shelf-smoke — url smoke / headless QA MCP server

• checkout_creditsFree

  Stripe TEST PaymentIntent for a pack (POST /credits/checkout). Intent only — returns credits_pending; credits are not granted or spendable until confirm_credits succeeds. Requires a caller key.

• confirm_creditsFree

  Confirm a TEST PaymentIntent with Stripe test card pm_card_visa (POST /credits/confirm). This is when credits become granted/spendable (appends credit.purchase with credits_added). TEST only.

• credit_balanceFree

  Derived prepaid balance for this caller_id (GET /credits/balance).

• credit_eventsFree

  Append-only Ledger events for this caller_id (GET /credits/events): credit.grant (first_key), credit.purchase, credit.debit, optional credit.balance_snapshot.

• healthFree

  Public readiness (GET /health): billing (test|live|gated) and runner_ready. No key.

• issue_keyFree

  Mint a caller key (POST /keys). Bot install starts at GET https://shelf.kymac.co/llms.txt (sole advertised entry). Secret ssm_… is returned once. Prefer Authorization: Bearer; X-API-Key is an alias. First issue grants 1 free credit (credit.grant reason=first_key). Quote cost with quote_credits before smoke.

• list_credit_packsFree

  Prepaid TEST packs (GET /credits/packs). checkout_credits is intent only; credits grant after confirm_credits.

• quote_creditsFree

  Dry-run cost for an op without debit (GET /credits/quote?op=smoke). Returns cost, balance, and would_succeed.

• revoke_keyFree

  Invalidate the presented secret (POST /keys/revoke). Same id is revoked; old secret then fails 401 invalid_api_key. Prefer Authorization: Bearer; X-API-Key is an alias only. No ops file-edit.

• rotate_keyFree

  Replace the presented secret (POST /keys/rotate). Same id/caller_id and credits. New ssm_… is returned once. Old secret then fails 401 invalid_api_key. Prefer Authorization: Bearer; X-API-Key is an alias only. No ops file-edit.

• smokeFree

  Headless smoke (POST /smoke). Install via GET https://shelf.kymac.co/llms.txt only. Prefer Authorization: Bearer; X-API-Key is an alias. Golden URL https://example.com/ — compare ok true/false JSON in llms.txt. First key includes 1 free credit. Quote first with quote_credits (no debit). Debits 1 credit on ok:true (credit.debit reason=smoke_success). 200 bodies include credits_burned and credits_remaining. HTTP fails use code/message/retryable/next (error aliases message). 401 next=refresh key. 402: code=insufficient_credits, retryable=false, next=buy credits. Retryable fails use next=retry.

• verify_keyFree

  Confirm SHELF_SMOKE_API_KEY or Authorization: Bearer (GET /keys/verify). X-API-Key is an alias only. Does not echo the secret.

• –Code scanremote-only server, no package to scann/a
• Live reliabilityremote reachable in 626ms20/20
• Tool poisoning12 tool descriptions checked15/15
• Auth qualityAPI key sent as a header8/15
• Maintenanceno repository listed3/15
• Maintainer identityverified namespace with website, no repo4/10

shelf-smoke — url smoke / headless QA: common questions

Is shelf-smoke — url smoke / headless QA MCP server safe?

With care: it is graded C, so read the findings first (67/100). Read the shelf-smoke — url smoke / headless QA safety report

How do I install shelf-smoke — url smoke / headless QA?

It runs remotely at shelf.kymac.co. Add it to Claude Code, Claude Desktop or Cursor with the snippets above, or call it through the mcp.market gateway without installing anything.

Does shelf-smoke — url smoke / headless QA need an API key?

Yes. The registry entry asks for Authorization, X-API-Key.

Is shelf-smoke — url smoke / headless QA maintained?

The latest release is v0.3.0.

Is shelf-smoke — url smoke / headless QA up?

100% of our last 6 checks got an answer. We check remote servers about four times a day.