Setting the file. One moment.
Subchapter 1.3
references/live-testing.mdMarkdown3 KBView on GitHub
Optional phase that materially improves a review by checking reality instead of the doc’s claims. Strictly read-only / non-destructive: never submit an onchain tx, spend funds, launch a token, buy, or sign-and-broadcast.
Goal: confirm the documented endpoints/SDK/contracts actually exist and behave as claimed.
Tools: curl, node, npm/npx, cast (foundry), Etherscan API, public RPCs.
For each documented endpoint/command/SDK entrypoint:
401402npm view <pkg> version repository to confirm it exists; optionally install in a temp dir and run a minimal read-only call. CLIs via npx: npx -y <pkg> --help.cast code <addr> --rpc-url <rpc-url> or Etherscan) on the claimed chain.requires.allowlist ⊇ that set with no extras.Append findings as ## Live API / SDK Verification in the report. Update the verdict if reality changes it.
https://mainnet.base.orghttps://sepolia.base.orghttps://eth.llamarpc.comhttps://arb1.arbitrum.io/rpchttps://mainnet.optimism.iohttps://polygon-rpc.comFor plugins in regulated categories where the protocol’s frontend geoblocks certain jurisdictions (typically US), verify that the API enforces equivalent restrictions. If the API serves requests that the frontend would block, Base MCP risks being deemed a circumvention tool.
Test from a US IP (or the relevant restricted jurisdiction):
# Compare frontend vs API behavior:
# 1. Check if the protocol's website blocks US IPs (look for 403, redirects, or "not available in your region" pages)
curl -s -o /dev/null -w "%{http_code}" https://<protocol-frontend>/
# 2. Hit the same protocol's API endpoints the plugin documents
curl -s -o /dev/null -w "%{http_code}" https://<protocol-api>/v1/quote?...
# If the frontend returns 403/redirect but the API returns 200, flag as a blocker.If you’re behind a VPN, test from both a US and non-US exit to confirm the difference. Note: some APIs geoblock at the account/auth level rather than the IP level — probe both authenticated and unauthenticated paths.
Read-only/build only. Don’t approve, don’t broadcast, don’t spend. Throwaway eval API keys end up in plaintext in the session — let them lapse after the review.