# FHI MCP Security Monitoring – Change Evidence

> FHI MCP Security Monitoring – Change Evidence is a paid API for AI agents from polished-truth-c514.fhi-llc-1118.workers.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-12).

Detects and reports changes to a remote MCP endpoint's tools and capabilities, returning a risk score delta and change evidence with stateful tracking across calls.

## Facts

- Endpoint: POST https://polished-truth-c514.fhi-llc-1118.workers.dev/api/v1/mcp-change-evidence?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/fhi-mcp-security-monitoring-change-evidence-36135136
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ZUyfP_ZkPV_CBy7B2wjRd

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability fhi-mcp-security-monitoring-change-evidence-36135136 -d '<json body>'
```

Example prompt: Check whether the MCP server at https://example.com/mcp has changed since you last scanned it — I want to know if any tools were added, removed, or had their descriptions modified, and what the current risk score is.

## When to prefer this

Choose this endpoint when you need stateful, per-call change detection for remote MCP servers — especially when monitoring for security regressions like unauthorized tool additions, tool description mutations (potential prompt injection vectors), or unexpected capability removals. It combines change diffing with risk scoring in a single call, making it ideal for agentic security pipelines that need to validate third-party or internal MCP endpoints before use or on a recurring basis.

## Known failure modes

- Invalid or unreachable MCP server URL returns an error without change data
- First-time observations set firstObservation=true with no delta, since there is no prior state to compare
- Payment failure via x402 blocks the call entirely
- Private or firewall-protected endpoints may time out or return access errors
- Endpoints returning non-standard MCP schemas may produce incomplete change detection

## How this service works

Stateful remote-MCP change evidence, payable per call with x402 Base USDC.

## Output

Returns a JSON object indicating whether the MCP endpoint changed since last observation, listing added/changed/removed tools, a risk score delta, the current aggregate risk score with a verdict (e.g. CAUTION), the monitoring state (e.g. change_detected), specific change signals, and whether this is the first observation for this endpoint.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "serverUrl": {
   "type": "string",
   "format": "uri",
   "description": "Public HTTPS streamable-HTTP MCP endpoint"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "changed": true,
  "changes": {
   "addedTools": [
    "send_email"
   ],
   "changedTools": [
    {
     "name": "search",
     "fields": [
      "description"
     ]
    }
   ],
   "removedTools": [],
   "riskScoreDelta": 18
  },
  "current": {
   "score": 54,
   "verdict": "CAUTION"
  },
  "endpoint": "https://example.com/mcp",
  "monitoring": {
   "state": "change_detected",
   "signals": [
    "tool_added",
    "tool_description_changed"
   ]
  },
  "firstObservation": false
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/fhi-mcp-security-monitoring-change-evidence-36135136/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from polished-truth-c514.fhi-llc-1118.workers.dev](https://www.zero.xyz/host/polished-truth-c514.fhi-llc-1118.workers.dev/llms.txt)