ari-mcp-server

v0.2.0 suspicious
4.0
Medium Risk

MCP server that stops AI agents from overpaying. Drops into Claude Desktop, Cursor, Continue, Windsurf, Zed, ChatGPT desktop, and Gemini CLI to give any agent live fair-market-value lookups, a green/amber/red prepay verdict, and cryptographically-signed (Ed25519) receipts for every x402 / MPP / agentic-payment quote.

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits moderate risk due to network interactions with an external server and a relatively new maintainer. While no immediate malicious activities were identified, these factors warrant further scrutiny.

  • network risk due to external server calls
  • maintainer is new with only one package
Per-check LLM notes
  • Network: The package makes network calls to an external server which is not uncommon but should be reviewed for the legitimacy of the server and purpose of the requests.
  • Shell: No shell execution patterns were detected in the provided code snippet.
  • Obfuscation: The use of base64 decoding with validation might indicate an attempt to ensure data integrity, but without more context, it could suggest some level of obfuscation.
  • Credentials: No clear patterns indicating credential harvesting were detected.
  • Metadata: The maintainer appears to be new and has only one package, which could indicate potential risk but lacks clear red flags.

📦 Package Quality Overall: Medium (6.6/10)

✦ High Test Suite 9.0

Test suite present — 7 test file(s) found

  • 7 test file(s) detected (e.g. test_aliases.py)
◈ Medium Documentation 7.0

Some documentation present

  • Documentation URL: "Documentation" -> https://agentrateindicators.com/docs/mcp
  • Detailed PyPI description (9878 chars)
○ Low Contributing Guide 2.0

No contributing guide or governance files found

  • No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
◈ Medium Type Annotations 7.0

Partial type annotation coverage

  • Classifier: Typing :: Typed
  • 73 type-annotated function signatures detected in source
✦ High Multiple Contributors 8.0

Active multi-contributor project

  • 3 unique contributor(s) across 8 commits in Antmanbuilds/ARI
  • Small but multi-author team (3–4 contributors)

🔬 Heuristic Checks

⚠ Outbound Network Calls score 6.0

Found 4 network call pattern(s)

  • BASE_URL try: r = httpx.post(f"{base.rstrip('/')}/api/v1/mcp/install-ping", json=body, ti
  • skip_pin self._http = httpx.Client(timeout=timeout, follow_redirects=True) if public_k
  • _pinned_pem() -> str: r = httpx.get(BASE_URL + "/.well-known/ari-pubkey.pem", timeout=15) r.
  • else BASE_URL + path with httpx.Client(timeout=30, follow_redirects=True) as c: r = c.reque
⚠ Code Obfuscation score 2.0

Found 1 obfuscation pattern(s)

  • try: sig_bytes = base64.b64decode(signature_b64, validate=True) passed.add("signat
✓ Shell / Subprocess Execution

No shell execution patterns detected

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository Antmanbuilds/ARI appears legitimate

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Only one version has ever been released — brand new package
  • Author "Agentic Rate Indicators" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with ari-mcp-server 
Create a mini-application named 'FairAIQuoteChecker' that leverages the 'ari-mcp-server' package to ensure AI agents receive fair market value quotes for their services. This application will integrate seamlessly with various AI platforms such as Claude Desktop, Cursor, Continue, Windsurf, Zed, ChatGPT desktop, and Gemini CLI, providing real-time evaluations of payment requests based on fair market standards.

The application should perform the following steps:
1. Connect to the 'ari-mcp-server' via the API provided by the package.
2. Accept input parameters including the AI agent ID, service type, and proposed payment amount.
3. Query the 'ari-mcp-server' for a fair market value assessment of the proposed payment.
4. Receive a green/amber/red verdict from the server indicating whether the proposed payment aligns with fair market standards.
5. If the payment passes the fair market check, generate a cryptographically signed receipt using Ed25519 for the transaction.
6. Display the verdict and any relevant receipts to the user.

Suggested Features:
- User-friendly interface for inputting necessary details.
- Integration with multiple AI platforms for seamless usage.
- Detailed logs of all transactions for auditing purposes.
- Support for batch processing of multiple payments.
- Optional alert system for notifying users of non-compliant payments.

How to Utilize 'ari-mcp-server':
- Use the package's API to establish a connection to the MCP server.
- Send requests to the server with relevant data points required for evaluation.
- Process the server's response which includes the verdict and optionally a signed receipt.
- Ensure all communication is secure and complies with cryptographic standards.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!