English Français العربية

OSA Procurement Guard

السجل الرسمي الذكاء الاصطناعي والوكلاء

Pre-purchase trust, pricing and budget decisions for AI agents buying APIs and MCP tools.

الشيفرة المصدرية الموقع التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http osa-procurement-guard 'https://pkctqxeydfuiupadaoov.supabase.co/functions/v1/procurement-mcp' --header 'X-API-Key: <Required OSA API key. Get 20 free decision calls from websiteUrl.>'
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "osa-procurement-guard": {
            "type": "http",
            "url": "https://pkctqxeydfuiupadaoov.supabase.co/functions/v1/procurement-mcp",
            "headers": {
                "X-API-Key": "<Required OSA API key. Get 20 free decision calls from websiteUrl.>"
            }
        }
    }
}

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. OSA
  2. Core product
  3. Architecture
  4. Security
  5. Commercial acquisition tool
  6. Quick start
  7. Payments
  8. Operating rule
  9. Revenue-first gate
  10. Ecosystem

OSA

OSA is a machine-commerce trust and procurement system for evaluating agent/API endpoints before purchase or routing spend.

Core product

OSA combines live endpoint verification with historical evidence and produces a TrustScore plus confidence and reason codes.

  • GET /best — rank matching endpoints by trust, intent and optional max price.
  • GET /score — live-verify a registered endpoint.
  • GET /history — return historical snapshots.
  • POST /ingest — authenticated registry ingestion.
  • POST /sources/mcp and POST /sources/bazaar — ingest MCP/Bazaar-shaped records.
  • /.well-known/osa.json — machine-readable product metadata.

TrustScore currently considers uptime, latency, price stability, schema stability, payment stability and transaction evidence. Confidence is reported separately.

Architecture

OSA uses a split-plane design:

  • Product/Data/Commercial plane — procurement/MCP distribution, pricing and benchmark history, endpoint observations, product usage, leads/deals and payment reconciliation.
  • Control/Execution/Security plane — VPS agents, approvals, task policy, audit/control alerts, SSH bridge and certificate-only RAW SSH execution.
  • GitHub — canonical source, CI/security scanning and controlled deployment workflows.

The split keeps product data workloads separate from privileged infrastructure execution.

Security

  • Endpoint verification is read-only (GET/HEAD).
  • SSRF defenses reject local/private/link-local/documentation targets and unsafe URL schemes.
  • DNS results and redirect targets are revalidated.
  • Response size, redirect count, timeouts and concurrency are bounded.
  • Ingestion is authenticated in production.
  • Privileged VPS execution uses short-lived SSH certificates and host-key verification.
  • Secrets and private keys are not committed to this repository.

Commercial acquisition tool

npm run lead:audit -- https://example.com

The Lead-Leakage Audit performs a public-page, read-only conversion-path audit. It does not submit forms, authenticate, bypass controls or access private systems. It can be used as an evidence-first acquisition wedge for OSA services without becoming a separate product strategy.

Quick start

npm install
npm test
npm start

Payments

The public checkout exposes one human product: the $79 OSA 30-Day MCP Reliability Pilot. A buyer can request a private invoice/bank-transfer route or pay immediately with USDC on a verifier-backed network. Card and mobile-wallet buttons stay hidden until a live merchant rail is independently verified. Tap is owner-disabled. Optional x402 v2 middleware remains the machine-payment path for /best and /score when OSA_PAY_TO is configured. Requests, test events, page views, and wallet connections are never counted as revenue.

Operating rule

OSA is one product. Agent Trust Oracle, Procurement Guard, pricing/benchmark intelligence, MCP reliability and payment-rail checks are modules of the same pre-transaction decision system.

Progress means verified external usage, verified payment and repeat usage — not internal test rows, crawler probes, generated dashboards or speculative revenue.

Revenue-first gate

Before first verified external payment, OSA keeps one primary revenue path plus one backup and freezes generalized product/infrastructure/payment/browser/autonomy expansion unless it is the minimum fix for a named external blocker or a real safety incident.

Every non-trivial change should carry the decision record defined in knowledge/05-revenue-gate.md. Pull requests are checked by the Revenue Gate workflow. The governing distinction is strict: BUILT != VERIFIED != SELLING != PAID.

Ecosystem

الأسئلة الشائعة

ما هو OSA Procurement Guard؟

Pre-purchase trust, pricing and budget decisions for AI agents buying APIs and MCP tools.

كيف أثبّت OSA Procurement Guard؟

يعمل كخادم بعيد. في Claude Code: claude mcp add --transport http osa-procurement-guard 'https://pkctqxeydfuiupadaoov.supabase.co/functions/v1/procurement-mcp' --header 'X-API-Key: <Required OSA API key. Get 20 free decision calls from websiteUrl.>'. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج OSA Procurement Guard إلى مفتاح API؟

نعم. يتطلب X-API-Key، وتضبطها في إعداداته.

هل OSA Procurement Guard مفتوح المصدر؟

شيفرته علنية على GitHub، لكن المستودع لا يعلن ترخيصًا قياسيًا.

من يصون OSA Procurement Guard؟

ينشره omarfff. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.