Agent Access · Checks for what agents can reach and what they are told

Decide what agents can reach.

Every API an agent can call, every rule a gateway enforces and every door a visiting agent finds was either decided or left to chance. Agent Access checks those decisions with eight tools: eight checks. They cover which endpoints became agent tools and who decided, whether gateway rules are written and owned, whether a read-only agent is read-only, whether writes and spends pass through prepare, approval and submit, what an anonymous agent sees on a public layer, where each permission is enforced, whether an outside listing sends agents to the right place, and whether a settlement holds up against the chain. Your agent sends the inventory, rules, toolset, design, listing or evidence in the call, and each tool returns a signed report with every status, match and verdict decided from it.

See the tools Read the contract

Tool access: 0.10 USDC / call
Tools: Eight tools: eight checks
Connection: /mcp
Result: Signed report

The eight tools.

Each tool reads one kind of access material and answers one question about it. The report names the endpoint, rule, tool, action, entry point, permission, listing field or chain reading behind every status, so your agent and you can see why it reads the way it does.

`wever_tool-exposure-check`

Reads: An API inventory: every endpoint with what it can do, the most sensitive data it handles, whether agents can call it as a tool, how it became one, and the decision on exposing it with its decider.
The signed report states: Every endpoint that can delete, administer, move money or reach personal or confidential data and became an agent tool with no recorded decision, by generation or passthrough alone, with no named decider, or against a decision that withholds it.
Price: 0.10 USDC per call
Verdicts: undecided_exposuredecision_gapsexposure_unverifieddecided_exposure

`wever_gateway-rules-check`

Reads: The rules a gateway or policy layer enforces, each with where it is written, its owner, when it last changed and was reviewed and the tools it covers, plus when the toolset last changed.
The signed report states: Each rule written, owned and current, with every rule held only in live configuration or code, owned by no one, an agent or a vendor default, reviewed before the last toolset change, still naming retired tools, or left unreviewed when the toolset changes.
Price: 0.10 USDC per call
Verdicts: unwritten_rulesrule_gapsrules_unverifiedrules_governed

`wever_read-only-scope-check`

Reads: An agent meant to investigate and change nothing, with every tool it can call: how each is described, its operations, the free-form input it passes on, the credential behind it, its HTTP methods and its side effects.
The signed report states: Every mutation path in the toolset, with the writes hiding inside query-shaped tools listed apart: SQL or GraphQL under a credential that can write, request tools that send POST or DELETE, shell runners and side effects.
Price: 0.10 USDC per call
Verdicts: mutation_reachableboundary_unverifiedread_only

`wever_transaction-gate-check`

Reads: An agent-facing surface's actions: whether each reads, writes or spends, the steps it passes through, any direct path, who approves it, how the submitted action is bound to the approved one, its audit trail and its authentication.
The signed report states: Every write or spend that can skip prepare, human approval or submit, every approval not made by a person or not bound to what is submitted, every unaudited or unauthenticated write, and every read forced through the gate.
Price: 0.10 USDC per call
Verdicts: gate_skippablegate_gapsgate_unverifiedgated

`wever_public-surface-check`

Reads: A site's public layer as an anonymous visiting agent meets it: every entry point with the authentication it needs, whether it is machine readable, what it tells a visitor and what a visitor can do or see through it.
The signed report states: Every discovery gap, where a visiting agent cannot find a machine-readable entry, what is offered, how to proceed or what authentication comes next, and every transaction, write or piece of personal data reachable without authentication.
Price: 0.10 USDC per call
Verdicts: leaks_founddiscovery_gapssurface_unverifieddiscoverable_and_contained

`wever_enforcement-layer-check`

Reads: A permission design: each permission with every place it is enforced or stated, from gateway and policy engine to system prompt and conversation, what the enforcing layer does when it cannot decide, and whether the model can change it.
The signed report states: Every permission enforced outside the model, every permission that rests only on instructions the model can argue with, ignore, or lose in a long context, and every outside enforcement that fails open or that the model can switch off.
Price: 0.10 USDC per call
Verdicts: prompt_only_permissionsenforcement_gapsenforcement_unverifiedenforced_outside_model

`wever_external-listing-check`

Reads: A listing of your service on someone else's directory or registry, with its endpoint, network, version, count and status, beside the live service's own endpoints, retired endpoints, networks, version, count and status.
The signed report states: Every field as match, mismatch or unstated, with every field that sends agents to the wrong place, such as a retired endpoint or a test network, then every stale version, count or status, and the correction to request from the directory.
Price: 0.10 USDC per call
Verdicts: misdirects_agentsstale_listinglisting_unverifiedmatches_live

`wever_settlement-proof-check`

Reads: A settlement claim with its reference, amount, asset, destination, network and what it rests on, and the chain evidence read for it, each reading with its source, its independence from the seller, its status and its finality.
The signed report states: Whether the transaction exists, is final and matches the claim field by field, with every claim whose only proof is the seller's own receipt, every settlement that reverted after an earlier success and every delivery made before finality.
Price: 0.10 USDC per call
Verdicts: settlement_failedself_attestedsettlement_unverifiedsettlement_proven

Start with the two free tools.

On https://weverlabs.com/mcp-free, anonymous and with no wallet, two Agent Access tools read the same kind of material at discovery depth. Each returns an unsigned result in the family's report shape and ends with a line naming the main tools.

`wever_access-map`

Reads: An agent-facing surface's entry points, each with what a caller can do there, the authentication it needs and who approves an action there.
Returns: A plain map of public reads, private reads, gated writes, open writes and the doors where money changes hands, with the Agent Access check that covers each door.
Access: Free on /mcp-free

`wever_gateway-rules-sample`

Reads: Up to ten gateway rules with where each is written, its owner and when it was last reviewed or changed, and the date the toolset last changed.
Returns: For each rule, whether it is written down, owned by a named party and current. The gateway rules check gives the full audit.
Access: Free on /mcp-free

How agents and people use it.

Your agent

Maps a surface first with wever_access-map, so it knows which doors read, which write and where money changes hands.
Calls the check that answers the question on https://weverlabs.com/mcp at the moment it matters: when an API is turned into tools, when gateway rules or the toolset change, before a read-only agent goes live, before a transactional surface opens to agents, when the public layer changes, when a permission moves into or out of a prompt, when a directory lists the service and before delivering against a settlement.
Acts on the verdict and keeps the signed report with the work, so the next step starts from a record.

You

See each gap named with the change that closes it.
Know which dangerous endpoints agents can call and who decided, which permissions hold outside the model and which listings send agents to your live service.
Verify any report against Wever's published trust key whenever you need to show where a verdict came from.

A worked example

A generated delete. A placeholder decider.

The request

{
  "name": "wever_tool-exposure-check",
  "arguments": {
    "endpoints": [
      {
        "name": "GET /orders",
        "operations": [
          "read"
        ],
        "exposed": true,
        "via": "generated_from_spec"
      },
      {
        "name": "DELETE /customers/{id}",
        "operations": [
          "delete",
          "personal_data"
        ],
        "exposed": true,
        "via": "generated_from_spec"
      },
      {
        "name": "POST /refunds",
        "operations": [
          "move_money"
        ],
        "exposed": true,
        "decision": {
          "outcome": "expose_with_approval",
          "decided_by": "TBD"
        }
      },
      {
        "name": "POST /admin/roles",
        "operations": [
          "admin"
        ],
        "exposed": false,
        "decision": {
          "outcome": "withhold",
          "decided_by": "Platform lead"
        }
      }
    ]
  }
}

What the report returns

Verdict: undecided_exposure.

Undecided, bulk generated	DELETE /customers/{id} can delete and reach personal data. Agents can call it as a tool generated from an API description, with no recorded decision to expose it.
Decider, no decider	POST /refunds was exposed by a decision that names a placeholder as its decider.
Fix, DELETE /customers/{id}	Take DELETE /customers/{id} out of the generated toolset and expose it only by an explicit decision with a named decider.
Fix, POST /refunds	Record the named person or role who decided to expose POST /refunds.

1 dangerous endpoint exposed to agents without a decision to expose it: DELETE /customers/{id}.

An API becomes an agent toolset by generating one tool per endpoint from its API description. The order read is harmless. The customer delete also arrived as a tool, and nobody decided it should. The refund endpoint was exposed by a decision whose decider reads TBD. Taking the delete out until a named person decides, and naming the refund decider, gives every dangerous tool a decision someone owns.

Call it from your agent.

Connect to https://weverlabs.com/mcp and call any of the eight tools. Each call costs 0.10 USDC on Base. Eligible calls share 10 free calls per wallet over a rolling 30 days with the other paid tools. For free access, send X-Wever-Wallet-Proof signed over the exact JSON arguments and the tool route. The payment challenge supplies the x402 terms for a paid call.

Every report comes with an Ed25519 receipt signed with Wever's published trust key. The Agent Access contract lists the schemas, limits, verdicts and signing details. For sandbox isolation, exposure caps and discovery coverage, Agent Governance; for gateway coverage and approval conflicts, Agent Accountability; for sandbox escape routes and firewall order, Agent Control.

Browse all tools