Ruflo
Agent teams, swarms, memory and hooks for Claude Code and Codex, served over MCP.
Guardrails for LLM output: pass / fail / review verdicts and one recommended action. Hosted or npm.
Wähle die KI-App, die du nutzt, und kopiere die Einstellungen.
5/5 Prüfungen bestanden · Was du fragst, läuft über den Server des Anbieters (overwing.ai)
Zuerst: Welche KI nutzt du?
Wähle deine App, dann erscheinen die Schritte unten.
Klappt mit Claude · etwa 5 Min.
Du brauchst einen Schlüssel von Overwing (auf der Seite des Anbieters registrieren, kann kosten) · Einmal auf claude.ai oder in der Desktop-App einrichten, dann im Chat nutzen · kostenlose Konten können 1 hinzufügen
Öffne die Seite des Anbieters, registriere dich und erstelle einen API-Schlüssel für den nächsten Schritt. Kann Geld kosten.
CustomizeConnectors
Kopiere jeden Wert in das gleichnamige Feld in Claude und klicke Continue
Overwinghttps://overwing.ai/mcpUnter Request headers diesen Namen und Wert hinzufügen
AuthorizationBearer <Schlüssel hier einfügen>Füge den Schlüssel nur in das Feld der App ein, nie in einen Chat und schick ihn niemandem
Authentication so lassen, wie Claude es erkannt hat, dann Add klicken
+ConnectorsOverwing
Nutze Overwing und sag mir, was du für mich tun kannst; zeig mir dann eine Sache✓ Wenn Claude sagt, dass es Overwing nutzt, oder ein Werkzeug von Overwing in der Antwort zeigt, bist du verbunden
Menünamen am 11. Nov. 2026 mit der Hilfe von Anthropic abgeglichen · dein Bildschirm kann je nach App-Version leicht abweichen
ChatGPT kann Overwing noch nicht verbinden
Overwing braucht zum Verbinden deinen eigenen Schlüssel, aber die OpenAI-Hilfe beschreibt nur die Anmeldung per OAuth; eine Schlüssel-Option konnten wir nicht bestätigen
A · Eine App nutzen, die Overwing verbinden kann
B · Andere in Suche & KI-Gedächtnis, die mit ChatGPT funktionieren
Aus den meistgenutzten derselben Kategorie, nur solche, die per Adresse ohne Schlüssel verbinden
Klappt mit Claude Code · etwa 5 Min.
Du brauchst einen Schlüssel von Overwing (auf der Seite des Anbieters registrieren, kann kosten)
Öffne die Seite des Anbieters, registriere dich und erstelle einen API-Schlüssel für den nächsten Schritt. Kann Geld kosten.
Mac: Command+Leertaste drücken und Terminal tippen · Windows: PowerShell öffnen
claude mcp add --transport http overwing https://overwing.ai/mcp --header 'Authorization: your-value'Ersetze „your-value“ vor dem Enter durch deinen Schlüssel
Füge den Schlüssel nur in das Feld der App ein, nie in einen Chat und schick ihn niemandem
Overwing sollte in der Liste als verbunden erscheinen
Nutze Overwing und sag mir, was du für mich tun kannst; zeig mir dann eine Sache✓ Wenn Claude Code sagt, dass es Overwing nutzt, oder ein Werkzeug von Overwing in der Antwort zeigt, bist du verbunden
Menünamen am 11. Nov. 2026 mit der Hilfe von Anthropic abgeglichen · dein Bildschirm kann je nach App-Version leicht abweichen
Klappt mit Cursor · etwa 5 Min.
Du brauchst einen Schlüssel von Overwing (auf der Seite des Anbieters registrieren, kann kosten)
Öffne die Seite des Anbieters, registriere dich und erstelle einen API-Schlüssel für den nächsten Schritt. Kann Geld kosten.
In den Einstellungen von Overwing ist Authorization leer; trag deinen Schlüssel ein und speichere
Füge den Schlüssel nur in das Feld der App ein, nie in einen Chat und schick ihn niemandem
Nutze Overwing und sag mir, was du für mich tun kannst; zeig mir dann eine Sache✓ Wenn Cursor sagt, dass es Overwing nutzt, oder ein Werkzeug von Overwing in der Antwort zeigt, bist du verbunden
Menünamen am 11. Nov. 2026 mit der Hilfe von Cursor abgeglichen · dein Bildschirm kann je nach App-Version leicht abweichen
Klappt mit VS Code · etwa 5 Min.
Du brauchst einen Schlüssel von Overwing (auf der Seite des Anbieters registrieren, kann kosten)
Öffne die Seite des Anbieters, registriere dich und erstelle einen API-Schlüssel für den nächsten Schritt. Kann Geld kosten.
VS Code fragt nach einer Bestätigung; klicke Install
In den Einstellungen von Overwing ist Authorization leer; trag deinen Schlüssel ein und speichere
Füge den Schlüssel nur in das Feld der App ein, nie in einen Chat und schick ihn niemandem
Nutze Overwing und sag mir, was du für mich tun kannst; zeig mir dann eine Sache✓ Wenn VS Code sagt, dass es Overwing nutzt, oder ein Werkzeug von Overwing in der Antwort zeigt, bist du verbunden
Menünamen am 11. Nov. 2026 mit der Hilfe von VS Code abgeglichen · dein Bildschirm kann je nach App-Version leicht abweichen
Claude Code
claude mcp add --transport http overwing https://overwing.ai/mcp --header 'Authorization: your-value'Cursor (~/.cursor/mcp.json)
{
"mcpServers": {
"overwing": {
"url": "https://overwing.ai/mcp",
"headers": {
"Authorization": "your-value"
}
}
}
}VS Code (mcp.json)
{
"servers": {
"overwing": {
"type": "http",
"url": "https://overwing.ai/mcp",
"headers": {
"Authorization": "your-value"
}
}
}
}Claude Code
claude mcp add overwing --env OVERWING_API_KEY=your-value --env OVERWING_AGENT_KEY=your-value --env OVERWING_BASE_URL=your-value -- npx -y overwing-mcpClaude Desktop (claude_desktop_config.json)
{
"mcpServers": {
"overwing": {
"command": "npx",
"args": [
"-y",
"overwing-mcp"
],
"env": {
"OVERWING_API_KEY": "your-value",
"OVERWING_AGENT_KEY": "your-value",
"OVERWING_BASE_URL": "your-value"
}
}
}
}Cursor (~/.cursor/mcp.json)
{
"mcpServers": {
"overwing": {
"command": "npx",
"args": [
"-y",
"overwing-mcp"
],
"env": {
"OVERWING_API_KEY": "your-value",
"OVERWING_AGENT_KEY": "your-value",
"OVERWING_BASE_URL": "your-value"
}
}
}
}VS Code (mcp.json)
{
"servers": {
"overwing": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"overwing-mcp"
],
"env": {
"OVERWING_API_KEY": "your-value",
"OVERWING_AGENT_KEY": "your-value",
"OVERWING_BASE_URL": "your-value"
}
}
}
}OVERWING_API_KEY geheim envOVERWING_AGENT_KEY geheim envOVERWING_BASE_URL envDiese Einstellungen werden aus dem Registry-Eintrag des Entwicklers erzeugt. Wenn in der README etwas anderes steht, folge der README.
npm: overwing-mcpBasierend darauf, wie sich dieser Server verbindet, und auf der eigenen Doku jeder App, geprüft am 10. Nov. 2026.
Verbinden sich über das Internet in
ClaudeGooseLM StudioMsty StudioCherry StudioCursorVS Code + GitHub CopilotVisual StudioWindsurf (Devin Desktop)ZedKiroClineContinueJetBrains AI AssistantClaude CodeCodex CLIGemini CLIOpenCodenodecodeWarpLibreChatOpen WebUIRaycast
Laufen auf deinem Computer in
ClaudeGooseLM StudioMsty StudioCherry StudioCursorVS Code + GitHub CopilotVisual StudioWindsurf (Devin Desktop)ZedKiroClineContinueJetBrains AI AssistantClaude CodeCodex CLIGemini CLIOpenCodenodecodeWarpLibreChatRaycast
Tool-Namen und -Beschreibungen genau so, wie der Server sie am 8. Nov. 2026 gemeldet hat. Geschrieben hat sie der Entwickler, nicht wir; wir zeigen sie als reinen Text.
evaluateWorks with no API key: 10 evaluations a day, inputs up to 2,000 characters, and the text is not stored. With a key: 250 a day and up, inputs up to 100,000 characters, and your own rule sets. Score any text (typically an LLM's output) against an Overwing rule set. The text can be
evaluate_batchScore up to 50 texts against one rule set in a single call. Each item counts as one evaluation. Returns a summary plus per-item verdicts; items can fail independently. Needs an organization key.
list_rule_setsList the prebuilt and custom rule sets available to this organization. Needs an organization key.
get_rule_setFetch a rule set with its full rule definitions. Use 'content-safety' as a worked example when writing your own. Needs an organization key.
create_rule_setCreate a custom rule set with 1 to 25 rules. Each rule is a choice (pick one option), score (position on an ordered scale), or noul (yes/no) question with a fail condition, optional review threshold, weight, and action (block, redact, or review) that callers should take when it f
get_evaluationFetch a stored evaluation by id, including the original input and per-rule results. Needs an organization key.
list_evaluationsList recent evaluations, newest first, with optional verdict and rule set filters. Use next_cursor to page. Needs an organization key.
get_usageDaily usage, remaining quota for today, and plan limits. Needs an organization key.
whoamiIdentify the organization and plan behind the API key on this request, the key's scope, the organization's data settings (store_inputs, retention_days), and whether billing is set up. Needs an organization key.
create_accountCreate an Overwing account for yourself, with no email: an organization and an API key, returned once. Nothing is sent to anyone. Use it when you have no key and nobody has given you one; do not create a second account if you already have a key (whoami says which account a key be
prove_domainBegin proving that your account controls a domain. For an account with no email the domain stands in for one: it raises the limits to the normal free tier, opens full Beacon reports, and lets a lost key be replaced. Returns one value to publish at the domain, as a DNS TXT record
verify_domainLook for the value prove_domain asked for, at the domain. Found: the domain is the account's. Not found: an error saying what was looked for; DNS changes can take a few minutes, and calling again is safe. Needs an organization key.
list_plansPublic plan catalog: prices, daily limits, and per-minute burst limits. No API key needed.
atlas_lookupSay what a User-Agent string claims to be and whether the claim can be trusted, from the Overwing Atlas registry of AI crawlers, fetchers and browser agents. Returns the claimed agent, operator, purpose class, verification method (Web Bot Auth signature, user-agent string only, o
atlas_agentsBrowse or search Overwing Atlas, the registry of AI crawlers, fetchers and browser agents: name, operator, user-agent tokens, Web Bot Auth key directory, robots.txt behaviour, and (with Atlas Pro or Team) purpose class, verification, evasion flags and traffic shares. Filter by fr
atlas_register_agentAdd an agent or crawler you operate to the Overwing Atlas registry, free, so a site that looks up its User-Agent learns who runs it. Give the agent's name, the operator (the company or person running it), the operator's domain, and the token the User-Agent carries (the product na
atlas_verify_registrationLook for the proof at the operator's domain: the DNS TXT record or the file that atlas_register_agent asked for. Found: the entry is published in the registry, or held for a person when the operator name already belongs to someone. Not found: an error saying what was looked for;
atlas_list_registrationsThe agents this organization has registered in Overwing Atlas, newest first, each with its status (pending_verification, pending_review, published, rejected) and, while unverified, the value to publish at the domain. Needs an organization key.
atlas_withdraw_registrationWithdraw a registration. A published entry leaves the registry, so lookups stop naming the agent; an unfinished request is abandoned. This cannot be undone: register again to put it back. Needs an organization key.
atlas_summaryPublic numbers from Overwing Atlas: registry counts by purpose and verification, published browser-agent traffic shares, sector field-scan headlines (e.g. how many OSINT sites carry AI-crawler rules or any agent-payable surface), and the summary of the Agent Consumers report on w
beacon_startOverwing Beacon answers one question about a site: is this product reachable by agents? It checks robots.txt rules for AI agents, llms.txt, the sitemap, the MCP server card, hosted MCP endpoint and MCP Registry listing, the A2A agent card, OpenAPI discovery, and how the home page
beacon_reportThe report for a check started with beacon_start. The first call runs the check. With an Overwing key on the connection: score (0 to 100), verdict (yes, partly, no), the find / read / use answers, every check with what was found and a fix when it did not pass, and top_fixes ranke
feedbackSend one message to the people who run Overwing: a verdict you think was wrong, an error you could not act on, a payment you could not make, a tool that did not do what its description says. Read by a person, not answered automatically; give a contact if you want an answer. No ke
beacon_sampleA real Overwing Beacon report, free: the check of overwing.ai itself, refreshed daily. Read it to see exactly what a full report holds before starting a check. No key needed.
preflight_paymentCall this with the 402 you were given, before signing an x402 payment. It reads the terms (network, asset, amount, payee, timeout, resource) and answers allow, review or refuse with reasons: the terms against your policy, the payee against x402-list's directory (verified delivery
preflight_checkCall this before signing any Solana transaction. Overwing Preflight simulates the unsigned transaction against the chain as it is now, works out what it would take from the wallet you name (SOL, tokens, and control of its token accounts) and answers allow or refuse against your p
preflight_verdictThe public record of one Preflight verdict: its decision, reason codes, the programs the transaction would run, the transaction's digest, our signature, and every landed transaction reported against it. Never the wallet, the amounts or the transaction. No key needed.
preflight_reportAfter a transaction that Preflight allowed has landed, report its signature. Preflight reads the landed transaction from the chain and says whether the allow held: not_a_miss, or miss when it took more from the wallet than the policy permitted. The outcome is published. A covered
preflight_recordEverything Preflight has said and how it held up: counts of verdicts and misses, every miss with what the chain showed, the latest verdicts, and what the guarantee's reserve holds. Read it before deciding whether to rely on Preflight. No key needed.
preflight_overviewThe reference for Overwing Preflight: every policy field, every reason code a refusal can carry, what a verdict does and does not promise, the price, and the terms of the guarantee. Read it once before the first preflight_check. No key needed.
tower_load_templateSet up Overwing Tower for this organization by loading the starter workflow: email purchase order to order entry, with create_order, update_order and cancel_order against a mock IBM i system, and a starter policy. Idempotent. Needs an organization key. Returns a sample input you
tower_create_agentCreate a scoped agent identity and its key. Needs an organization key. Scope it to the operations the agent needs (for example create_order) rather than * where you can. The key (ow_agent_...) is returned once, in this result, and this server does not keep it: store it, and send
tower_list_agentsList this organization's Tower agents with scopes, status and last use. Keys are never returned. Needs an organization key.
tower_revoke_agentRevoke an agent. Its key stops working at once and cannot be restored. Needs an organization key.
tower_capabilitiesList the operations this agent is allowed to call, each with the JSON Schema its input must match and its compensating operation. Call this first; build inputs from the schema rather than guessing. Needs an agent key.
tower_decideAsk Tower how it would rule on an operation without doing anything: auto (would execute), review (a person must approve), or reject. Returns the score, the reason, and each policy question's answer. No side effects. Needs an agent key.
tower_submit_actionAsk Tower to perform an operation on the legacy system. Tower decides: executed (done), pending (a person must approve; poll tower_get_action, do not resubmit), or rejected (do not retry unchanged). Always send an idempotency_key that is stable for this business request, such as
tower_get_actionStatus and result of an action: pending, approved, executed, failed, compensated, or rejected. Use it to poll an action that is waiting on human review. Needs an agent key.
tower_compensateRun the compensating operation for an executed action, for example cancel the order that create_order made. Runs once; repeating it returns the first outcome. Needs an agent key.
tower_get_receiptFetch one signed receipt by id or by sequence number: the payload, its hash, the previous link's hash, and the Ed25519 signature. Needs an agent key.
tower_verify_receiptsRecompute every hash and check every signature over a range of this organization's receipts. Reports the first break, if any. Defaults to the whole chain (up to 5,000 links per call). Needs an agent key.
Wir prüfen Informationen, die jeder sehen kann; den Code haben wir nicht gelesen. Checks, die nicht zutreffen, werden nicht mitgezählt. · Geprüft am 12. Nov. 2026
Der Registry-Name wurde über die Domain overwing.ai bestätigt (die Registry prüft, wem die Domain gehört)
Code zuletzt geändert: vor 8 Tagen
Nutzt MIT
Antwort in 262 ms (HTTP 200)
Keine Anmeldung nötig
Wir haben 41 Tool-Beschreibungen gelesen und keine versteckten Anweisungen an die KI gefunden
Fragen, Tipps teilen oder melden, dass etwas nicht geht. Sortiert nach „hilfreich“.
Noch keine Beiträge. Stell die erste Frage oder teile einen Tipp.
Beiträge hier stammen von Nutzern, nicht vom PopNx-Team.
Noch keine Bewertungen
Verglichen mit allen aktiven Servern dieser Kategorie in der Registry. Sterne zählen nur, wenn dem Herausgeber das Repo gehört.
Er hat 5 von 5 zutreffenden Basischecks bestanden. Den Code haben wir nicht gelesen. Bevor du einen Schlüssel oder Token hinzufügst, sieh nach, welche Zugriffe der Server verlangt, und nutze einen Schlüssel, der nur die Berechtigungen hat, die du brauchst.
Das musst du eintragen: OVERWING_API_KEY, OVERWING_AGENT_KEY, Authorization
Beides geht: Installiere ihn auf deinem Computer oder verbinde dich mit der Cloud-Version.
Das GitHub-Repo wurde zuletzt vor 8 Tagen geändert, und die neueste Version (0.15.0) kam vor 29 Tagen in die Registry.
Apps, die MCP unterstützen, etwa Claude Desktop, Claude Code, Cursor und VS Code. Er verbindet sich per URL und funktioniert daher auch in Apps mit Remote-MCP, etwa ChatGPT Business und höher.
In derselben Kategorie: Ruflo, Context7, Metabase
Server derselben Kategorie von anderen Entwicklern, sortiert nach Sternen.
So liest du eine Karte:↓ Downloads pro Wochei★ GitHub-SterneiDrei Säulen: Bewertungen · Checks · NutzungiAktualisiert = neueste Version in der Registry veröffentlichti
Unverändert aus dem Repo des Entwicklers übernommen. PopNx MCP hat den Inhalt weder geprüft noch empfiehlt es ihn. HTML, Bilder und Skripte wurden entfernt. Links führen von dieser Website weg.
Guardrails for LLM output, as MCP tools.
Score any text for safety and quality. Get pass / fail / review verdicts with calibrated confidence, usually in under 500 ms.
简体中文 · 日本語 · 한국어
Overwing is an API that checks what your model said before it ships. This package exposes it to any MCP-capable agent: Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, OpenAI's Agents SDK, and anything else that speaks the Model Context Protocol.
fail means a rule matched; review means it was unsure; pass means neither.Try it without installing anything: paste text into the console at overwing.ai.
The same 41 tools are served at https://overwing.ai/mcp (Streamable HTTP). Point any client that takes a remote MCP URL at it:
claude mcp add --transport http overwing https://overwing.ai/mcp
No key is needed for evaluate, atlas_lookup, atlas_summary, list_plans, create_account, the three beacon_ tools, and preflight_verdict, preflight_report, preflight_record and preflight_overview. For the rest, send Authorization: Bearer ow_live_... on the connection.
It works with no API key: evaluate and atlas_lookup each run 10 times a day free, and text sent without a key is not stored. For more, get a key at overwing.ai/login, or let your agent make its own account with the create_account tool. That account has no email: nothing is sent to anyone, and the key is returned once. The same call from a shell:
curl -X POST https://overwing.ai/api/v1/signup
Put the key in OVERWING_API_KEY. An account with no email starts at 50 evaluations a day; proving a domain (prove_domain, verify_domain) raises it to the normal free limits and makes a lost key recoverable.
Claude Code
claude mcp add overwing -e OVERWING_API_KEY=ow_live_... -- npx -y overwing-mcp
Claude Desktop, Cursor, Windsurf, VS Code (any JSON-configured client)
{
"mcpServers": { "overwing": { "command": "npx", "args": ["-y", "overwing-mcp"], "env": { "OVERWING_API_KEY": "ow_live_..." } } } }
Set OVERWING_BASE_URL to point at a self-hosted deployment. Requires Node 20+.
For Overwing Tower, set OVERWING_AGENT_KEY=ow_agent_... to operate as an existing agent. Without it, tower_create_agent mints a key with the organization key and keeps it in memory for the session.
evaluate, atlas_lookup, atlas_summary and list_plans work with no key at all.
For Overwing Preflight, preflight_check needs OVERWING_API_KEY; the other preflight_ tools need no key. No Preflight tool takes a private key, and none should ever be given one.
The text can be in any language. It was tested on 2026-09-29 in Spanish, Portuguese, French, German, Japanese, Simplified Chinese, Korean, Arabic and Hindi: a small test, not a benchmark. Results come back in English.
| Tool | What it does |
|---|---|
evaluate | Score one text against a rule set. Returns the verdict, a recommended_action (block, redact, review, or allow), aggregate score, confidence, latency, and per-rule results with each rule's action. Takes an optional context object (recipient, channel, ownership) that context-aware rule sets such as outbound-message read, and store: false to run the check without keeping the text. |
evaluate_batch | Score up to 50 texts in one call, with a summary and per-item verdicts and recommended actions. |
list_rule_sets · get_rule_set · create_rule_set | Browse the prebuilt set or define your own rules: yes/no questions, classifications, or scored scales. |
get_evaluation · list_evaluations | Read stored results, filter by verdict or rule set, page with a cursor. |
create_account · prove_domain · verify_domain | An account for the agent itself, with no email: create_account returns a key and sends nothing to anyone. Proving a domain (a DNS TXT record or a file) takes the place of the email: it raises the limits, opens full Beacon reports, and makes a lost key recoverable. |
atlas_lookup | Overwing Atlas: say what a User-Agent string claims to be and whether the claim can be trusted (Web Bot Auth, spoofable string, or unattributable). Works with no key, 10 a day; 100 a day with a free key. |
atlas_agents · atlas_summary | Search the registry of AI crawlers, fetchers and browser agents; get traffic shares, sector field-scan headlines, and the agent-spending summary. |
atlas_register_agent · atlas_verify_registration · atlas_list_registrations · atlas_withdraw_registration | Add an agent you operate to the Atlas registry, free, so a lookup of its User-Agent names you. Register it, publish the value you are given at the operator's domain (a DNS TXT record or a file), then verify. Needs OVERWING_API_KEY. |
beacon_start · beacon_report · beacon_sample | Overwing Beacon: is a site reachable by agents? Checks robots.txt, llms.txt, the MCP server card, endpoint and Registry listing, the A2A agent card and OpenAPI, and how the home page reads to a model. A check is free: beacon_start returns an id and beacon_report runs the check and returns the report. With OVERWING_API_KEY it is the full report, saved to your dashboard; with no key it is the summary (the score, the three answers and the first fix). beacon_sample is a real report in full. |
feedback | Tell the people who run Overwing what went wrong: a wrong verdict, an error you could not act on, a payment you could not make. No key needed. |
preflight_check | Overwing Preflight: should the agent sign this Solana transaction? Give it the unsigned transaction in base64 and a policy: the wallet to protect, the most SOL that may leave it (max_sol_out, fees included, or max_sol_out_lamports), and optionally max_token_out, min_token_in, allowed_programs and allow_delegation. It simulates the transaction and answers allow or refuse with every reason. Sign only on allow; a refusal, an error or anything else means do not sign. A verdict is valid for about two minutes. It never takes a private key. One check counts as one evaluation. Needs OVERWING_API_KEY. |
preflight_payment | Should the agent sign this x402 payment? Reads the 402's terms and checks the payee against x402-list's directory and the server's own manifest, and the price against the record. allow, review or refuse with reasons. No key needed. |
preflight_verdict · preflight_report · preflight_record · preflight_overview | Preflight's public side, with no key: read one published verdict, report the transaction that landed after a verdict (by its signature) to learn whether the verdict held, read the record of every verdict and miss, and read the overview of policy fields, reason codes, limits and prices. |
tower_load_template · tower_create_agent · tower_list_agents · tower_revoke_agent | Overwing Tower setup, with the organization key: load the starter order-entry workflow, then mint a scoped agent identity. The new agent key is used for the rest of the session. |
tower_capabilities · tower_decide · tower_submit_action · tower_get_action · tower_compensate | Overwing Tower operations, with the agent key: see which operations you may call and their input schemas, ask how a request would be ruled, submit it (executed, pending human review, or rejected), poll it, undo it. |
tower_get_receipt · tower_verify_receipts | Read a signed receipt, or recompute every hash and signature in the chain. |
get_usage · whoami · list_plans | Today's quota, the org behind the key, and the public plan catalog. |
The overwing://guide resource returns the full plain-text API guide.
What this server does on your machine: it reads three environment variables (OVERWING_API_KEY, OVERWING_AGENT_KEY, OVERWING_BASE_URL) and makes HTTPS requests to the Overwing API. It reads no files, runs no commands, and talks to no other host. It has two runtime dependencies (@modelcontextprotocol/sdk, zod), and the whole server is one file: src/index.ts.
What happens to text you evaluate:
get_evaluation, until you delete them. To change that:store: false to evaluate or evaluate_batch to keep no text or context for that call;store_inputs: false on the organization (PATCH /api/v1/org, or the dashboard) to keep none at all;retention_days on the organization to delete evaluations after that many days.preflight_check is sent to the Overwing API with its policy, and simulated against a Solana node. What is published is the verdict: its id, decision, reason codes, programs and the transaction's digest. Never the wallet, the amounts or the transaction. No private key is ever sent, and the tool does not accept one.Give your agent a restricted key. A key with scope evaluate can run checks and read rule sets, and cannot read stored evaluations, change rule sets, manage keys, webhooks or billing, or delete anything:
curl -X POST https://overwing.ai/api/v1/api-keys \
-H "Authorization: Bearer ow_live_..." -H "Content-Type: application/json" \ -d '{"name":"agent","scope":"evaluate"}'
Overwing is a young service and has not had an independent security audit. The full picture, including subprocessors and what we have not done, is at overwing.ai/security; the privacy policy is at overwing.ai/privacy. To report a vulnerability, see SECURITY.md.
Ask your agent:
Check this reply before I send it: "Reach me at dana@example.com or 555-0142 to sort out the refund."
It calls evaluate and gets back:
Verdict: FAIL score=0.82 confidence=0.97 251ms
toxicity: pass (answer="safe", confidence=1) pii_detected: fail (answer=true, confid