English Français العربية

io.github.maxigirl123/storefront-guard

Official registry Finance and payments

Verifies a merchant storefront is legitimate before an AI agent commits payment.

Source code Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package storefront-guard-mcp-server
Claude Code 
claude mcp add storefront-guard -e 'GOOGLE_SAFE_BROWSING_API_KEY=<your google_safe_browsing_api_key>' -e 'SAM_GOV_API_KEY=<your sam_gov_api_key>' -e 'URLHAUS_AUTH_KEY=<your urlhaus_auth_key>' -- npx -y storefront-guard-mcp-server@0.3.2
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "storefront-guard": {
            "command": "npx",
            "args": [
                "-y",
                "storefront-guard-mcp-server@0.3.2"
            ],
            "env": {
                "GOOGLE_SAFE_BROWSING_API_KEY": "<your google_safe_browsing_api_key>",
                "SAM_GOV_API_KEY": "<your sam_gov_api_key>",
                "URLHAUS_AUTH_KEY": "<your urlhaus_auth_key>"
            }
        }
    }
}

Environment variables

  • GOOGLE_SAFE_BROWSING_API_KEY secret Google Safe Browsing API key for scam domain checks. Optional — degrades gracefully if not set.
  • SAM_GOV_API_KEY secret SAM.gov API key for US federal exclusions check. Optional — skipped if not set.
  • URLHAUS_AUTH_KEY secret URLhaus Auth-Key for malware URL lookups. Optional — degrades gracefully if not set.

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. Fortik
  2. What it checks
  3. Setup
  4. Running it
  5. Feedback endpoint
  6. How to use the recommendation field
  7. Pricing
  8. Environment variables

Fortik

Real-time merchant verification for agentic commerce. A shopping agent calls verify_storefront with a domain before paying, and gets back a trust score with a plain-English verdict the agent can act on — in under two seconds.

Fortik is the trust check AI shopping agents run before checkout. It doesn't ask merchants to register in advance — it gathers evidence directly, in the moment, from independent public sources.

fortik.io

This is the mirror image of merchant-side agent-verification protocols like Visa's Trusted Agent Protocol: those let a merchant confirm an incoming agent is legitimate. Fortik lets the agent confirm the merchant is legitimate before committing payment.

What it checks

  • Domain registration age & recent changes — via free public RDAP lookups. A domain registered days ago, or one whose registration data changed in the last two weeks, is a red flag.
  • SSL certificate issuance history — via free public Certificate Transparency logs (crt.sh). A cert reissued very recently on an otherwise long-established domain can indicate a takeover or hosting change, even when the domain itself looks old and trustworthy.
  • HTTPS validity — does the site currently serve a valid cert at all.
  • Known-scam blocklist — URLhaus and Google Safe Browsing.
  • Corporate registration — US entity lookup via OpenCorporates.
  • Legal name verification — GLEIF entity registry cross-check.
  • Web traffic rank — Tranco top-1M ranking.
  • Federal exclusions — SAM.gov debarment check.
  • FDA enforcement — corroborating signal when other risks are present.

Every deduction from the trust score comes with a plain-English reason in the reasons array — this is deliberately an explainable heuristic, not a black-box model.

Setup

Requires Node.js 18+.

npm install
npm run build

Copy .env.example to .env and fill in your keys.

Running it

As a local MCP server (stdio):

npm start

As a remote MCP server (streamable HTTP) with x402 payment:

npm run start:http
# POST http://localhost:3000/mcp

As a pay-per-call x402 HTTP API:

npm run start:x402
# POST http://localhost:4021/verify   { "domain": "example-shop.com" }

As a REST API (API key auth):

npm run start:rest
# POST http://localhost:4022/verify   { "domain": "example-shop.com" }
# Header: X-API-KEY: your-key

All three servers at once:

npm run start:all
# MCP:  http://localhost:3000/mcp
# x402: http://localhost:4021/verify
# REST: http://localhost:4022/verify

Feedback endpoint

Submit outcome data after a transaction to help build training data for future ML scoring:

POST http://localhost:4022/feedback
Header: X-API-KEY: your-key
Body: { "domain": "example-shop.com", "outcome": "legit" | "scam" }

How to use the recommendation field

Every verification result includes a top-level recommendation string alongside the numeric trustScore. Agents should branch on it rather than implementing their own threshold logic against the raw score.

ValueSuggested agent behavior
proceedComplete the transaction silently. Trust score is low-risk with high confidence.
pause_for_confirmationStop before paying and show recommendationReason to the user.
do_not_proceedBlock the transaction and actively notify the user — do not fail silently.

recommendationReason is a one-line plain-English explanation safe to show directly to users.

Pricing

$0.01/call via x402. Set your wallet address in PAY_TO_ADDRESS and network in X402_NETWORK (default: base).

Environment variables

VariableRequiredDescription
PAY_TO_ADDRESSYes (x402)Your wallet address for USDC payments
X402_NETWORKNoBlockchain network (default: base)
PRICE_USDNoPer-call price (default: 0.01)
API_KEYSYes (REST)Comma-separated valid API keys
GOOGLE_SAFE_BROWSING_API_KEYNoDegrades gracefully if unset
SAM_GOV_API_KEYNoDegrades gracefully if unset
URLHAUS_AUTH_KEYNoDegrades gracefully if unset
FEEDBACK_LOGNoPath for feedback JSONL log (default: feedback.jsonl)
MCP_PORTNoMCP server port (default: 3000)
X402_PORTNox402 server port (default: 4021)
REST_PORTNoREST API port (default: 4022)

Frequently asked questions

What is io.github.maxigirl123/storefront-guard?

Verifies a merchant storefront is legitimate before an AI agent commits payment.

How do I install io.github.maxigirl123/storefront-guard?

It runs on your machine. In Claude Code: claude mcp add storefront-guard -e 'GOOGLE_SAFE_BROWSING_API_KEY=<your google_safe_browsing_api_key>' -e 'SAM_GOV_API_KEY=<your sam_gov_api_key>' -e 'URLHAUS_AUTH_KEY=<your urlhaus_auth_key>' -- npx -y storefront-guard-mcp-server@0.3.2. For other clients, paste the JSON configuration from this page into their MCP settings.

Does io.github.maxigirl123/storefront-guard need an API key?

Yes. It expects GOOGLE_SAFE_BROWSING_API_KEY, SAM_GOV_API_KEY, URLHAUS_AUTH_KEY, which you set in its configuration.

Is io.github.maxigirl123/storefront-guard open source?

Its code is public on GitHub, but the repository does not declare a standard license.

Who maintains io.github.maxigirl123/storefront-guard?

It is published by maxigirl123. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.