Card Skimmer and POS Tamper Checks

What it does

Card Skimmer and POS Tamper Checks takes the result of a hands-on look at each card device in a convenience store (PIN pads, counter terminals, fuel-pump card readers, self-checkouts, ATMs) and says which ones need attention. For each device you send your own label, its kind, the date of the last inspection, and seven checks marked pass, fail or not_checked (seal intact, serial matches your list, no overlay or loose parts, no extra cable or hole, no foreign device or camera nearby, housing and mount secure, pump panel lock intact). It sorts devices into failed, overdue (not looked at within your own interval, 7 days unless you say otherwise), incomplete (a check missing) or ok, and says what to do next. If you also answer five plain questions about how the store takes cards, it names the PCI self-assessment questionnaire (SAQ B, B-IP, P2PE, C, C-VT, SPoC or D) the answers point to, with the reason and the questions still open. Every answer lists its sources with the date the rules were written, and carries a signed record anyone can check against the public key below. Ask for check_sources and it also reads the PCI Security Standards Council's own public pages, through Countersign's safe fetcher, and reports which PCI DSS version they name today and whether the version these rules were written against (PCI DSS v4.0.1) is still the newest one named. It is a checklist and a lookup: no model, no network call unless you ask for the source check, nothing stored.

Who it is for

Agents that help convenience-store owners, franchise operators and the small payment and POS service firms that look after them, and that want a fast, checkable first pass on card-device inspections and the right PCI form.

Price

Free, no sign-up: 120 checks an hour per address. Paid calls are planned and not charging.

Limits

Up to 50 devices per call, 30,000 bytes in all; larger requests are refused, never cut. It does NOT inspect anything: a person looks at the devices and tells it what they found. It cannot detect a skimmer, scan a network, test encryption, assess PCI compliance, replace a PCI assessor or decide which SAQ you must file; your acquirer or processor decides that. 'No problems in what you reported' is never a statement that the devices are safe. 'Overdue' uses your own interval (1 to 90 days); PCI sets no number of days, it asks you to set the frequency by a documented risk analysis (requirement 9.5.1.2.1). The SAQ pointer follows the five answers only; each form has more eligibility conditions, online orders are a separate channel, and the mapping is the builder's reading of the published SAQ descriptions, not checked against the form PDFs in this build. The source check reads version numbers printed on two public PCI SSC pages (cached 10 minutes for everyone, 20 source checks an hour per address); it does not read the standards. The only addresses fetched are those two, fixed inside the tool: you cannot send an address. Do not send card numbers, serial or terminal numbers, or staff names: device labels and the store label with 6 or more digits are refused, and unknown fields are refused, but it cannot spot every identifier, so keep them out. Nothing you send is stored. The signed record covers a fingerprint of your inputs, the counts, the verdict, the suggested SAQ and what the source check found, not the per-device list, which you can recompute from the stated rule.

For developers: try it

POST https://llpro.ai/mcp
{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"card_skimmer_and_pos_tamper_checks","arguments":{"devices":[{"device_id":"lane1-pinpad","kind":"pin_pad","last_inspected":"2026-11-10","checks":{"tamper_seal_intact":"pass","serial_matches_device_list":"pass","no_overlay_or_loose_parts":"fail"}}],"payments":{"how_cards_are_taken":"standalone_ip_terminal","stores_card_data_electronically":"no","terminals_are_pci_approved_pts":"yes"},"check_sources":true}}}
-> device status (failed / overdue / incomplete / ok), the suggested SAQ with its reason, sources with dates, the PCI DSS version the Council names today, signed record

For agents

Tool card_skimmer_and_pos_tamper_checks on https://llpro.ai/mcp and in the tools list. Signed answers are checked with the public key below (signer llpro1:ju55uz4narilapl3plbr77te2y): an Ed25519 signature over the observation as canonical JSON (sorted keys, no spaces).

Public key (base64): VuKy94ZsA9r9QVXkXcw7g4hdg53JjcYLE1SoGz3vam4=

This tool exists to be found by agents that search MCP registries for card-device, point-of-sale and PCI checks (road: MCP registries, through the Campus gateway: MCP, Agent2Agent and REST). It makes one signed, checkable answer per call; keep the signed record with your work so a person can see what was checked and when.

For agents: this page as Markdown · JSON · llms.txt · MCP endpoint llpro.ai/mcp · agent card