English Français العربية

OSA Procurement Guard

Official registry AI and agents

Pre-purchase trust, pricing and budget decisions for AI agents buying APIs and MCP tools.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http osa-procurement-guard 'https://pkctqxeydfuiupadaoov.supabase.co/functions/v1/procurement-mcp' --header 'X-API-Key: <Required OSA API key. Get 20 free decision calls from websiteUrl.>'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "osa-procurement-guard": {
            "type": "http",
            "url": "https://pkctqxeydfuiupadaoov.supabase.co/functions/v1/procurement-mcp",
            "headers": {
                "X-API-Key": "<Required OSA API key. Get 20 free decision calls from websiteUrl.>"
            }
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. OSA
  2. Core product
  3. Architecture
  4. Security
  5. Commercial acquisition tool
  6. Quick start
  7. Payments
  8. Operating rule
  9. Revenue-first gate
  10. Ecosystem

OSA

OSA is a machine-commerce trust and procurement system for evaluating agent/API endpoints before purchase or routing spend.

Core product

OSA combines live endpoint verification with historical evidence and produces a TrustScore plus confidence and reason codes.

  • GET /best — rank matching endpoints by trust, intent and optional max price.
  • GET /score — live-verify a registered endpoint.
  • GET /history — return historical snapshots.
  • POST /ingest — authenticated registry ingestion.
  • POST /sources/mcp and POST /sources/bazaar — ingest MCP/Bazaar-shaped records.
  • /.well-known/osa.json — machine-readable product metadata.

TrustScore currently considers uptime, latency, price stability, schema stability, payment stability and transaction evidence. Confidence is reported separately.

Architecture

OSA uses a split-plane design:

  • Product/Data/Commercial plane — procurement/MCP distribution, pricing and benchmark history, endpoint observations, product usage, leads/deals and payment reconciliation.
  • Control/Execution/Security plane — VPS agents, approvals, task policy, audit/control alerts, SSH bridge and certificate-only RAW SSH execution.
  • GitHub — canonical source, CI/security scanning and controlled deployment workflows.

The split keeps product data workloads separate from privileged infrastructure execution.

Security

  • Endpoint verification is read-only (GET/HEAD).
  • SSRF defenses reject local/private/link-local/documentation targets and unsafe URL schemes.
  • DNS results and redirect targets are revalidated.
  • Response size, redirect count, timeouts and concurrency are bounded.
  • Ingestion is authenticated in production.
  • Privileged VPS execution uses short-lived SSH certificates and host-key verification.
  • Secrets and private keys are not committed to this repository.

Commercial acquisition tool

npm run lead:audit -- https://example.com

The Lead-Leakage Audit performs a public-page, read-only conversion-path audit. It does not submit forms, authenticate, bypass controls or access private systems. It can be used as an evidence-first acquisition wedge for OSA services without becoming a separate product strategy.

Quick start

npm install
npm test
npm start

Payments

The public checkout exposes one human product: the $79 OSA 30-Day MCP Reliability Pilot. A buyer can request a private invoice/bank-transfer route or pay immediately with USDC on a verifier-backed network. Card and mobile-wallet buttons stay hidden until a live merchant rail is independently verified. Tap is owner-disabled. Optional x402 v2 middleware remains the machine-payment path for /best and /score when OSA_PAY_TO is configured. Requests, test events, page views, and wallet connections are never counted as revenue.

Operating rule

OSA is one product. Agent Trust Oracle, Procurement Guard, pricing/benchmark intelligence, MCP reliability and payment-rail checks are modules of the same pre-transaction decision system.

Progress means verified external usage, verified payment and repeat usage — not internal test rows, crawler probes, generated dashboards or speculative revenue.

Revenue-first gate

Before first verified external payment, OSA keeps one primary revenue path plus one backup and freezes generalized product/infrastructure/payment/browser/autonomy expansion unless it is the minimum fix for a named external blocker or a real safety incident.

Every non-trivial change should carry the decision record defined in knowledge/05-revenue-gate.md. Pull requests are checked by the Revenue Gate workflow. The governing distinction is strict: BUILT != VERIFIED != SELLING != PAID.

Ecosystem

Frequently asked questions

What is OSA Procurement Guard?

Pre-purchase trust, pricing and budget decisions for AI agents buying APIs and MCP tools.

How do I install OSA Procurement Guard?

It runs as a remote server. In Claude Code: claude mcp add --transport http osa-procurement-guard 'https://pkctqxeydfuiupadaoov.supabase.co/functions/v1/procurement-mcp' --header 'X-API-Key: <Required OSA API key. Get 20 free decision calls from websiteUrl.>'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does OSA Procurement Guard need an API key?

Yes. It expects X-API-Key, which you set in its configuration.

Is OSA Procurement Guard open source?

Its code is public on GitHub, but the repository does not declare a standard license.

Who maintains OSA Procurement Guard?

It is published by omarfff. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.