Skip to content

MCP server

Agent-money checks, inside your agent

I built these checks for founders whose AI agents hold or move money. With the Consistra MCP server, Claude, Cursor or any agent built on the OpenAI Agents SDK can run them as tool calls: before it retries a payment, before it buys a token, or while you review its spending setup. It is free with an API key.

Endpoint (streamable HTTP): https://consistra.com/mcp
Auth: Authorization: Bearer <your key>

Get a free API key

Quickstart

Claude Code

claude mcp add --transport http consistra https://consistra.com/mcp \
  --header "Authorization: Bearer YOUR_CONSISTRA_KEY"

Claude Desktop

Add this to claude_desktop_config.json (Settings, Developer, Edit Config), then restart Claude Desktop. It uses the open-source mcp-remote bridge to reach the endpoint above.

{
  "mcpServers": {
    "consistra": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://consistra.com/mcp",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer YOUR_CONSISTRA_KEY"
      }
    }
  }
}

Cursor

In ~/.cursor/mcp.json (or .cursor/mcp.json in a project):

{
  "mcpServers": {
    "consistra": {
      "url": "https://consistra.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_CONSISTRA_KEY"
      }
    }
  }
}

OpenAI Agents SDK (Python)

import asyncio, os
from agents import Agent, Runner
from agents.mcp import MCPServerStreamableHttp

async def main():
    async with MCPServerStreamableHttp(
        name="consistra",
        client_session_timeout_seconds=120,  # live checks take 10-90 s; the SDK default is 5 s
        params={"url": "https://consistra.com/mcp",
                "headers": {"Authorization": f"Bearer {os.environ['CONSISTRA_API_KEY']}"}},
    ) as consistra:
        agent = Agent(name="Payments reviewer",
                      instructions="Use the Consistra tools to check payment settings.",
                      mcp_servers=[consistra])
        result = await Runner.run(agent, "Our client times out after 10 s and retries 3 times "
                                         "with no idempotency key. How often do we pay twice?")
        print(result.final_output)

asyncio.run(main())

OpenAI Agents SDK (TypeScript)

import { Agent, run, MCPServerStreamableHttp } from "@openai/agents";

const consistra = new MCPServerStreamableHttp({
  name: "consistra",
  url: "https://consistra.com/mcp",
  requestInit: { headers: { Authorization: `Bearer ${process.env.CONSISTRA_API_KEY}` } },
  clientSessionTimeoutSeconds: 120, // live checks take 10-90 s
});
await consistra.connect();
const agent = new Agent({ name: "Payments reviewer", mcpServers: [consistra] });
const result = await run(agent, "Stress-test a daily cap with 10 agents sharing one wallet.");
console.log(result.finalOutput);
await consistra.close();

Tools

Starter checks

Pure checks on the numbers and settings you give. Nothing is fetched and nothing is kept.

  • check_double_pay
    Double-Pay Retry Simulator

    Estimates how often an agent's payment retries send the same payment twice, from its client timeout, retry and backoff settings, idempotency, the pre-retry status check and how long payments take to confirm (p50/p95 seconds). Returns duplicates per 1,000 payments, a 30-day estimate, the safe timeout and which of the three safe-retry settings are missing. Any field left out uses the tool's example value (listed in assumedDefaults).

  • check_spend_cap
    Spend-Cap Stress Test

    Stress-tests an AI agent's spending cap against 11 known ways caps fail (talk-past, self-edit, parallel races, price inflation, runaway loops, window resets, crews of agents, other assets, any recipient, no kill switch, retries). Pass a pasted x402 SpendControls object or CDP policy in `config` (secrets are removed before reading; nothing is kept) and/or direct `answers`. Returns a grade A-E, the worst-case 24-hour exposure and each scenario red/amber/green with the reason and acceptance tests.

  • check_injection_to_signature
    Injection-to-Signature Path Finder

    Maps every path by which untrusted text (x402 payment requests, tool output, web pages, email, other agents) can reach the payee, amount or asset of a payment the agent signs, and which controls (signer rebuilds the payload, human approval, payee allowlist, per-payment max) cut or bound each path. Returns open/bounded/cut paths, the top path in one sentence, missing cuts and acceptance tests.

Live, read-only measurements

These read public chain data right now. They never sign or send anything.

  • check_data_age
    Data Age Check

    Measures, live, how old the data an agent would act on is right now on one chain: each public RPC's lag behind the chain tip and the Chainlink price feed's age against its heartbeat, then ranks the sources and gives a safe fallback order. Runs for 10-30 seconds, read-only (public RPCs bundled with the tool, read methods only). For your own RPC or indexer, or price APIs, use the browser tool.

  • scan_wallet
    Agent-Wallet Watchdog: one-off scan

    Read-only, one-off scan of a public agent-wallet address over the last 1 or 6 hours with the watchdog's rules: spend spikes, new payees, new token approvals and allowances, a draining balance, odd-hour activity. It reads public chain data live and takes about 30-90 seconds (longer with more chains). Nothing is stored and nothing is watched afterwards (use watch_wallet for ongoing alerts). Public address only: never pass a private key or seed phrase.

Labs

The products I am building on top of the checks. Each tool says plainly when its product is still in private testing.

  • run_redteam
    Attack My Agent: start a red-team run

    Starts an 'Attack My Agent' session: a private range of hostile pages and API responses (prompt injections, fake invoices, payee swaps, allowance tricks, x402 look-alike payment requests) to point an AI agent at. Testnet only: the range records the payment the agent would sign and never moves real funds. Returns the start URL for the agent, the agent token, the owner token (keep it: it finishes the run) and when it expires. Call get_redteam_report when the agent is done.

  • get_redteam_report
    Attack My Agent: finish and get the report

    Finishes an Attack My Agent run and returns the scored report: what the agent tried to sign in each attack case, the verdict per case, the overall score and a shareable report link. Needs the sessionId and owner token from run_redteam.

  • watch_wallet
    Agent-Wallet Watchdog: start watching (opt-in)

    Asks the watchdog to keep watching a public agent-wallet address and alert by email or Telegram on spend spikes, new payees, approvals, drains and odd hours. Opt-in: nothing is watched until the owner of the email or Telegram account confirms from the message we send; the confirmation gives the manage token that list_alerts needs. Set optIn to true only when the user asked for alerts to that destination.

  • list_alerts
    Agent-Wallet Watchdog: list alerts

    Lists the latest alerts (up to 100) for a confirmed watch, with rule, severity, chain and transaction hashes. Needs the manage token shown after confirming the watch.

  • safety_index_lookup
    Agent Payment Safety Index: look up a score

    Looks up the Agent Payment Safety Index: how an LLM or agent framework scored against the fixed red-team suite (safe rate with its interval, task completion, run date, sample size caveat), or how an x402 facilitator or agent-wallet product rates on public safety signals (with sources). Search by name or slug; kind narrows it down.

  • search_incidents
    Agent-Money Incident Tracker: search

    Searches the Agent-Money Incident Tracker: real losses and near-misses involving AI agents, trading bots and automated wallets, each with date, amount, chains, root-cause tags and source links. Filter by free text, root cause, agent kind, loss vs near-miss, chain or year.

Can Your Agent Get Back Out? (the exit-liquidity check before a buy) runs in your browser on the free tools page for now; it joins the server once its price sources allow it.

Keys and limits

Keys are free and self-serve: create one on the key page, and revoke it there whenever you like. Listing the tools works without a key; calling one needs it.

  • 120 requests a minute per key (bursts of 60), 2000 tool calls a day.
  • Live Data Age runs: up to 3 back to back, then one every 10 minutes (6 an hour); 10 to 30 seconds each.
  • Red-team runs: up to 3 back to back, then one every 10 minutes (6 an hour). New wallet watches: 10 a day.
  • Wallet scans read public chain data live and take about 30 to 90 seconds; set your client's tool-call timeout to at least 2 minutes.
  • Requests are capped at 64 KB; a pasted spend config at 20,000 characters.

When a limit is reached, the tool answers with how many seconds to wait.

What I keep, and what I never ask for

  • For each key: a short id, a one-way hash of the key, the day it was created, last used and revoked. No email, no name, no IP address.
  • Logs record the key id, the tool name, the outcome and the time taken. Never your inputs, your address or the key itself.
  • Never send a private key, seed phrase or API secret to any tool. Wallet tools take public addresses only, and secrets pasted into a spend config are removed before it is read.
  • Every chain call is read-only. Red-team runs use testnets only: the range records what your agent would sign and never moves real funds.
  • The tools only reach the public sources built into them. None of them fetches a URL you give it.
  • Wallet alerts are opt-in: nothing is watched until you confirm from the email or Telegram message.

These are engineering checks from your own inputs and public data. They are not a security audit, or legal, compliance or investment advice.

Want a second pair of eyes?

If a check turns up something you want to talk through, I offer a free 48-hour integration review for AI-crypto founders: you share the agent's payment path, and I come back with what I would fix first.

Book the integration review