Demand challenge — Slip only — 18 September 2026

Role. Adversarial market challenger. Demand only. Legal and security are out of scope even when they would also kill.

Product under test. Slip as specified in decision/DECISION.md and decision/SPEC.md: a public blast-radius card for MCP/tool catalogs + English→YAML + hashed decision receipts. Not a hosted MCP proxy. Price: $0 / $19 Indie / $49 Studio. Domain: cryptobook.space (former crypto social).

What this file is not. The adoption challenge (challenges/adoption.md) invented “MCP Blast Card” and scored it SURVIVE. The competition challenge invented Slip as the patched survivor. Finance scored a “Permit Inbox” stretch to $5k MRR. Those files are treated as claims to attack, not gospel. A product can survive legal/security/competition and still have no buyer this week.

Bar. Instant KILL if any of the four tests fail. SURVIVE only if a Cursor/Claude Code human would pay $19 this week, the card is a tweet not homework, cryptobook.space can reach that human, and ~150 paying customers in 12 months is plausible on PLG only.

Verdict: KILL

Zero of four. Demand does not care that the architecture is not a gateway. The job “see what this MCP can do” is a free homepage category as of this date. The job “pay $19/mo for an unwatermarked receipt and a deny inbox” is a feature looking for a weekly ritual that does not exist unless the user first installs a PEP Slip is forbidden to be.

If PM ships Slip as specified, the playground will get lurker screenshots and ~0–15 paying accounts by M6. That is the finance kill-switch. Demand is calling it now.

Kill tests used (demand only)

1. This-week wallet. A person who already has Cursor or Claude Code open will spend $19 in the next seven days rather than the free default they already have.
2. Tweet, not homework. A stranger posts the object without being paid. If the aha requires tools/list JSON, an account, English rules, or a local sidecar, it is homework.
3. Channel matches buyer. The domain, brand, and discovery path are where this buyer already looks.
4. PLG arithmetic. ~150 paying in 12 months without a sales team, from this VPS, this domain, this price.

“Category is hot” is not a pass. MCP security is hot. That is why the homepage is already occupied.

Named landscape, fetched 18 September 2026

Slip’s homepage promise is SPEC H1: “See what the agent can do.” That sentence is not white space. It is the default H1 of a crowded free-scanner lane.

Products whose homepage is “see what this MCP can do”

These are not adjacent. They are the same first screenshot.

ToolProof.ai (separate from the free scanner) sells $249/server connection reviews and $49/mo maintained profiles to MCP publishers, not to Cursor users. That is the only paid conversion that clearly exists in “what can this MCP touch,” and the buyer is a vendor shipping a server, not an indie installing one.

There is already a paid product whose homepage is this job. MCP Observatory charges $29 for hosted scan history. ShieldMCP charged $49 for the PDF. Neither is a breakout. Observatory’s own ladder admits the money is a $15,000 enterprise pilot. That is a sales motion Slip forbids.

The free defaults the $19 has to beat this week

Slip does not replace any of these. It asks the same human to also keep a pink receipt.

What Slip thinks is scarce, and is not

“A + B + C, and nobody ships all three” is still not demand. It is the aggregator excuse the competition file already rejected for Hallpass. Slip is that aggregator with the proxy cut out. Cutting the proxy removed the only reason anyone would pay (enforcement). What remains is a poster.

Test 1 — $19 this week vs the free default

FAIL.

The hair-on-fire moment is real: “I am about to paste this MCP into Cursor.” That moment is already instrumented:

1. Paste URL into Toolproof or CodeFlowOps → 30–60s grade, $0, no account.
2. npx mcp-scan against the config they just wrote → $0, scans stdio too.
3. Look the server up in Armor1 / Backslash / PolicyLayer / Observatory Safety Index → $0.
4. Leave Claude on always_ask / set Cursor mcpAllowlist → $0, and this actually blocks the call.

Slip’s paid conversion (SPEC + DECISION) is not the card. The card is free, watermarked. Paid is:

• unwatermarked /r/ receipt
• 90-day deny / spend inbox
• saved policies, project token, POST /v1/decide

None of those fire this week unless the user:

• creates an account on a crypto-social domain
• compiles English they have not written
• installs a local PEP Slip is not allowed to be (security/competition: no customer MCP proxy)
• generates enough real denies to make an inbox feel like insurance

A receipt of a demo session against a toy GitHub catalog we own is a brochure. Nobody pays $19/mo to unwatermark a brochure.

WTP table for this exact buyer (indie Cursor/Claude Code, this week):

$19 is not cheap. It is a second subscription for a poster of a decision the IDE already made. Langfuse $29 is the ceiling for infra people already tracing production agents. Slip is not in that workflow.

The one human who might pay this week already got a $400 Anthropic invoice. They buy OpenAI/Anthropic spend limits (now hard 429s) or Cloudflare AI Gateway, not a tool-name classifier.

Test 2 — Tweet or homework?

FAIL as a company. The card is a tweet that other people already tweeted.

Predicted posts in adoption.md:

“PSA: the ‘official’ X MCP can read_file your .env. Card: cryptobook.space/c/…”

That post is real as a genre. It is also how Toolproof, CodeFlowOps, PolicyLayer, Armor1, Backslash, and Observatory already grow. A stranger will post a card. They will post the card from the tool they already ran (npx mcp-scan, Toolproof, Observatory Safety Index). They will not discover a fourth card site named CryptoBook, paste tools/list JSON, and then pay to remove a watermark.

Honest aha path in SPEC:

1. Click Example: GitHub MCP (canned). Felt scare. This is a landing animation. Rehearse was killed as a SKU for this reason.
2. Paste a remote MCP URL. Security forbids fetching customer MCP from this VPS (SSRF). If engineering obeys, this path is a lie.
3. Paste raw tools/list JSON. Homework. The indie who “opened Cursor 20 minutes ago” does not have that JSON. Getting it is mcp inspector, a proxy, or reading a log. That is a docs tab.

So the only honest 60-second aha is the canned example. A canned example is a museum. IBM Composer already taught this lesson on quantum. SSL Labs taught it on badges. ShieldMCP taught it on MCP configs: free scare, $49 PDF, nobody bought.

English box + YAML pane is a form. Adoption already called a policy textarea homework when it killed Hallpass. Slip put the same textarea under the card. That does not make it a tweet. It makes the tweet a lead-gen for homework.

The paid object (/r/ of /v1/decide against a local PEP) is a weekend integration. Adoption kill-test 2. Stdio never hits cryptobook.space. SPEC is explicit: “Enforcement of real GitHub/Slack/filesystem servers runs next to your agent.” Next to the agent = the user did homework. They will do that homework inside Claude/Cursor settings, or npx @policylayer/intercept, not by POSTing {tool, args_hash, policy_id} to a VPS they found via a pink card.

Tweetable ≠ billable. HaveIBeenPwned is a tweet. It is not a $19/mo SaaS for the person who pasted their email. Troy Hunt bills enterprises. Slip has no enterprise motion and is forbidden from becoming one.

Test 3 — Is cryptobook.space a viable channel?

FAIL.

Buyer: person installing MCP into Cursor / Claude Code this week.

Where they already look:

• npx / uvx (mcp-scan, Observatory, Intercept, ccperm, toolproof-scan)
• Cursor forum / Claude docs / GitHub Copilot org settings
• Google: “MCP security scanner”, “is this MCP safe”, “mcp-scan”
• HN Show HNs from Golf, Armor1, Observatory
• Snyk, Permit.io, PolicyLayer, Backslash — funded or OSS-default brands

Where they do not look:

• A domain that still says crypto social. cryptobook.space / .com Google as a coin-talk leftover. Finance already applied a 30–50% conversion haircut for this brand tax. Demand applies a distribution zero.
• A site that spent 2026 with an expired Let’s Encrypt cert (expired 2026-04-11). That is not a trust signal for a security card.
• Virtus-pink chrome associated with virtusblockchainlabs.com / tokensmarketcap.com. Wrong graph.

No existing audience of coding-agent users on this host. The social graph is being taken out (BRIEF). There is no HN brand, no npm package, no VS Code extension, no Cursor marketplace listing, no npx slip. PLG for this buyer is the terminal. Slip’s distribution is a website on a dead social domain.

cryptobook.com DNS is still on IONOS (217.160.223.94), HTTP basic-auth. Even the “real” name is not on this VPS. Shipping on .space and hoping SEO for “MCP blast radius” from a crypto brand is how casino sites fail to sell CI.

Golf (YC), Snyk, Permit.io, Backslash, PolicyLayer, Observatory, Toolproof already spent 2025–2026 teaching Google what “MCP security” means. A new domain does not outrank npx mcp-scan in the week the user is scared.

Test 4 — ~150 paying in 12 months, PLG only

FAIL.

Required math (finance.md, restated):

Freemium → paid for a dev tool with a strong OSS/free alternative: 2–3.5%, not 4.5%. Unknown domain, ungated playground: visitor→signup 2–4%.

To hold 150 paying at 3% free→paid and 5%/mo churn on a monthly $19 insurance SKU you need, roughly:

• ~5,000–8,000 ever-paid-capable signups over the year (churn eats the stack)
• ~150k–400k playground unique visitors on a new domain with a crypto name

cryptobook.space will not do that. Comparable attempts:

Every serious player that started with a card either gives the card away forever (Armor1, Backslash, Toolproof, PolicyLayer registry) or uses it as a lead into a gateway / enterprise control plane (Permit, Golf, Observatory, PolicyLayer hosted). Slip is forbidden to be the gateway. So it is the lead-gen with no paid back-end the user will install.

Retention death: set-and-forget card = 6–10%/mo churn (finance). The “weekly denied N” email only exists if /v1/decide is on the hot path. It will not be. Empty inbox → cancel in month one. DECISION residual risk #1 already said: if M6 paying < 15 after a real launch, stop. Demand says you will hit that kill-switch.

150 paying PLG customers is a fantasy about someone else’s distribution. GitHub Copilot allowlists, Snyk, Permit Community, and npx own the pipe.

Why the previous SURVIVE was a category error

Adoption F / competition Slip / finance Permit Inbox all made the same swap:

Humans do not buy policy. They buy a scare they can share, then they pay to make the scare stop.

The scare is real. The second clause is false in this market. The scare already has a free stop:

• Don’t install it (card / catalog / mcp-scan)
• Allowlist it in the IDE (Claude, Cursor, Copilot)
• Wrap it with OSS (Intercept, mcp-doorman, Toolproof wrap, Wombat)
• Drop in Permit Community URL if they even want a hosted hop

Paying to “make the scare stop” is how gateways convert, and Slip is not a gateway. Paying for a prettier scare is how badges fail to convert. Slip is a badge with a YAML compiler.

DECISION’s own one-sentence test — public blast-radius card + signed receipt, without becoming the gateway — is exactly the product shape that has no WTP. The gateway is where the money is (Permit Pro $25, Observatory $15k, Golf enterprise, PolicyLayer hosted). The card is the brochure those companies print for free.

What I refuse to bless as a FIX

• “Lower to $9.” Then you need 556 paying. Worse arithmetic, same free substitutes.
• “Charge MCP publishers $249 like ToolProof.” Different buyer, Armor1/Backslash already gave the catalog away, cryptobook.space is a joke of a trust brand for a server vendor. Still KILL.
• “Add the wrap URL behind the card.” That is Hallpass. Security + competition already killed it. Demand would still lose to Permit Community $0.
• “Ship npx @slip/pep as distribution.” Then we are mcp-doorman / Intercept / Wombat / Observatory, with zero stars, on a crypto npm scope. The website is no longer the product and still has no reason to be $19.
• “Launch on HN / Twitter with Virtus pink.” One spike. Then the user bookmarks Toolproof or runs mcp-scan. ShieldMCP already ran the PH experiment.

No narrower Slip on this substrate passes the four tests.

Job that WOULD have demand on this VPS (if any)

Not Slip. Not another MCP catalog. Not English→YAML. Not receipts.

Demand that already walks into this box is tokensmarketcap.com (live, multi-backend) and the surrounding Virtus properties. academy.tokensmarketcap.com is currently 404. That is a hole in an existing intent stream, not a new category to evangelize from a dead social domain.

Jobs, ranked by whether a stranger would use them this week without a tweetstorm:

1. Serve TMC’s existing visitor — market data, listings, calculators, the academy URL that already 404s. This is boring and it is the only inbound this VPS actually has. BRIEF said “not TokensMarketCap unless specified”; demand does not care about the aesthetic brief. A 404 on a property people already type is wasted demand.
2. Do not manufacture an agentic SKU on cryptobook.space. The coding-agent buyer lives in npx and in Cursor/Claude settings. This domain cannot be that store. If the founder personally has a Cursor/Claude audience, the artifact is an npm package, and even then the lane is owned (mcp-scan, Observatory, Intercept). A pink SaaS on .space will not be paid.
3. Publisher trust badges / MCP directory — the only observed WTP in “what can this MCP do” is server authors (ToolProof $249, mcp-audit widgets, Observatory $15k). Still crowded, still a bad brand fit, still a sales-shaped ceiling. Mentioned only so nobody “pivots” into it and calls it demand.

Quantum remains a demand kill (IBM Composer free + real QPUs). Freelance receipts remain a two-sided kill. Trace clones remain a price kill.

There is no agentic-governance job on cryptobook.space that a Cursor user will pay $19 for this week. The VPS can keep hosting the sites people already open. Slip is not one of them.

Instruction to PM

Flip Slip from SURVIVE to KILL on demand. Do not ship the playground as a company. Do not spend a sprint on /c/ and /r/ hoping the card converts. The card is a tweet other products already send; the paywall is homework; the domain is a crypto ghost; 150 PLG customers will not appear.

If the builder has already started SPEC, stop at the toy demo. Do not wire Stripe. Do not register slip as if it were a product.

Re-open the pivot. The constraint “must be agentic AI or quantum” is what produced a brochure. Demand’s constraint is “someone already coming to this VPS, this week, with a wallet out.” That person is not installing GitHub MCP. They are hitting tokensmarketcap.com.

End of challenge.