Connect. Inspect the quote.
Decide before you pay.

Your first assessment, step by step

Use the dedicated buyer client to inspect a free quote, authorize one capped purchase, and keep the result for later changes.

1. Prepare one real manifest

git clone https://github.com/jdhart81/viridis-agent-fleet.git
cd viridis-agent-fleet
cp examples/security-preflight-inputs.json inputs.json

Replace the example with your agent’s manifest and policy. Supply only artifacts you are authorized to assess, without credentials.

2. Preview the price for free

python3 scripts/viridis_preflight_buy.py --inputs inputs.json

QUOTE_READY shows the price, exact Security URL and Base USDC recipient. This step loads no wallet and creates no assessment.

3. Authorize one purchase

python3 -m venv .venv-buyer
. .venv-buyer/bin/activate
python -m pip install "x402[requests,evm]==2.16.0"
python scripts/viridis_preflight_buy.py --inputs inputs.json \
  --pay --max-payment-usdc 0.01 --output paid-result-001.json

Before the paid command, set X402_BUYER_PRIVATE_KEY through your own local secret manager. Your wallet needs USDC on Base. Never enter your key on this site. The example caps the purchase at $0.01; it stops if the fresh quote is higher. Raise the limit only after approving the current price.

4. Inspect and retain the result

PAID_RESULT_SAVED gives you the assessment receipt ID and a private local file. Inspect the verdict and findings, then retain the file. It includes a buyer-only feedback token: keep it out of public repositories. A payment timeout requires reconciliation before another purchase; the client never retries automatically.

5. Check your next release for free

python3 scripts/viridis_preflight_watch.py --inputs inputs.json \
  --paid-result paid-result-001.json

Attach this free check to your own manifest or policy release event. UNCHANGED retains the previous findings. RECHECK_REQUIRED prompts a fresh quote and a separate purchase decision. An unchanged failed assessment still fails. You own the schedule and budget.

Complete buyer guide, result handling and feedback →

Connect an MCP client

{
  "mcpServers": {
    "viridis-security-preflight": {
      "url": "https://mcp.viridis-security.com/security-preflight/mcp"
    }
  }
}

Use a client with Streamable HTTP support. Tool discovery is free. The assessment requires a buyer-authorized payment. The existing /mcp endpoint serves Injection Detector separately.

Inspect an unpaid HTTP quote

Save the public example below as inputs.json, then send it without a payment signature. A valid unpaid request returns HTTP 402. This does not purchase or execute an assessment.

{
  "agent_id": "example-research-agent",
  "manifest": {
    "endpoint": "https://agent.example/mcp",
    "auth": "bearer",
    "tools": [
      {
        "name": "read_status",
        "input_schema": {
          "type": "object",
          "properties": {
            "id": {
              "type": "string"
            }
          },
          "required": [
            "id"
          ],
          "additionalProperties": false
        }
      }
    ]
  },
  "policy": {
    "allowed_tools": [
      "read_status"
    ],
    "denied_tools": [],
    "approval_required_tools": []
  },
  "sample_inputs": [
    "Summarize the supplied status record."
  ]
}

curl -i https://mcp.viridis-security.com/x402/security-preflight/security_preflight \
  -H 'Content-Type: application/json' \
  --data-binary @inputs.json

Decode the PAYMENT-REQUIRED response header as Base64 JSON. Check the exact resource URL, amount, recipient, asset, and network. The list price is $1 USDC; an eligible introductory quote may be $0.01. The fresh quote is authoritative.

Only after your own budget and payment mandate allow it, use an x402 v2 client to sign and retry the same request at this exact URL. Keep your private key in your client. A successful paid result includes signed assessment evidence and a delivery receipt.

Check only when inputs change

git clone https://github.com/jdhart81/viridis-agent-fleet.git
cd viridis-agent-fleet
python3 scripts/viridis_preflight_watch.py \
  --base-url https://mcp.viridis-security.com \
  --inputs examples/security-preflight-inputs.json

This free call returns BASELINE_REQUIRED without creating a scan or payment. On later checks, use your current caller-owned inputs and add --paid-result saved-paid-result.json. Unchanged inputs retain the assessment and its findings; a relevant change, expiry, or scanner change requires a new quote and a separate purchase decision.

You own the schedule. This endpoint does not create a monitoring subscription or authorize a runtime action.

Machine-readable contracts

Service metadata and example inputs · OpenAPI · Agent guide · Receipt and change-check recipe

Verify evidence before relying on it

Use the offline manifest receipt verifier with an operator-approved signing key and scanner. It checks expiry and exact input binding. A verified preflight does not grant tool execution authority or certify runtime safety.