{"ok":true,"tool":"mcp-tool-surface-audit","name":"MCP Tool Surface Audit — Agent Tool Permission Risk","calls":100,"credits_per_call":4,"required_credits":400,"x402":{"price_per_call":"$0.04","currency":"USDC","network":"Base + Solana","networks":["eip155:8453","solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"],"endpoint":"https://bounty-engineer-x402-prod.onrender.com/v1/mcp-tool-surface-audit"},"paypal":{"recommended_one_time_pack":{"id":"starter","amount_usd":"4.99","credits":500,"calls_covered":125,"checkout":"https://bounty-engineer-x402-prod.onrender.com/paypal/start?product=starter&utm_source=workflows"},"note":"Credits and USDC prices are separate payment options. No automatic subscription is selected."},"prepaid_endpoint":"https://bounty-engineer-x402-prod.onrender.com/v1/prepaid/mcp-tool-surface-audit","input_example":{"tools":[{"name":"search_docs","description":"Retrieve documentation","inputSchema":{"type":"object","properties":{"q":{"type":"string"}}},"annotations":{"readOnlyHint":true}},{"name":"execute_shell","description":"Run shell command on the agent host","inputSchema":{"type":"object"},"annotations":{"readOnlyHint":true}}],"policy":{"allow_tools":["search_docs"]}},"sample_output":{"ok":true,"mode":"mcp-tool-surface-audit","evaluated_tools":2,"outcome":"manual_review","metadata_risk_score":62,"findings":[{"tool":"execute_shell","severity":"high","reason":"potential_side_effect","categories":["exec"],"index":1},{"tool":"execute_shell","severity":"critical","reason":"conflicting_read_only_annotation","index":1},{"tool":"execute_shell","severity":"medium","reason":"tool_not_in_caller_allowlist","index":1}],"counts":{"critical":1,"high":1,"medium":1},"inventory_sha256":"267d493d115327ef684f5515ca6c3e6a6bdd85c6cc28c00f0d0e44592c04a216","assumptions":["Only caller-provided tool declarations were inspected; no MCP server was contacted.","Keyword signals are static heuristics, not a vulnerability scan or a tool-behavior guarantee.","Tool descriptions and readOnly annotations may be inaccurate; enforce authorization outside this report."],"charged_downstream":false,"server_called":false},"sample_note":"Worked example using published sample data only.","free_preview":"https://bounty-engineer-x402-prod.onrender.com/v1/free-preview?tool=mcp-tool-surface-audit","integration":{"method":"POST","headers":{"Authorization":"Bearer YOUR_PRIVATE_API_KEY","Content-Type":"application/json","Idempotency-Key":"UNIQUE_PER_LOGICAL_REQUEST","X-Max-Credits":"4"},"body":{"tools":[{"name":"search_docs","description":"Retrieve documentation","inputSchema":{"type":"object","properties":{"q":{"type":"string"}}},"annotations":{"readOnlyHint":true}},{"name":"execute_shell","description":"Run shell command on the agent host","inputSchema":{"type":"object"},"annotations":{"readOnlyHint":true}}],"policy":{"allow_tools":["search_docs"]}}},"limitations":["Never put your API key in a URL or public workflow export.","Reuse the same idempotency key for retries of the same input.","Execution of your own data requires a verified payment and available credits."]}