are never stored beyond the receipt.", "Scheduled scans are capped at 10 schedules per account (up to 200 clients each).", "A BOUND verdict certifies only the clients and configurations tested, against the canary hostile-server shape.", "Lost-token recovery is a manual step via support@textforagents.com."], "support": "support@textforagents.com"}