Fairquery Agent Trust & Data Safety (MCP server)

One MCP server for AI agents that handle untrusted data. It covers four jobs:

• PII and secret redaction: check text before it reaches an LLM.
• Email checks: syntax, typos, disposable and role addresses, plus MX/SPF/DMARC in the paid tool.
• Sanctions screening: OFAC, EU, UK and UN lists.
• Dependency vulnerabilities: lookups against OSV.dev.
• MCP server pre-check: local scan of tool names and descriptions before you install or enable a server.

Free tools need no token or account and run on your machine. Paid tools are optional. They call public Fairquery Apify Actors with your own APIFY_TOKEN, and runs are billed to your Apify account.

Tools

Every tool description has WHAT / WHEN / WHEN NOT / COST / RETURNS / EXAMPLE sections. Outputs are paged (limit, offset, nextOffset, hasMore). Errors use named codes: APIFY_TOKEN_MISSING, APIFY_TOKEN_INVALID, APIFY_PAYMENT_REQUIRED, APIFY_ACTOR_RUN_FAILED, APIFY_TIMEOUT, INPUT_EMPTY, INPUT_TOO_LARGE, INVALID_ECOSYSTEM, INVALID_JSON, INVALID_PACKAGE_NAME, PATH_NOT_FOUND, PATH_NOT_ALLOWED, OSV_FETCH_FAILED and VULN_NOT_FOUND.

Paid tools use these Apify Actors:

• fairquery/llm-data-guard-pii-secrets for pii_guard_documents, from $0.99 per 1,000 documents processed on Apify's Business plan and above ($1.50 on Free). The per-run start fee is $0.05 per 1,000 runs.
• fairquery/email-validator-mx-disposable for email_validate_deliverability and trust_screen_lead, from $0.59 per 1,000 emails checked on Apify's Business plan and above ($0.79 on Free). The per-run start fee is $0.05 per 1,000 runs.
• fairquery/sanctions-watchlist-screener for sanctions_screen_names and trust_screen_lead, from $2.10 per 1,000 names screened on Apify's Business plan and above ($3.00 on Free). The per-run start fee is $7.00 per 1,000 runs.
• fairquery/osv-dependency-vulnerability-check for osv_audit_dependencies, from $0.35 per 1,000 packages checked and $1.00 per 1,000 vulnerabilities found on Apify's Business plan and above ($0.50 and $1.50 on Free). The per-run start fee is $0.05 per 1,000 runs.

Prices as shown on the Apify Store on 2026-10-24.

When to use which tool

Start with the free tools. Use a paid tool only when you need what it adds; each paid call runs an Apify Actor billed to your own token.

Asia national-ID pack

pii_scan_text and pii_redact_text detect these national IDs locally. A value is reported only when the checksum (if the scheme has one) and the structural checks pass. A failed check is ignored. Mask style keeps the last four characters, the same as a US SSN, and risk_level is high.

Pre-check an MCP server

The free call only scans what you already have. It does not install the package, start it, or send tool names and descriptions anywhere.

{
  "name": "mcp_server_precheck",
  "arguments": {
    "tools": [
      { "name": "sum", "description": "Add two numbers." }
    ]
  }
}

A clean description comes back with meta.risk_level of none and meta.shared_externally.tool_names_and_descriptions of false. Findings, when there are any, are rows with a rule such as PROMPT_INJECTION, SECRET_EXFILTRATION, HIDDEN_INSTRUCTION, CONCEALED_TEXT or CROSS_SERVER_REFERENCE.

You can point path at a local checkout or a .json tools/list file, or pass packageName for a package that is already installed under node_modules. If the name is not on disk, the result says so and does not download it.

The paid mode is the same scan plus a dependency audit. It needs APIFY_TOKEN and a local package.json or package-lock.json. License and publish age come from the local manifest and, when the package is not marked private, a public npm registry lookup of the package name. Tool descriptions are still not uploaded.

{
  "name": "mcp_server_precheck",
  "arguments": {
    "path": "/absolute/path/to/the-mcp-package",
    "auditDependencies": true
  }
}

Without a token the local findings still return, and the dependency_audit row has error_code APIFY_TOKEN_MISSING.

Install

Requires Node.js 20 or later. APIFY_TOKEN is optional and only needed for paid tools. Get one at https://console.apify.com/settings/integrations.

Quick start (stdio):

npx -y @fairquery/agent-trust-mcp

The configs below run the npm package with npx -y: no clone or build step needed.

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "fairquery-trust": {
      "command": "npx",
      "args": ["-y", "@fairquery/agent-trust-mcp"],
      "env": { "APIFY_TOKEN": "<optional-your-apify-token>" }
    }
  }
}

Cursor (~/.cursor/mcp.json or .cursor/mcp.json)

{
  "mcpServers": {
    "fairquery-trust": {
      "command": "npx",
      "args": ["-y", "@fairquery/agent-trust-mcp"],
      "env": { "APIFY_TOKEN": "<optional-your-apify-token>" }
    }
  }
}

VS Code (.vscode/mcp.json)

{
  "inputs": [{ "type": "promptString", "id": "apify-token", "description": "Apify token (optional, paid tools only)", "password": true }],
  "servers": {
    "fairquery-trust": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@fairquery/agent-trust-mcp"],
      "env": { "APIFY_TOKEN": "${input:apify-token}" }
    }
  }
}

Gemini CLI (~/.gemini/settings.json)

{
  "mcpServers": {
    "fairquery-trust": {
      "command": "npx",
      "args": ["-y", "@fairquery/agent-trust-mcp"],
      "env": { "APIFY_TOKEN": "<optional-your-apify-token>" }
    }
  }
}

Streamable HTTP

npx -y @fairquery/agent-trust-mcp --http   # Streamable HTTP on http://127.0.0.1:3000/mcp (PORT, HOST env)

MCPB bundle (Smithery local install, Claude Desktop)

manifest.json describes an MCPB bundle that runs this server locally over stdio. The bundle asks for one optional, sensitive setting: your own Apify API token. Leave it empty to use only the free tools.

npm run build:mcpb   # -> build/fairquery-agent-trust-mcp-<version>.mcpb (dist + production node_modules)
npm run test:mcpb    # unpack, initialize, tools/list, free call, paid call without token -> APIFY_TOKEN_MISSING

build:mcpb also writes <name>-smithery.mcpb, the file to upload to Smithery. It is the same bundle with only manifest.json changed: each tool also carries its inputSchema, outputSchema and annotations, taken from the server's own tools/list. Smithery's publish API needs these for its server card, but the MCPB 0.3 manifest schema allows only name/description per tool, so the canonical .mcpb keeps the spec-valid manifest. test:mcpb tests both bundles and checks that they differ only in those tool schemas.

Tests

npm run smoke        # initialize + tools/list + guide/annotation checks, Asia national-ID vectors, no token
npm run test:live    # every free tool live, ReDoS probes, paid tools without token -> APIFY_TOKEN_MISSING
npm run test:paid    # also ONE paid call per family using APIFY_TOKEN from env (costs < $0.02)

Security

See https://getfairquery.com/security/. Free tools never contact Apify or Fairquery, and the code contains no secrets. mcp_server_precheck does not send tool descriptions anywhere. With auditDependencies: true it sends a local manifest to the OSV Actor and, unless the package is marked private, the package name to the public npm registry.

Disclaimer

Sanctions results come from automated fuzzy matching and are not a certified screening service. Review every potential match yourself. Email checks do not probe SMTP mailboxes.

License

MIT © Fairquery