# FHI MCP Security Monitoring

> FHI MCP Security Monitoring is a paid API for AI agents from polished-truth-c514.fhi-llc-1118.workers.dev, paid per call via x402, $0.1/call, status unknown (last checked 2026-10-11).

Monitors and audits remote MCP endpoints for security changes, cross-referencing SEC filings and domain signals to produce a vendor due-diligence verdict.

## Facts

- Endpoint: POST https://polished-truth-c514.fhi-llc-1118.workers.dev/api/v1/mcp-vendor-due-diligence?utm_source=zero.xyz
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/fhi-mcp-security-monitoring-1c970232
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_E19HSCK0M4A1NeIHYOIc5

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability fhi-mcp-security-monitoring-1c970232 -d '<json body>'
```

Example prompt: Run a security due-diligence check on the MCP endpoint at https://example.com/mcp for the company with ticker ACME, looking at changes since 2024-01-01 — I need the verdict and any domain signals flagged.

## When to prefer this

Use this endpoint when you need to vet or continuously monitor a remote MCP server for security changes, especially when cross-referencing the operator's SEC filings and domain reputation. Prefer this over generic website monitoring tools when the target is specifically an MCP endpoint and you want an AI-security-specific verdict with structured due-diligence output. Best suited for enterprise or compliance workflows where AI vendor risk management is required.

## Known failure modes

- Invalid MCP URL format returns a validation error
- CIK or ticker not found in SEC database returns zero filings with limited verdict confidence
- Unreachable MCP endpoint causes timeout or connectivity error
- Payment not completed via x402 results in 402 Payment Required response
- Malformed since date causes date parsing failure
- Baseline not yet established for a new URL returns only baseline_created signal with no change data

## How this service works

Stateful remote-MCP change evidence, payable per call with x402 Base USDC.

## Output

Returns a JSON object with a summary containing an mcpVerdict (e.g. CAUTION), a count of relevant SEC filings, a list of domain signals (e.g. baseline_created, anomaly_detected), and a top-level decision field (e.g. REVIEW or PASS) indicating whether further action is recommended.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "cik": {
   "type": "string",
   "pattern": "^[0-9]{1,10}$"
  },
  "since": {
   "type": "string",
   "format": "date"
  },
  "mcpUrl": {
   "type": "string",
   "format": "uri",
   "description": "Public HTTPS streamable-HTTP MCP endpoint"
  },
  "ticker": {
   "type": "string",
   "pattern": "^[A-Za-z0-9.-]{1,12}$"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "summary": {
   "mcpVerdict": "CAUTION",
   "secFilings": 0,
   "domainSignals": [
    "baseline_created"
   ]
  },
  "decision": "REVIEW"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/fhi-mcp-security-monitoring-1c970232/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from polished-truth-c514.fhi-llc-1118.workers.dev](https://www.zero.xyz/host/polished-truth-c514.fhi-llc-1118.workers.dev/llms.txt)