# Bitcoin Devkits > Offline test fixtures that check whether your agent refuses poisoned tools and hostile sellers. No API key, no LLM spend. Pay once in bitcoin, no account. Delivered as a zip in a Nostr DM. MIT licence. - Test your client, in CI, with golden cases that have a known right answer: same result every run, no keys, no network. - Payer Safety Tests is the test your spend guard should pass: hostile mock sellers in both 402 styles (L402 and x402 headers and field names, every value a mock), judged from the wallet and seller logs. - Each kit lists what it does not test under limits; kits that ship a LIMITS.md carry the full list in the zip. Sole trader, ABN 53 775 929 055, Australia (name on ABN Lookup). Not registered for GST. ## What is for sale - payer-safety-tests 1.0.2: Payer Safety Tests, A$15, paid in bitcoin on-chain. A runnable test suite for the paying side of agent-to-API payments. It runs your payer code against misbehaving mock sellers and a mock wallet, then reports which safety checks failed. Local only, no real funds. MIT licence. Zip payer-safety-tests-1.0.2.zip, 28865 bytes, SHA-256 26cd698ca95c0d8ea0dd1266fa894b74bbd79bd9032bc8a2cb0559b1261b9880. - mcp-safety-tests 1.0.2: MCP Safety Tests, A$19, paid in bitcoin on-chain. Offline test fixtures that check whether your MCP client or agent refuses poisoned tools: 33 golden cases in 7 families (tool poisoning, shadowing, rug-pulls and clean controls), a black-box harness and a tool-description linter. Same result every run; no LLM key, no network. MIT licence. Zip mcp-safety-tests-1.0.2.zip, 28988 bytes, SHA-256 a9d65c315c2a05644b7e64905aee88203407960f2f6b86a7a115cc48144998ef. - mcp-safety-policy 1.0.3: MCP Safety Policy, A$12, paid in bitcoin on-chain. Starter allow, confirm and deny rules for the tool calls an agent makes (shell, files, deletion, payments, network), an evaluator, a before-tool-call hook and a token estimate. Offline. MIT licence. Zip mcp-safety-policy-1.0.3.zip, 23997 bytes, SHA-256 67bd2c66eb02f6c4878cb6cf7a34d340cbe75488a0333b80896c738e105c895b. ## Free tools Free to download and use; no order, no DM. - mcp-safety-lint 1.0.0: MCP Safety Lint. An MCP server (stdio) that lints a list of MCP tool definitions for prompt-injection wording and hidden Unicode, and estimates their context cost. It reads only the list you pass: no files, no network. Tools: lint_tools, budget_tools. MIT licence, Node 20+, no dependencies, offline. Tarball: https://karma-incense-mcrm.here.now/mcp-safety-lint-1.0.0.tgz (10089 bytes, SHA-256 37f16a224afcd2ccf3f79ea968809611eef2d9f9b910cea4054a22ba81bef693; checksum file https://karma-incense-mcrm.here.now/mcp-safety-lint-1.0.0.tgz.sha256). MCP config: `{"mcpServers":{"mcp-safety-lint":{"command":"npx","args":["-y","https://karma-incense-mcrm.here.now/mcp-safety-lint-1.0.0.tgz"]}}}` ## How to order (Nostr DM only) Shop public key: npub18g2gs2facz8ma4mx8uymtmcqnvs3ryc0c93jw3l6w9cvaaly44gqnr392s. Relays: wss://relay.damus.io, wss://nos.lol, wss://relay.primal.net. Send a NIP-17 direct message (kind 14 inside a kind 1059 gift wrap): - `help` lists what is for sale. - `buy payer-safety-tests ref=agents` returns a quote. - `sample payer-safety-tests ref=agents` returns a free sample zip of 8000 bytes or less (one sample per sender per day). - `buy mcp-safety-tests ref=agents` returns a quote. - `sample mcp-safety-tests ref=agents` returns a free sample zip of 8000 bytes or less (one sample per sender per day). - `buy mcp-safety-policy ref=agents` returns a quote. The quote has: order id; product name and version; price in A$ and in sats, with the A$ per BTC rate used; time until which the price holds; one-use on-chain address and a bitcoin: URI; confirmations needed; seller line with the ABN. The price holds for 30 minutes. Pay on-chain. Confirmations: 1; 100 AUD or more: 3. The zip arrives in the same chat as base64 between BEGIN and END lines, with its SHA-256, once the payment has the confirmations. Check it with shasum -a 256. Or from a shell (Node 18+, no dependencies): `curl -fsSO https://karma-incense-mcrm.here.now/buy.mjs && node buy.mjs buy ` prints the quote; pay it from your own wallet, then `node buy.mjs wait ` saves the zip once its SHA-256 matches. buy.mjs: 47017 bytes, SHA-256 991fbe48dfe8656236f1e820dd4b286159a9982e8992b22343ebcb0f6e994600; checksum file https://karma-incense-mcrm.here.now/buy.mjs.sha256. ## Limits ### Payer Safety Tests - Headers and field names follow L402 and x402 (v1 and v2), but every value is a mock: no real macaroons, signatures or invoices. The kit tests your payer's decisions (what it pays, how often, to whom), not its cryptography or a real seller. - It covers the 14 failure modes in docs/THREAT-MODEL.md and nothing else. - The harness runs your command with only PATH and HOME in its environment. Never point it at a real wallet; the wallet URL is always a local mock. - A full run takes about 30 seconds. ### MCP Safety Tests - Each fixture asks for one next step. It cannot see an agent that behaves for three steps and leaks on the fourth. - The harness judges only the JSON your agent prints. Calls your wrapper makes without reporting them are invisible. - 33 fixtures are examples, not a catalogue. - The reference agents are scripts, not language models. No LLM is called. - The canary check covers raw, URL-encoded, base64, hex and reversed forms. A paraphrased, split or encrypted secret is not caught. - The linter is a heuristic with false positives and false negatives. Resources, prompts, sampling, OAuth and transport are not tested. ### MCP Safety Policy - This is a guard, not a guarantee. Review every rule before you rely on it. - The patterns catch plain spellings. Quoting tricks, variables, encodings and scripts that run other scripts are not caught. - A test runner on the allow list still runs your project's code, which can write anything. - It sees one call at a time: not earlier calls, the user's intent, file contents or what a command does once it runs. - The rules are written for common tool names. Until you edit them, your own tools fall through to the default, which asks. Broad names such as `read*`, `fetch*` or `delete*` also catch tools you did not mean. - The hook blocks only when it runs. A missing `node`, a wrong path or a timeout lets the call through. - A Grep with no path can print lines from a `.env` file in the workspace. - An allowed host also admits its subdomains, and any allowed URL can still carry data in its path. - Payment caps are per call. It does not total spend over time, and it never sends money. - The code has not had an independent audit. It is a set of starting rules, not security advice. ## Terms Australian Consumer Law guarantees are not affected. Change-of-mind refunds are not offered. Refunds go to an address the buyer gives. Questions: reply in the chat. Business and developer sales only; not sold to consumers in the EU or UK. Machine-readable version: agents.json (schema bitcoin-devkits/agents/1, updated 2026-10-10). ## Prices in sats, pages and terms Prices are set in A$. The quote gives the price in sats at the A$ per BTC rate when you ask (mempool.space AUD price) and holds it for 30 minutes; there is no fixed sats price. - Payer Safety Tests 1.0.2: A$15, in sats at the quote's rate. Page: https://karma-incense-mcrm.here.now/payer-safety-tests.html - MCP Safety Tests 1.0.2: A$19, in sats at the quote's rate. Page: https://karma-incense-mcrm.here.now/mcp-safety-tests.html - MCP Safety Policy 1.0.3: A$12, in sats at the quote's rate. Page: https://karma-incense-mcrm.here.now/mcp-safety-policy.html - One test from MCP Safety Tests, free: https://karma-incense-mcrm.here.now/mcp-safety-sample-test.html - Terms: https://karma-incense-mcrm.here.now/terms.html - Refunds: https://karma-incense-mcrm.here.now/refunds.html - Privacy: https://karma-incense-mcrm.here.now/privacy.html