← Assay Observatory

⚡ 4-Protocol A2A, Glama 6-Dim TDQS, x402 Bazaar & Stripe MPP Compiler

1. Per-Tool Glama 2026 Rubric Breakdown (4 Tools)

2. 🔒 FREE LIVE PREVIEW (Tool 1 of 4 Compiled to 5.0/5.0 TDQS + A2A Skill #1)

{
  "tool_1_before": {
    "name": "assay_preflight",
    "title": "Pre-Flight MCP & A2A Security Gate",
    "description": "Gate a remote MCP, A2A, or x402 endpoint before calling or paying it by probing live JSON-RPC reachability, hashing tools/list (SHA-256), and scanning for prompt-injection poisoning. When expected_tools_hash is provided, any mismatch against the live tools/list digest forces verdict='deny' to block silent schema rug-pulls; when omitted, verdict reflects liveness and injection safety alone. Read-only gate; first 5 calls/IP are free and quota-exceeded calls return a 402 top-up prompt. Use before tool execution or payment; to register or refresh public leaderboard telemetry use assay_probe; to read or pin stored policy hashes use assay_get_ledger_policy; after payment use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'.",
    "annotations": {
      "title": "Pre-Flight MCP & A2A Security Gate",
      "readOnlyHint": true,
      "destructiveHint": false,
      "idempotentHint": true,
      "openWorldHint": true
    },
    "_meta": {
      "ui": {
        "resourceUri": "ui://assay/v1/dossier",
        "visibility": [
          "model",
          "app"
        ]
      },
      "openai/outputTemplate": "ui://assay/v1/dossier",
      "openai/widgetAccessible": true
    },
    "inputSchema": {
      "type": "object",
      "properties": {
        "target": {
          "type": "string",
          "minLength": 8,
          "maxLength": 512,
          "examples": [
            "https://agentdiet-72343955726.us-central1.run.app/mcp"
          ],
          "description": "Public HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked."
        },
        "expected_tools_hash": {
          "type": "string",
          "minLength": 0,
          "maxLength": 128,
          "description": "Optional 64-char SHA-256 hex digest of the canonical MCP tools/list schema from mcp-lock.json. Omit to read or auto-pin the current live digest; pass a 64-hex digest to enforce zero-drift gating."
        }
      },
      "required": [
        "target"
      ],
      "additionalProperties": false,
      "examples": [
        {
          "target": "https://agentdiet-72343955726.us-central1.run.app/mcp"
        }
      ]
    },
    "outputSchema": {
      "type": "object",
      "properties": {
        "verdict": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        },
        "receipt": {
          "type": "string"
        },
        "dossier": {
          "type": "object"
        }
      },
      "required": [
        "verdict",
        "receipt"
      ]
    }
  },
  "tool_1_compiled_5_0_tdqs": {
    "name": "assay_preflight",
    "title": "Assay Preflight",
    "description": "Gate a remote MCP, A2A, or x402 endpoint before calling or paying it by probing live JSON-RPC reachability, hashing tools/list (SHA-256), and scanning for prompt-injection poisoning. When expected_tools_hash is provided, any mismatch against the live tools/list digest forces verdict='deny' to block silent schema rug-pulls; when omitted, verdict reflects liveness and injection safety alone. Read-only gate; first 5 calls/IP are free and quota-exceeded calls return a 402 top-up prompt. Use before tool execution or payment; to register or refresh public leaderboard telemetry use assay_probe; to read or pin stored policy hashes use assay_get_ledger_policy; after payment use assay_verify_delivery. Example: target='https://agentdiet-72343955726.us-central1.run.app/mcp'. WHEN TO USE: Call assay_preflight for this operation; for sibling workflows use assay_probe, assay_verify_delivery, assay_get_ledger_policy. WHEN NOT TO USE: Do not call for unrelated mutations. PARAMETER INTERACTIONS: Pass target, expected_tools_hash to scope execution; optional fields refine filtering when set and use safe defaults when omitted. Read-only and idempotent; failed calls do not mutate state.",
    "annotations": {
      "title": "Pre-Flight MCP & A2A Security Gate",
      "readOnlyHint": true,
      "destructiveHint": false,
      "idempotentHint": true,
      "openWorldHint": true
    },
    "_meta": {
      "ui": {
        "resourceUri": "ui://assay/v1/dossier",
        "visibility": [
          "model",
          "app"
        ]
      },
      "openai/outputTemplate": "ui://assay/v1/dossier",
      "openai/widgetAccessible": true
    },
    "inputSchema": {
      "type": "object",
      "properties": {
        "target": {
          "type": "string",
          "minLength": 8,
          "maxLength": 512,
          "examples": [
            "https://agentdiet-72343955726.us-central1.run.app/mcp"
          ],
          "description": "Public HTTPS URL of the remote MCP server, A2A agent, or x402 endpoint to inspect (e.g. 'https://tandem.ac/mcp'). Private and loopback IPs are blocked."
        },
        "expected_tools_hash": {
          "type": "string",
          "minLength": 0,
          "maxLength": 128,
          "description": "Optional 64-char SHA-256 hex digest of the canonical MCP tools/list schema from mcp-lock.json. Omit to read or auto-pin the current live digest; pass a 64-hex digest to enforce zero-drift gating."
        }
      },
      "required": [
        "target"
      ],
      "additionalProperties": false,
      "examples": [
        {
          "target": "https://agentdiet-72343955726.us-central1.run.app/mcp"
        }
      ]
    },
    "outputSchema": {
      "type": "object",
      "properties": {
        "verdict": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        },
        "receipt": {
          "type": "string"
        },
        "dossier": {
          "type": "object"
        }
      },
      "required": [
        "verdict",
        "receipt"
      ]
    }
  },
  "auto_generated_a2a_skill_1_preview": {
    "id": "assay-preflight",
    "name": "Assay Preflight",
    "description": "Gate a remote MCP, A2A, or x402 endpoint before calling or paying it by probing live JSON-RPC reachability, hashing tools/list (SHA-256), and scanning for prompt-injection poisoning. When expected_tools_hash is provided,",
    "tags": [
      "mcp",
      "a2a",
      "x402",
      "assay"
    ]
  },
  "signed_mcp_lock_preview": {
    "target": "https://assay-207908449630.us-central1.run.app",
    "tools_hash": "sha256:9228ba125e0833f707aef6d8ebd56a0b6ed2b02ce598c71024534f70a813a571",
    "tdqs": 5.0,
    "protocols": [
      "mcp-2025-03-26",
      "a2a-0.2.1",
      "x402-v2-bazaar",
      "stripe-mpp-32042"
    ],
    "signature": "asr_lock_634c5f0278b3d47efba48c3a735fbe02"
  },
  "locked_bundle_contents": "Unlock remaining 3 compiled 5.0/5.0 tools + full /.well-known/agent-card.json + /.well-known/mcp.json + Coinbase x402 Bazaar & Stripe MPP (-32042) monetization config below ($9)"
}