QuotaProof MCP

QuotaProof turns SaaS pricing, entitlements, and usage limits into an executable contract before customers discover the mistakes.

A paid product usually repeats the same promise across a pricing page, billing products, feature gates, route middleware, counters, resets, and usage dashboards. Those copies drift. Free users can slip beyond a hard limit, paid users can be blocked early, retries can charge twice, failed requests can consume quota, and upgrades can keep stale lower-tier access.

QuotaProof audits that entire chain with five deterministic MCP tools:

• audit_plan_catalog finds invalid limits, ambiguous calendar resets, broken overage rules, duplicated metrics, and higher-priced plans that lose features or quota. • audit_enforcement_map maps routes and MCP tools to entitlements, then detects client-controlled quota identities, non-atomic final-slot races, asynchronous hard-limit meters, fail-open behavior, missing idempotency, and batch-unit mismatches. • generate_boundary_tests produces exact last-included, first-excess, multi-unit, reset, failed-request, retry, concurrency, upgrade, and downgrade scenarios. • replay_usage_trace replays sanitized production events and reports false allows, false blocks, overcharges, undercharges, duplicate retry charges, and remaining-counter drift. • compare_plan_versions classifies catalog changes as customer-breaking, revenue-leaking, billing-sensitive, safe additions, or manual-review items, with a migration checklist.

Every result includes stable rule codes, precise JSON paths, evidence, counterexamples, and recommended fixes. The engine is stateless and uses no model calls, provider APIs, database, secrets, or outbound requests. Use opaque subject identifiers; never submit customer content or credentials.

Built for SaaS founders, API and MCP publishers, platform engineers, billing teams, and QA teams who need to prove that customers receive exactly the access they were promised—and cannot consume expensive work for free.

QuotaProof is an audit and testing aid. It proves consistency with the plan contracts and traces supplied to it; it does not certify an undisclosed production implementation.