fredyee/hallucc-mcp

**中文文档** ｜ Live Demo ｜ Official MCP Registry
> Give your AI a fact-checker and a safety gateway: claim-by-claim hallucination detection, agent trajectory evaluation, L0-L3 risk gating for Computer-Use Agent (CUA) actions, Agent source code static audit, and a 40+ feature prompt-injection / jailbreak guard — one MCP server, five tools, works with Claude Code / Cursor / Claude Desktop.
See it first — no sign-up required
- 🔍 A real verification report (per-claim verdicts + confidence + sources): https://aihcc.cloud/r/GttouoJfMpkC
- 🛡️ Try CUA action gating online (rule-based, free, no quota cost): https://aihcc.cloud/cua
- 📝 Web app (3 free checks per day): https://aihcc.cloud
Tools (5)
| Tool | Backend endpoint | What it does | Quota |
|---|---|---|---|
| verify_text | POST /detect | Claim-by-claim hallucination check: red/yellow/green summary + per-claim status/confidence/reason/**sources** + citations | ✅ detect |
| verify_agent | POST /detect-agent | Text-level verification of an agent's final output + 6-dimension trajectory evaluation (factuality / sourcing / instruction compliance / tool-claim consistency / task completion / reflection) | ✅ detect |
| check_cua_actions | POST /cua/classify | L0-L3 risk classification for Computer-Use Agent (CUA) actions + takeover (credential scenarios); covers sensitive paths/destructive commands, domain grading, payment-amount thresholds, task_scope intent deviation, and multi-agent delegation-chain taint analysis; response includes ruleset_version and disclaimer (pure rules, no LLM) | ❌ free |
| check_cua_code_audit | POST /cua/audit-code | Static audit of Agent source code: dangerous imports / permission boundaries / injection surfaces / dangerous defaults / sandbox absence | ❌ free |
| check_safety | POST /guard/check (fast=true → /guard/check-fast) | 40+ feature safety gateway: prompt injection / jailbreak / harmful content / PII leakage / fraud | ✅ detect |
> Auth model: each client sends Authorization: Bearer → the server forwards it **as-is** to the backend → the backend validates and deducts from the same account quota as the web app. Keys travel only in HTTP headers — **never in tool arguments, never in model transcripts**.
The tightening capabilities of check_cua_actions
| Field | Effect |
|---|---|
| actions[].target_url / url | Target URL of a browser action — navigation to an unknown domain escalates to L2; pasting sensitive content to a non-allowlisted domain escalates to L3; blacklisted domains are L3 |
| task_scope.task | Declares the intended task, used for deviation detection and audit traceability |
| task_scope.allowed_apps / allowed_domains | Allowed apps / domains (domain suffix matching includes subdomains) |
| task_scope.forbidden_elements | Forbidden element labels (highest precedence) |
| actions[].chain_id | Multi-agent delegation chain id (uuid hex) — when given, the response gains a chain_trace cross-hop taint analysis |
| actions[].agent_id / parent_agent_id | The agent owning this action / its delegating parent — pairs cross-agent-boundary propagation chains |
| actions[].delegation_depth | Delegation depth (root agent = 0); a subagent exfiltrating content matching sensitive patterns gets an L2 |
An action that leaves task_scope is **escalated one level** (L0→L1, L1→L2, L2 stays L2 with an "outside task scope" reason appended, L3 unchanged). This mechanism only tightens and never loosens; omitting task_scope has no effect. Credential fields and payment/login domains yield a takeover verdict (suspend and wait for the user to type it themselves — the agent never types your password).