mcpindex.ai
← Index

io.github.100xPercent/pop-pay

io.github.100xPercent/pop-pay·v0.5.7·Security

Runtime security for AI agent commerce. CLI + MCP server blocks hallucinated purchases.

Trust verdict · v1 advisory · method
NOT YET SCREENEDno verdict on file

Verdict not yet evaluated for this tool. The semantic screen takes adversarial cases first; coverage rolls out as the corpus expands (15/150 labels to graduation). The deterministic conformance probe is built but has not yet run on the public corpus, so a recorded verdict here is REVIEW or UNVERIFIED, never a clearing ALLOW. Until a verdict is recorded, an agent should treat this tool as not-yet-cleared and fall back to its own checks. Method: the eval, four-state verdict, honest limits.

Own this server? Screen its description →

Environment variables
POP_CDP_URL

Chrome DevTools Protocol endpoint for credential injection (default: http://localhost:9222)

POP_ALLOWED_CATEGORIES

JSON array of allowed vendor categories (e.g. '["aws","cloudflare"]')

POP_MAX_PER_TX

Per-transaction spending limit in USD

POP_MAX_DAILY

Daily spending limit in USD

POP_GUARDRAIL_ENGINE

Guardrail engine: 'keyword' (offline, default) or 'llm' (requires API key)

MCP quality score · maturity, not trust · methodology
freshness
23
completeness
10
installability
25
documentation
15
stability
5
Alternatives in Security
ai.dynamicfeed/dynamic-feed
ai.dynamicfeed/dynamic-feed

87 keyless tools of live, verifiable data for AI: weather, hazards, space, CVEs. Ed25519-signed.

Helixar Security
ai.helixar/mcp

Security tools for AI agents: scan MCP servers, validate HDP delegation chains, audit releases.

RFP.ai
ai.rfp/rfp-ai

Draft cited RFP and security questionnaire answers from your knowledge base, with human review