# NO HANDS AI MCP Server Risk Check

> NO HANDS AI MCP Server Risk Check is a paid API for AI agents from nohands-coinbase-bazaar.bytoken2023.workers.dev, paid per call via x402, $0.020001/call, status unknown (last checked 2026-11-02).

Assess caller-declared MCP server tools, authentication, and transport for side-effect risks and returns an advisory risk report.

## Facts

- Endpoint: GET https://nohands-coinbase-bazaar.bytoken2023.workers.dev/v1/x402/agent/mcp-server-risk-check?utm_source=zero.xyz
- Price: $0.020001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-02
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/no-hands-ai-mcp-server-risk-check-a18c63ab
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_tyC3uHUNmjnu3sb30suxq

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability no-hands-ai-mcp-server-risk-check-a18c63ab
```

Example prompt: Before I wire my agent up to the MCP server at https://example.com/mcp, can you run a risk check on it? It uses bearer auth and HTTP transport, and exposes tools called read_file, write_file, and send_email.

## When to prefer this

Choose this endpoint when an AI agent or orchestrator needs to pre-screen an MCP server before connecting, especially to detect dangerous side-effect tools (e.g. email sending, file writing, financial actions) or weak authentication postures. It is advisory-only and does not enforce permissions, making it safe for preflight checks without side effects. Prefer this over manual inspection when tools are declared as a list or when a manifest URL is available but the agent cannot parse it directly.

## Known failure modes

- Invalid or unreachable server_url returns an error or degraded assessment
- Unknown tool names may result in incomplete side-effect detection
- Missing required fields (type, method) cause schema validation errors
- Truncated tool list (over 2000 chars) may omit tools from analysis
- Unrecognized auth or transport enum values default to 'unknown' and may reduce accuracy

## How this service works

Assess caller-declared MCP tools, authentication and transport for side-effect risks. Advisory report only; it does not connect to or enforce permissions on the server.

## Output

Returns a structured advisory report including: overall risk level (e.g. LOW/MEDIUM/HIGH), numeric risk score, list of side-effect tools identified, individual reason codes with severity and detail, a decision string, policy and schema version metadata, and connection guidance — all as a read-only assessment with no enforcement actions taken.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "auth": {
       "enum": [
        "none",
        "api_key",
        "bearer",
        "oauth",
        "mTLS",
        "unknown"
       ],
       "type": "string",
       "example": "bearer",
       "description": "Authentication mode exposed by the MCP server."
      },
      "tools": {
       "type": "string",
       "example": "read_file,write_file,send_email",
       "maxLength": 2000,
       "description": "Comma-separated MCP tool names when a manifest URL is unavailable."
      },
      "transport": {
       "enum": [
        "stdio",
        "http",
        "sse",
        "websocket",
        "unknown"
       ],
       "type": "string",
       "example": "http",
       "description": "MCP transport mode."
      },
      "server_url": {
       "type": "string",
       "example": "https://example.com/mcp",
       "pattern": "^https?://",
       "maxLength": 2048,
       "description": "Public MCP server, manifest, or connector URL."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "server": {
       "type": "object",
       "properties": {
        "url": {
         "type": "string"
        },
        "auth": {
         "type": "string"
        },
        "transport": {
         "type": "string"
        },
        "tool_count": {
         "type": "integer"
        },
        "side_effect_tool_count": {
         "type": "integer"
        }
       },
       "additionalProperties": true
      },
      "product": {
       "type": "string"
      },
      "decision": {
       "type": "string"
      },
      "assessment": {
       "type": "object",
       "properties": {
        "reasons": {
         "type": "array",
         "items": {
          "type": "object",
          "properties": {
           "code": {
            "type": "string"
           },
           "detail": {
            "ty
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/no-hands-ai-mcp-server-risk-check-a18c63ab/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from nohands-coinbase-bazaar.bytoken2023.workers.dev](https://www.zero.xyz/host/nohands-coinbase-bazaar.bytoken2023.workers.dev/llms.txt)