English Français العربية

io.github.maxigirl123/storefront-guard

Registre officiel Finance et paiements

Verifies a merchant storefront is legitimate before an AI agent commits payment.

Code source Documentation

Installation

Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).

NPM package storefront-guard-mcp-server
Claude Code 
claude mcp add storefront-guard -e 'GOOGLE_SAFE_BROWSING_API_KEY=<your google_safe_browsing_api_key>' -e 'SAM_GOV_API_KEY=<your sam_gov_api_key>' -e 'URLHAUS_AUTH_KEY=<your urlhaus_auth_key>' -- npx -y storefront-guard-mcp-server@0.3.2
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "storefront-guard": {
            "command": "npx",
            "args": [
                "-y",
                "storefront-guard-mcp-server@0.3.2"
            ],
            "env": {
                "GOOGLE_SAFE_BROWSING_API_KEY": "<your google_safe_browsing_api_key>",
                "SAM_GOV_API_KEY": "<your sam_gov_api_key>",
                "URLHAUS_AUTH_KEY": "<your urlhaus_auth_key>"
            }
        }
    }
}

Variables d'environnement

  • GOOGLE_SAFE_BROWSING_API_KEY secret Google Safe Browsing API key for scam domain checks. Optional — degrades gracefully if not set.
  • SAM_GOV_API_KEY secret SAM.gov API key for US federal exclusions check. Optional — skipped if not set.
  • URLHAUS_AUTH_KEY secret URLhaus Auth-Key for malware URL lookups. Optional — degrades gracefully if not set.

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. Fortik
  2. What it checks
  3. Setup
  4. Running it
  5. Feedback endpoint
  6. How to use the recommendation field
  7. Pricing
  8. Environment variables

Fortik

Real-time merchant verification for agentic commerce. A shopping agent calls verify_storefront with a domain before paying, and gets back a trust score with a plain-English verdict the agent can act on — in under two seconds.

Fortik is the trust check AI shopping agents run before checkout. It doesn't ask merchants to register in advance — it gathers evidence directly, in the moment, from independent public sources.

fortik.io

This is the mirror image of merchant-side agent-verification protocols like Visa's Trusted Agent Protocol: those let a merchant confirm an incoming agent is legitimate. Fortik lets the agent confirm the merchant is legitimate before committing payment.

What it checks

  • Domain registration age & recent changes — via free public RDAP lookups. A domain registered days ago, or one whose registration data changed in the last two weeks, is a red flag.
  • SSL certificate issuance history — via free public Certificate Transparency logs (crt.sh). A cert reissued very recently on an otherwise long-established domain can indicate a takeover or hosting change, even when the domain itself looks old and trustworthy.
  • HTTPS validity — does the site currently serve a valid cert at all.
  • Known-scam blocklist — URLhaus and Google Safe Browsing.
  • Corporate registration — US entity lookup via OpenCorporates.
  • Legal name verification — GLEIF entity registry cross-check.
  • Web traffic rank — Tranco top-1M ranking.
  • Federal exclusions — SAM.gov debarment check.
  • FDA enforcement — corroborating signal when other risks are present.

Every deduction from the trust score comes with a plain-English reason in the reasons array — this is deliberately an explainable heuristic, not a black-box model.

Setup

Requires Node.js 18+.

npm install
npm run build

Copy .env.example to .env and fill in your keys.

Running it

As a local MCP server (stdio):

npm start

As a remote MCP server (streamable HTTP) with x402 payment:

npm run start:http
# POST http://localhost:3000/mcp

As a pay-per-call x402 HTTP API:

npm run start:x402
# POST http://localhost:4021/verify   { "domain": "example-shop.com" }

As a REST API (API key auth):

npm run start:rest
# POST http://localhost:4022/verify   { "domain": "example-shop.com" }
# Header: X-API-KEY: your-key

All three servers at once:

npm run start:all
# MCP:  http://localhost:3000/mcp
# x402: http://localhost:4021/verify
# REST: http://localhost:4022/verify

Feedback endpoint

Submit outcome data after a transaction to help build training data for future ML scoring:

POST http://localhost:4022/feedback
Header: X-API-KEY: your-key
Body: { "domain": "example-shop.com", "outcome": "legit" | "scam" }

How to use the recommendation field

Every verification result includes a top-level recommendation string alongside the numeric trustScore. Agents should branch on it rather than implementing their own threshold logic against the raw score.

ValueSuggested agent behavior
proceedComplete the transaction silently. Trust score is low-risk with high confidence.
pause_for_confirmationStop before paying and show recommendationReason to the user.
do_not_proceedBlock the transaction and actively notify the user — do not fail silently.

recommendationReason is a one-line plain-English explanation safe to show directly to users.

Pricing

$0.01/call via x402. Set your wallet address in PAY_TO_ADDRESS and network in X402_NETWORK (default: base).

Environment variables

VariableRequiredDescription
PAY_TO_ADDRESSYes (x402)Your wallet address for USDC payments
X402_NETWORKNoBlockchain network (default: base)
PRICE_USDNoPer-call price (default: 0.01)
API_KEYSYes (REST)Comma-separated valid API keys
GOOGLE_SAFE_BROWSING_API_KEYNoDegrades gracefully if unset
SAM_GOV_API_KEYNoDegrades gracefully if unset
URLHAUS_AUTH_KEYNoDegrades gracefully if unset
FEEDBACK_LOGNoPath for feedback JSONL log (default: feedback.jsonl)
MCP_PORTNoMCP server port (default: 3000)
X402_PORTNox402 server port (default: 4021)
REST_PORTNoREST API port (default: 4022)

Questions fréquentes

Qu'est-ce que io.github.maxigirl123/storefront-guard ?

Verifies a merchant storefront is legitimate before an AI agent commits payment.

Comment installer io.github.maxigirl123/storefront-guard ?

Il s'exécute sur votre machine. Dans Claude Code : claude mcp add storefront-guard -e 'GOOGLE_SAFE_BROWSING_API_KEY=<your google_safe_browsing_api_key>' -e 'SAM_GOV_API_KEY=<your sam_gov_api_key>' -e 'URLHAUS_AUTH_KEY=<your urlhaus_auth_key>' -- npx -y storefront-guard-mcp-server@0.3.2. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.

Faut-il une clé API pour io.github.maxigirl123/storefront-guard ?

Oui. Il attend GOOGLE_SAFE_BROWSING_API_KEY, SAM_GOV_API_KEY, URLHAUS_AUTH_KEY, à renseigner dans sa configuration.

io.github.maxigirl123/storefront-guard est-il open source ?

Son code est public sur GitHub, mais le dépôt ne déclare pas de licence standard.

Qui maintient io.github.maxigirl123/storefront-guard ?

Il est publié par maxigirl123. AI.tn le référence sans le maintenir ni le recommander.

Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.