ddg-agent-payable-servicesBLOCK
mcp/daedalusdevelopmentgroup/ddg-agent-payable-services
Pay-per-call x402 gateway for AI agents — MCP server + OpenAI-compatible API for agent tools, market data, RPC, and MCP security audits. Pay in USDC on Base, no account.
Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
54 45r · 9w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
0
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
mcp-name: com.daedalusdevelopmentgroup/ddg-agent-services-mcp
This directory contains the machine-readable launch artifacts and local scaffold for turning Hermes/DDG into a paid service surface for other AI agents.
Current launch wedges
- One-cent transaction smoke test (
/v1/tx-smoke-test) — $0.01 receipt-only paid request so other AI agents can prove they can complete a DDG paid HTTP transaction. - Website audit (
/v1/site-audit) — read-only; launch settlement-test price $0.75. - Model router / basic conversation (
/v1/model/chat-completions,/v1/model/agent-run) — paid access to DDG-operated model routing using explicit model aliases; supports basic chat, analysis, code/help prompts, and bounded agent tasks. - Operator-reviewed OAuth/model artifact run (
service_id=provider_model_artifact_orderthrough/v1/order-intake) — DDG-operated account/provider-backed model work only where terms permit; no raw token/account/seat resale. - Lead pack (
/v1/lead-pack) — paid local business intelligence; launch price $5. - Browser proof (
/v1/browser-proof) — paid screenshots/QA proof; launch price $2. - Outreach brief (
/v1/outreach-brief) — paid draft only; no sending without human approval; launch price $1.50. - Ethereum private RPC query (
/v1/ethereum/rpc) — implemented read-only, method-whitelisted Reth proxy with sync gate, fair-use lease timer, per-agent request caps, max batch size, and upstream max-concurrency cap; public self-serve waits for execution sync/health. - Local model free-seat pool (
/v1/micro-model-swarm-preview,/v1/model/agent-run,/v1/ollama-models) — live free/best-effort Ollama local routes with one concurrent generation seat per healthy configured local runtime backend, capped at two by default for configured 8GB-VRAM backends. Defaults: 24-hour per-agent lease, 100 reques
Read from source at commit
b071fe4fa406OBSERVED · 2026-10-1102
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude-code (pypi)
claude mcp add ddg-agent-services-mcp --env DDG_PRIVATE_KEY=${DDG_PRIVATE_KEY} -- None ddg-agent-services-mcp==0.10.103
Exposed tools (54)
45 read · 9 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ddg_address_validate | read | US street address parse + normalize with completeness score ($0.003). |
ddg_agent_distribution_targets | read | Return the AI-agent radar surfaces DDG is targeting and their current go-live gates. |
ddg_agent_reputation_lookup | read | Reputation for an agent id / seller endpoint / payTo: DDG-rail settlement history + public signals, explainable score ($0.002). |
ddg_agent_status | read | Return DDG |
ddg_calendar_parse | read | Parse 20+ datetime formats -> ISO/UTC + epoch + day-of-week, optional ICS ($0.001). |
ddg_call | write | Invoke any DDG service by service_id or /v1/ path with JSON args. |
ddg_card_fingerprint | read | BIN/IIN fingerprint: network, expected length, Luhn validation. Masked output ($0.002). |
ddg_checkout_conformance | read | Return DDG |
ddg_crypto_portfolio | read | Consolidated USD value of 1-10 addresses (native + USDC on ethereum/base) ($0.003). |
ddg_crypto_price | read | USD prices for eth/usdc/usdt/wbtc/aero/degen etc. 60s cached ($0.001). |
ddg_data_query | read | Call an allowlisted DDG paid data endpoint (prediction-markets, dex-pairs, model-catalog, price-feed, dns-lookup, web-search, contract-abi, etc.). |
ddg_direct_crypto_addresses | read | Return DDG |
ddg_dispute_evidence_pack | read | Bundle DDG receipt lookups + Base on-chain tx proofs into a sha256-pinned evidence file ($0.05). |
ddg_domain_age | read | WHOIS domain creation date + age + trust band ($0.001). |
ddg_eth_gas | write | Gas price, base fee trend, priority bands, simple-transfer cost USD ($0.001). Chains: ethereum/base/arbitrum/optimism. |
ddg_ethereum_rpc_query | read | Proxy a free read-only Ethereum JSON-RPC query through DDG |
ddg_fetch_public_resource | read | Fetch an allowlisted DDG public manifest/doc by id or ddg:// URI with redaction and size caps. |
ddg_gas_multi | write | Gas + transfer cost across ethereum/base/arbitrum/optimism in one call ($0.002). |
ddg_html_to_structured | read | Extract structured JSON from raw HTML via CSS selectors ($0.002). selectors={ |
ddg_list_local_runtime_options | read | List free-seat status plus requestable local runtimes such as Ollama, llama.cpp, LM Studio, OpenAI-compatible servers, and vLLM. |
ddg_list_models | read | List local/free Ollama models and queryable paid/account-backed route labels. |
ddg_list_services | read | List DDG live/manual services from the public pricing and catalog surfaces. |
ddg_mcp_security_profile | read | Return this MCP wrapper |
ddg_micro_swarm_preview | write | Run the free DDG micro-model-swarm preview with a local Ollama mini-model. |
ddg_model_compare | read | Same prompt to 2-3 LOCAL models (Ollama) with agreement score ($0.01). Account-backed models are rejected. |
ddg_order_artifact | write | Fetch an agent-scoped DDG order artifact when ready. |
ddg_order_status | write | Poll an agent-scoped DDG order status URL. |
ddg_phone_intel | read | Phone parse/validate: E.164, country, line type, carrier hint ($0.002). |
ddg_prompt_cost_budget | read | Cost ladder for a workload across DDG routes, cheapest first ($0.002). |
ddg_public_resource_index | read | List allowlisted DDG public manifests/docs available as MCP resources. |
ddg_quote_payment | read | Return the payment challenge for a supported DDG protected route without executing backend compute. |
ddg_receipt_escrow_release | read | Open an escrow case: DDG holds the release decision until a completion receipt validates ($0.01, operator-verified). |
ddg_receipt_verify_design | read | Describe the planned free receipt-verification tool contract. |
ddg_regex_builder | read | Named regex template (email, url, eth_address, tx_hash, ...) with live matching, or test a pattern against samples with ReDoS risk ($0.002). |
ddg_request_ollama_model | read | Queue a local model/runtime request. This never auto-downloads by public request. |
ddg_robot_delegation_chain_audit | read | Multi-robot delegation-contract audit: monotone caps, per-hop expiry + revocation, chain aggregate ($0.01). |
ddg_robot_fleet_quota_audit | read | Robot fleet spend-quota audit: per-robot caps, aggregate cap, unique ids, rate bound ($0.01). |
ddg_robot_geo_fence_audit | read | Physical/geographic authority audit: geofence, vertical bounds, outdoor scoping, speed cap ($0.01). |
ddg_robot_human_takeover_audit | read | Human handback audit: pause signal, handover latency, operator ack, resume policy ($0.01). |
ddg_run_paid_model | write | Run a paid model/chat or agent-run route after caller supplies valid payment headers. |
ddg_search_services | read | Find DDG agent-callable services matching a natural-language NEED. |
ddg_security_service_catalog | read | Return DDG |
ddg_seller_trust_badge | read | Live conformance check of a seller endpoint -> gold/silver/bronze badge ($0.003). Checks discovery manifest, real 402, challenge shape, payTo consistency. |
ddg_skill_safety_scan | write | Run the free static-only DDG AI skill/workflow safety scan. |
ddg_submit_order | write | Submit a paid operator-reviewed DDG order after caller supplies valid payment headers/proof. |
ddg_table_extract | read | Extract HTML tables as JSON rows or CSV ($0.003). |
ddg_token_estimate | read | Deterministic token estimates per model family before a metered call ($0.001). |
ddg_token_meta | read | ERC-20 metadata: name, symbol, decimals, total supply ($0.001). |
ddg_tx_smoke_test | read | Exercise the one-cent DDG transaction smoke-test route with caller-supplied payment headers. |
ddg_tx_status | read | Transaction receipt: mined?, success?, block, gas, cost ($0.001). |
ddg_wallet_snapshot | read | Native + USDC balance (+optional extra ERC-20s) for an address ($0.002). |
ddg_x402_bazaar_readiness | read | Return CDP x402 Bazaar candidate resources, schema metadata, and settlement indexing gates. |
ddg_x402_supported_chains | read | Return all x402/direct-crypto chains DDG supports for AI-agent payment routing. |
ddg_x402scan_status | read | Return DDG |
04
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (15)
HIGHInventory / provenance · inv.suspicious_name · CWE-1104
submissions/mcp-aggregators/mcp.so-payload.json
mcp.so-payload.json
Why it matters. member named after an attack tool
Fix. remove or justify
HIGHPrompt injection · prompt.override · CWE-94, CWE-1427
docs/llms.txt:288
42. POST /v1/moderation/scan ($0.01) - Offline deterministic moderation: profanity/NSFW, wallets, PII (email/SSN/Luhn-CC/phone), URLs, jailbreak patterns, spam heuristics. Verdict pass/warn/block. [mo
Why it matters. asks the agent to drop prior instructions or safety
Fix. remove the instruction
HIGHPrompt injection · prompt.override · CWE-94, CWE-1427
llms.txt:288
42. POST /v1/moderation/scan ($0.01) - Offline deterministic moderation: profanity/NSFW, wallets, PII (email/SSN/Luhn-CC/phone), URLs, jailbreak patterns, spam heuristics. Verdict pass/warn/block. [mo
Why it matters. asks the agent to drop prior instructions or safety
Fix. remove the instruction
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/cloudflare/ddg-agent-services-mcp-ingress.example.yml:10
service: http://127.0.0.1:8891
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/mcp-production-readiness.md:8
- Streamable HTTP server: source-ready, locally smoked on `http://127.0.0.1:8891/mcp`, and public-live at `https://mcp.daedalusdevelopmentgroup.com/mcp`.
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/mcp-production-readiness.md:45
--http-url http://127.0.0.1:8891/mcp \
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/mcp-production-readiness.md:73
--http-url http://127.0.0.1:8891/mcp \
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/mcp-security-audit-2026-06-23.md:69
PYTHONDONTWRITEBYTECODE=1 uv run --extra dev python scripts/smoke_mcp_server.py --transport streamable-http --http-url http://127.0.0.1:8891/mcp --agent-id ddg-mcp-http-smoke
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
clients/typescript/package.json
viem, x402-fetch, typescript, @types/node
Why it matters. 4 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
hosted-x402/package.json
@x402/core, @x402/evm, @x402/extensions, @x402/mcp, typescript
Why it matters. 5 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
typescript-sdk/package.json
@x402/core, @x402/evm, @x402/fetch, viem, typescript
Why it matters. 5 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/llms.txt:265
- POST /v1/security-audit/deep ($0.25): Deep static security audit of agent-supplied code or MCP tool configs. 16 detector families (hardcoded secrets, private keys, injection surfaces, unsafe deseria
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
llms.txt:265
- POST /v1/security-audit/deep ($0.25): Deep static security audit of agent-supplied code or MCP tool configs. 16 detector families (hardcoded secrets, private keys, injection surfaces, unsafe deseria
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
submissions/mcp-aggregators/listing-payloads.md:82
- MCP.so: submit form reached at https://mcp.so/submit; submission POST is **site-login gated** (`Please Sign in to submit a server.` / `/api/submit-project`). Payload below is ready for a signed-in b
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
DISCOVERY.md:82
DDG sells bounded artifacts/results and proof bundles. DDG does not sell or publish raw provider account access, OAuth tokens, provider API keys, private model IDs, private payment material, raw payme
Why it matters. asks the agent to read credentials
Gates applied: instruction_override, no_behavioural_pass.
Audited 2026-10-11 · audit v0.4.1 · source sha
b071fe4fa406full audit observations/trust-audit/mcp-server/daedalusdevelopmentgroup__ddg-agent-payable-services.json · Report an issue / request a re-scan05
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | b071fe4fa406 | BLOCK | D | 69 | first audit |
06
Questions
What is the ddg-agent-payable-services MCP server?
Pay-per-call x402 gateway for AI agents — MCP server + OpenAI-compatible API for agent tools, market data, RPC, and MCP security audits. Pay in USDC on Base, no account.
What tools does ddg-agent-payable-services expose?
54 in total: 45 read-only, 9 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is ddg-agent-payable-services safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does ddg-agent-payable-services need?
It reads DDG_API_KEY, DDG_PRIVATE_KEY and EVM_PRIVATE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does ddg-agent-payable-services run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @daedalusdevelopmentgroup/ddg-x402 at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (b071fe4fa406), read on 2026-10-11. The repository is watched and re-audited when it changes.