fhi-x402-security-tools

Tools

6 tools: 0 read-only, 4 change data, 2 high risk (delete, pay, send or run code).

2 tools can move money or change orders; they are listed first.

read-only

Only reads or looks things up. Safe for an agent to call on its own.

changes data

Creates, edits or sends something. Worth a person's approval the first time.

high risk

Can delete, pay, send on your behalf or run code. Hard or impossible to undo.

Connecting costs an agent about 807 tokens of tool definitions and a 797 ms handshake.

• high riskpayment_infomoves money or changes ordersFree guide to the FHI MCP tools, Base-USDC x402 payment flow, and per-tool prices.
• high riskmcp_payment_preflightmoves money or changes ordersMCP server security audit before an agent connects or pays: probes initialize and tools/list, then returns an ALLOW, CAUTION, or BLOCK risk score for command, filesystem, or wallet capabilities; prompt-injection or data-exfiltration signals; permissive JSON-schema inputs; missing HSTS; and a larg...
• changes datadomain_change_evidenceStateful DNS, CAA, and certificate-transparency monitoring for a public domain. The first call establishes a baseline; later calls return evidence changes and certificate-expiry signals. ($0.01 USDC on Base)
• changes datapackage_install_preflightnpm or PyPI install preflight: blocks missing packages, detects near-name typosquats when an expected name is supplied, and checks OSV advisories. ($0.01 USDC on Base)
• changes datasec_material_event_deltaNew SEC 8-K, 6-K, and late-filing evidence since a cursor date; accepts a ticker or CIK. ($0.01 USDC on Base)
• changes datamcp_vendor_due_diligenceOne decision-ready due-diligence dossier before an agent adopts or pays an MCP vendor: live MCP metadata and tool-risk preflight, DNS/CAA/certificate evidence, plus optional SEC material-filing evidence for a public company. Does not execute vendor tools or certify safety. ($0.10 USDC on Base)

Levels are automated estimates from each tool's public name, description and annotations, and can be wrong. Descriptions as the server publishes them.

Status

Newest check: answered with tools, from the daily check, 2026-10-03, 797 ms.

From one check a day over the last 1 day. Servers whose owner verified them are checked every 5 minutes. Sign-in and payment answers count as up.

Last 30 days

2026-09-042026-10-03

answered with toolssign-in or payment askednot answeringnot checked

Compare: the most reliable servers in Payments and finance, ranked by days answering.

Badge

Live: status, days reachable, the tokens its tool list costs an agent. For a README:

[![7Maps](https://7it.co.il/7maps/badge/polished-truth-c514.fhi-llc-1118.workers.dev/mcp.svg)](https://7it.co.il/7maps/s/polished-truth-c514.fhi-llc-1118.workers.dev/mcp)

Other styles: add ?style=uptime (30-day uptime), ?style=stars (agents’ rating) or ?style=verified (owner mark) to the image address, or ?style=top (shows "top 10%" when the server ranks in the top tenth of its category by days answering; otherwise the standard badge).

Is this badge genuine? Anyone can check what a genuine badge for this server says right now: /7maps/verify/badge?server=polished-truth-c514.fhi-llc-1118.workers.dev%2Fmcp (add the same &style= for another style).

Own this server? Verify that it is yours.

Status widget

A live status card for a status page, docs or a dashboard: current status, the 30-day strip, uptime and handshake time.

Script (renders where it is placed, in its own shadow DOM):

<script src="https://7it.co.il/7maps/widget/polished-truth-c514.fhi-llc-1118.workers.dev/mcp.js" async></script>

Or an iframe:

<iframe src="https://7it.co.il/7maps/widget/polished-truth-c514.fhi-llc-1118.workers.dev/mcp" title="7Maps status" width="360" height="176" style="border:0;max-width:100%" loading="lazy"></iframe>

The widget is drawn only from 7it.co.il. Is a status shown elsewhere genuine? Check it: /7maps/verify/badge?server=polished-truth-c514.fhi-llc-1118.workers.dev%2Fmcp.

Add ?theme=light or ?theme=dark to either address (default: follows the visitor's setting). Refreshed every 5 minutes. Open the card · script.

For AI agents

Before connecting, an agent can ask 7Maps for this server's full condition, every tool's risk level and what changed since a person approved it: the road_conditions, watch and route tools on https://7it.co.il/7maps/mcp, paid per call in USDC via x402. About 7Maps.