English Français العربية

OSA Procurement Guard

Registre officiel IA et agents

Pre-purchase trust, pricing and budget decisions for AI agents buying APIs and MCP tools.

Code source Site web Documentation

Installation

Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http osa-procurement-guard 'https://pkctqxeydfuiupadaoov.supabase.co/functions/v1/procurement-mcp' --header 'X-API-Key: <Required OSA API key. Get 20 free decision calls from websiteUrl.>'
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "osa-procurement-guard": {
            "type": "http",
            "url": "https://pkctqxeydfuiupadaoov.supabase.co/functions/v1/procurement-mcp",
            "headers": {
                "X-API-Key": "<Required OSA API key. Get 20 free decision calls from websiteUrl.>"
            }
        }
    }
}

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. OSA
  2. Core product
  3. Architecture
  4. Security
  5. Commercial acquisition tool
  6. Quick start
  7. Payments
  8. Operating rule
  9. Revenue-first gate
  10. Ecosystem

OSA

OSA is a machine-commerce trust and procurement system for evaluating agent/API endpoints before purchase or routing spend.

Core product

OSA combines live endpoint verification with historical evidence and produces a TrustScore plus confidence and reason codes.

  • GET /best — rank matching endpoints by trust, intent and optional max price.
  • GET /score — live-verify a registered endpoint.
  • GET /history — return historical snapshots.
  • POST /ingest — authenticated registry ingestion.
  • POST /sources/mcp and POST /sources/bazaar — ingest MCP/Bazaar-shaped records.
  • /.well-known/osa.json — machine-readable product metadata.

TrustScore currently considers uptime, latency, price stability, schema stability, payment stability and transaction evidence. Confidence is reported separately.

Architecture

OSA uses a split-plane design:

  • Product/Data/Commercial plane — procurement/MCP distribution, pricing and benchmark history, endpoint observations, product usage, leads/deals and payment reconciliation.
  • Control/Execution/Security plane — VPS agents, approvals, task policy, audit/control alerts, SSH bridge and certificate-only RAW SSH execution.
  • GitHub — canonical source, CI/security scanning and controlled deployment workflows.

The split keeps product data workloads separate from privileged infrastructure execution.

Security

  • Endpoint verification is read-only (GET/HEAD).
  • SSRF defenses reject local/private/link-local/documentation targets and unsafe URL schemes.
  • DNS results and redirect targets are revalidated.
  • Response size, redirect count, timeouts and concurrency are bounded.
  • Ingestion is authenticated in production.
  • Privileged VPS execution uses short-lived SSH certificates and host-key verification.
  • Secrets and private keys are not committed to this repository.

Commercial acquisition tool

npm run lead:audit -- https://example.com

The Lead-Leakage Audit performs a public-page, read-only conversion-path audit. It does not submit forms, authenticate, bypass controls or access private systems. It can be used as an evidence-first acquisition wedge for OSA services without becoming a separate product strategy.

Quick start

npm install
npm test
npm start

Payments

The public checkout exposes one human product: the $79 OSA 30-Day MCP Reliability Pilot. A buyer can request a private invoice/bank-transfer route or pay immediately with USDC on a verifier-backed network. Card and mobile-wallet buttons stay hidden until a live merchant rail is independently verified. Tap is owner-disabled. Optional x402 v2 middleware remains the machine-payment path for /best and /score when OSA_PAY_TO is configured. Requests, test events, page views, and wallet connections are never counted as revenue.

Operating rule

OSA is one product. Agent Trust Oracle, Procurement Guard, pricing/benchmark intelligence, MCP reliability and payment-rail checks are modules of the same pre-transaction decision system.

Progress means verified external usage, verified payment and repeat usage — not internal test rows, crawler probes, generated dashboards or speculative revenue.

Revenue-first gate

Before first verified external payment, OSA keeps one primary revenue path plus one backup and freezes generalized product/infrastructure/payment/browser/autonomy expansion unless it is the minimum fix for a named external blocker or a real safety incident.

Every non-trivial change should carry the decision record defined in knowledge/05-revenue-gate.md. Pull requests are checked by the Revenue Gate workflow. The governing distinction is strict: BUILT != VERIFIED != SELLING != PAID.

Ecosystem

Questions fréquentes

Qu'est-ce que OSA Procurement Guard ?

Pre-purchase trust, pricing and budget decisions for AI agents buying APIs and MCP tools.

Comment installer OSA Procurement Guard ?

Il fonctionne comme serveur distant. Dans Claude Code : claude mcp add --transport http osa-procurement-guard 'https://pkctqxeydfuiupadaoov.supabase.co/functions/v1/procurement-mcp' --header 'X-API-Key: <Required OSA API key. Get 20 free decision calls from websiteUrl.>'. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.

Faut-il une clé API pour OSA Procurement Guard ?

Oui. Il attend X-API-Key, à renseigner dans sa configuration.

OSA Procurement Guard est-il open source ?

Son code est public sur GitHub, mais le dépôt ne déclare pas de licence standard.

Qui maintient OSA Procurement Guard ?

Il est publié par omarfff. AI.tn le référence sans le maintenir ni le recommander.

Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.