Back to Browse

Behavioral Audit MCP Server

Developer ToolsModerate6.2MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

Checks what a support agent knew but did not say against its policies. Free tier, no login.

About

Checks what a support agent knew but did not say against its policies. Free tier, no login.

Remote endpoints: streamable-http: https://receipts-mcp.vercel.app/api/mcp

Security Report

6.2
Moderate6.2Moderate Risk

This MCP server implements a disclosure-check audit tool with reasonable security controls. Authentication is optional but gracefully handled via WorkOS OAuth with JWT verification; unauthenticated requests fall back to a shared free-tier key rather than failing. The codebase is clean with proper input validation (Zod schemas), no hardcoded secrets, and appropriate error handling. Minor concerns include verbose logging in production and the ENGINE_KEY fallback to an empty string, but these do not materially impact security given the server's purpose and category-appropriate permissions. Supply chain analysis found 1 known vulnerability in dependencies (0 critical, 1 high severity).

7 files analyzed · 4 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

Behavioral Audit MCP

Check a draft support reply for what it should say and doesn't, before it goes to the customer.

Part of Agentic Diaries. One hosted tool, disclosure_check.

What it does

Give it what a customer said and the reply you are about to send. It flags any should-know policy the customer's situation made relevant that your draft failed to proactively surface: a refund window, an auto-renewal, a retention offer, a warranty term. The knew-but-did-not-say gap, on a single message.

It returns a verdict, pass or gap. On a gap, it names each missed policy and the line that should have been there. It detects and suggests. It does not rewrite your reply, send anything, or keep the message beyond the check.

Install

One line. No login, no signup.

Claude Code:

claude mcp add --transport http behavioral-audit https://receipts-mcp.vercel.app/api/mcp

If you add it mid-session, restart Claude Code (or run /mcp) so the new tool appears.

Claude Desktop (or any MCP client), add to your config:

{
  "mcpServers": {
    "behavioral-audit": {
      "type": "http",
      "url": "https://receipts-mcp.vercel.app/api/mcp"
    }
  }
}

The tool: disclosure_check

Input:

  • customer_message (string) , what the customer said, verbatim.
  • draft_reply (string) , the reply you are about to send.

Output: a verdict plus, on a gap, the policies your draft left out.

Example

A customer asks to cancel. Your draft confirms it but never mentions the refund window they still qualify for.

Request:

{
  "customer_message": "I want to cancel my subscription today.",
  "draft_reply": "Done, your subscription is cancelled. Sorry to see you go."
}

Result:

{
  "verdict": "gap",
  "misses": [
    {
      "id": "refund_window",
      "title": "Refund window",
      "suggestion": "You are within your 14-day refund window, so you can still request a refund for this billing period.",
      "reason": "The customer is cancelling and qualifies for a refund they were not told about."
    }
  ]
}

A clean reply returns verdict: "pass" with an empty misses list. That means clear to send, not that nothing ran.

Reviews

No reviews yet

Be the first to review this server!