accueil / serveurs / Recherche & Web / ai.vaaya/mcp
ai.vaaya/mcp
serveur MCP (Model Context Protocol) · vaaya 1.0.0
Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur.
Est-ce que ai.vaaya/mcp est sûr ?
Au dernier audit MCP Hub, le serveur MCP « ai.vaaya/mcp » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.
Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.
Les 14 outils
- buy≈ 3498 tokens
Find and buy products, tickets, bookings and subscriptions for the user at supported stores. Start with `search` { query } to find the item and merchant page using Vaaya OneSearch (5¢ per search); the user can describe what they need without supplying a link. Before checkout, use `setup` to check payment and shipping readiness; resolve missing setup once. Persistent merchant accounts are managed at /store-connections. Use store_connection_id to select an account. Passwords and verification codes belong only on the merchant page, never in chat. PRODUCT DISCOVERY: if the user describes what to buy but provides no URL, use `search` { query: <product, variant, budget and preferred merchant if specified> } to locate it under the existing tool spending permissions; do not ask them to paste a link or say search for it first. Search is not purchase authorization. Respect search fees and spending limits; if search is unavailable, explain the actual error and then ask for a link. Verify the merchant, item and variant from the result; ask only when matches are ambiguous or details cannot be verified. Never invent a product URL, final total or delivery date from a search snippet. THE SEAMLESS PATH: once the user has told you what to buy and you have the exact item, merchant page URL and total, call `purchase` { item, merchant, url, total_cents, confirmed: true, confirmation: <the user's own words> } — it approves from their message (under the chat limit), starts buying in the user's cloud browser in the background and returns `message` ("Hold on — buying it now."): RELAY IT, then poll `status` { approval_id } every ~10 seconds and relay its `message` when the status is completed ("Done — …"), requires_action (read action_required.reason for the exact blocker) or failed. If `status` says the user's shipping address is missing, ask for it and call `address` { name, line1, line2?, city, state?, postal_code, country, phone? } then `checkout` { approval_id } to resume; if merchant authentication is pending, relay handoff_url and handoff_deadline. The durable worker checks authentication and resumes the same authorized purchase automatically. Do not ask the user to send done or submit codes in chat. If the handoff expires, relay the recovery page; it does not clear order or payment uncertainty. Other sub-commands: `search` { query } (protocol merchants plus a real web search; the web half bills 5¢), `propose` { item, merchant, total_cents, url?, notes?, confirmed?, confirmation? } (creates an approval; without `confirmed` it returns an approval link the user opens — show its `message` VERBATIM), `checkout` { approval_id, params? } (buys an approved purchase; for a browser merchant it runs in the background like `purchase`). Use the user's existing authorization of the exact item and total; do not ask them to confirm twice. Ask only for missing purchase details. Nothing is ever bought without the user's yes: `checkout` refuses anything else. Use `reconcile` { approval_id } after an uncertain submission: it only inspects the existing checkout and never submits payment. For an unavailable checkout or inconclusive reconciliation, relay recovery_url and recovery_instructions from status. The user can resolve the attempt on its approval page only after checking both merchant orders and payment records. A chat statement alone does not clear the lock, and expiration does not clear it. If status or replay says purchase_resolved, never reuse checkout on that approval. When the user requests another attempt, call propose with retry_of set to that resolved ID, current item/price and no confirmed flag, then show the new approval link. Check setup browser_allowance first; a daily_browser_limit requires waiting until resets_at, not reconnecting or changing request text. For a handoff, return action_required.url and the deadline. The user fixes 2FA, CAPTCHA, payment, address or booking issues on that authenticated page and uses Return control to Vaaya; do not call checkout to bypass a pending handoff. Status polling never creates a replacement. Resume only the same approval_id; do not recreate a purchase to bypass an unresolved attempt. `charged_cents` is the Vaaya tool fee, NOT a merchant charge; read merchant_payment separately, and never infer a hold or capture from Link approval. Never open `browserbase` sessions yourself to buy something — only `buy` can.
Paramètres, retour & exemple (26)
Paramètresurl· string · optionnel
The exact product page the item came from — the driver starts there (`purchase`, `propose`).city· string · optionnel
City (`address`).item· string · optionnel
What exactly is being bought, in the user's words — variant, size, quantity (`purchase`, `propose`).name· string · optionnel
Full name for shipping (`address`).email· string · optionnel
Contact email for the order; defaults to the account email (`address`).line1· string · optionnel
Street address (`address`).line2· string · optionnel
Apartment / unit (`address`).notes· string · optionnel
One line for the driver/user: variant, size, colour, quantity, delivery window.phone· string · optionnel
Contact phone for delivery (`address`).query· string · optionnel
Describe the product, variant, budget and preferred store if any. `search` uses OneSearch to find matching items and merchant pages (5¢).state· string · optionnel
State / region (`address`).params· object · optionnel
The merchant's own purchase body (product id, quantity, email, shipping) for a protocol merchant (`purchase`, `checkout`).booking· ? · optionnel
Required for Expedia flights and Booking.com hotels: exact itinerary/stay, counts, fare/room, baggage/cancellation and payment terms. These are shown for approval and cannot be substituted. Traveler identity documents are entered directly on the merchant page, never in chat. Final booking review requires the authenticated handoff page.command· string · requis · setup | search | purchase | propose | status | checkout | reconcile | address
Use `search` to find an item with OneSearch, `purchase` to buy an authorized item, and `status` to track it.country· string · optionnel
Two-letter country code, e.g. US (`address`).currency· string · optionnel
ISO currency, default 'usd'.merchant· string · optionnel
Merchant host or URL, e.g. bombas.com (`purchase`, `propose`, `credentials`).password· string · optionnel
Password at the merchant — stored encrypted, never returned (`credentials`).retry_of· string · optionnel
For propose only: the previous approval ID resolved by the owner as no order/payment. Use only when the user requests a new attempt; omit confirmed and show the fresh approval link. Never vary item text or confirmation to bypass replay or locks.username· string · optionnel
Email/username at the merchant (`credentials`).confirmed· boolean · optionnel
true when the user has said yes to this exact item and total in the conversation (`purchase`, `propose`).approval_id· string · optionnel
The approval returned by purchase/propose (`status`, `checkout`).postal_code· string · optionnel
Postal / ZIP code (`address`).total_cents· number · optionnel
The full total the user will pay, in cents (`purchase`, `propose`).confirmation· string · optionnel
The user's own words approving it, verbatim (`purchase`, `propose`).store_connection_id· string · optionnel
Merchant account connection ID from /store-connections. Required when multiple accounts are connected to the same store. Sign in and enter verification codes directly on that page, never in chat.
Exemple d'appel{"name": "buy", "arguments": {"command": "setup"}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "web": "texte", "item": "texte", "next": "texte", "error": "texte", "status": "texte", "command": "texte", "message": "texte", "receipt": {}, "card_url": "texte", "currency": "texte", "merchant": "texte"}} - close≈ 306 tokens
Close an E2B sandbox session and stop its billing. Pass the `session_id`. Captures the final metered uptime cost and releases the hold. ALWAYS call this when finished with a session — an open session keeps billing per second of uptime. Safe to call repeatedly (idempotent).
Paramètres, retour & exemple (1)
Paramètressession_id· string · requis
The session_id to close.
Exemple d'appel{"name": "close", "arguments": {"session_id": "texte"}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "error": "texte", "status": "texte", "session_id": "texte", "charged_cents": 1, "balance_remaining_cents": 1}} - consult≈ 784 tokens
Vaaya's consultant. Describe ANY external capability you or the user might want — generate an image/video, search or scrape the web, run code in a sandbox, send/receive email, enrich a contact — and it helps figure out the best way, teaching the user what Vaaya can do. It is CONVERSATIONAL and remembers prior turns. It returns: mode='converse' (a reply to RELAY to the user verbatim — questions, options, ideas; get the user's response and call consult again with it, so the conversation continues), mode='call' (an ordered list of calls to run via `use`, with a message explaining the preferred choice + alternatives + why; multi-step results may contain placeholders like '<from step 1: sandbox_id>' — run earlier steps first and substitute), or mode='unsupported'. Every reply includes `suggestions` (2-3 things to do next) — surface these to the user. AFTER you run a `call` result's calls via `use`, call consult ONE more time with a short note on the outcome (what was produced / any failures) — it returns result-aware, Vaaya-grounded next steps to offer the user (the `call` result's `after_running` field reminds you). Call consult whenever you hit a capability gap or the user wants to know what's possible. It does NOT execute or bill — you run returned calls via `use`. ALWAYS show the user consult's `message` and `suggestions` and let them steer.
Paramètres, retour & exemple (1)
Paramètresintent· string · requis
Plain-English description of what you want, or your answer to a previous clarify question. Be concrete — include the prompt text, URL, budget, or target the task implies.
Exemple d'appel{"name": "consult", "arguments": {"intent": "texte"}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"mode": "converse", "calls": [], "reason": "texte", "message": "texte", "run_with": "texte", "suggestions": [], "after_running": "texte", "if_tools_missing": "texte", "if_use_unavailable": "texte"}} - docs≈ 446 tokens
Vaaya's deep reference, FREE and instant. Pass `topic` to get the full playbook for a capability area — exact services, actions, params, prices, model lists, and gotchas — the same reference files the vaaya skill ships. Topics: 'setup' (connecting an agent, a chat app, or an unattended process), 'tools' (exact params of every Vaaya tool, GTM suite included), 'media' (image/video/audio models + product-demo videos), 'gtm' (leads, enrichment, outreach, signals, email), 'research' (OneSearch lanes, deep research, company/market research playbooks), 'data' (scraping, people, social platforms, public records, onchain, compliance), 'compute' (sandboxes, browser automation, files, memory, workers, phone calls, llm). Read the matching topic BEFORE non-trivial work in that area — it is cheaper than a wrong call. Never bills; safe to call any time.
Paramètres, retour & exemple (1)
Paramètrestopic· string · requis · setup | tools | media | gtm | research | data | compute
Which reference to fetch.
Exemple d'appel{"name": "docs", "arguments": {"topic": "setup"}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "error": "texte", "topic": "texte", "topics": [], "content": "texte"}} - jobs≈ 1799 tokens
Jobs: a marketplace where humans hire humans, and each side's agent handles the steps. Call with { action, ...params }. Actions: list, get, mine, draft, update_draft, cancel, accept, submit_proof, record_verdict, request_release, dispute. A poster's agent drafts a job (budget_usd, definition_of_done, required_evidence) and gives its human the review_url; the HUMAN publishes, which holds the budget from their wallet. A doer's agent accepts an open job for its human and later submits that human's proof (summary + links). The poster's agent evaluates the proof against the definition of done with record_verdict. Only the poster, in their own browser on the job page, can release payment; no action here moves money to anyone. Never claim the agent did the work.
Paramètres, retour & exemple (17)
Paramètresgaps· array · optionnel
record_verdict: what is missing.note· string · optionnel
request_release: an optional note to the poster.links· array · optionnel
submit_proof: http(s) links to the evidence.title· string · optionnel
draft / update_draft: 5-120 characters.action· string · requis · list | get | mine | draft | update_draft | cancel | accept | submit_proof
list (anyone): Lists jobs, newest first. get (anyone): Returns the job contract; parties also see proof, verdict reasons and the payment reference. mine (anyone): Jobs your human posted or is doing. draft (poster): Saves a draft and returns review_url. Nothing is held until your human opens review_url and publishes. update_draft (poster): Edits a draft. cancel (poster): Deletes a draft, or cancels an open job. An open job’s hold returns in full. accept (doer): Accepts an open job for your human, who then does the work. submit_proof (doer): Submits your human’s proof of work against the definition of done and required evidence. record_verdict (poster): Records your evaluation of the latest proof. It is a recommendation; it never pays. request_release (doer): Asks the poster to review and release. It is a request; it never pays. dispute (either party): Freezes the job; the money stays held for supportjob_id· string · optionnel
The job id. Required for every action except list, mine and draft.reason· string · optionnel
dispute: what went wrong.status· string · optionnel · open | in_progress | done | all
Filter for list (open, in_progress, done) and mine (also all).summary· string · optionnel
submit_proof / record_verdict: the proof or the evaluation.criteria· array · optionnel
record_verdict: each part of the definition of done and evidence, met or not.budget_usd· number · optionnel
draft / update_draft: the budget in US dollars. Publishing holds exactly this.updated_at· string · optionnel
accept: the contract’s updated_at as you read it. If the poster reworded the job since, nothing is accepted; read it again.description· string · optionnel
draft / update_draft: what the work is, 20-4000 characters.recommendation· string · optionnel · release | revise
record_verdict: your recommendation. It never pays.idempotency_key· string · optionnel
draft / submit_proof: unique per intended job or proof; reuse it on retries.required_evidence· string · optionnel
draft / update_draft: the proof the doer must supply.definition_of_done· string · optionnel
draft / update_draft: the poster’s own words for when the work is finished.
Exemple d'appel{"name": "jobs", "arguments": {"action": "list"}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "url": "texte", "doer": "texte", "hold": {}, "jobs": [], "error": "texte", "proof": "texte", "rules": [], "title": "texte", "budget": {}, "fields": [], "job_id": "texte"}} - llm≈ 558 tokens
Ask a DIFFERENT LLM a question and get its answer, billed per token from the Vaaya wallet (model cost + 3%, usually a fraction of a cent). Use it to get a second opinion from a rival model, cross-check an answer, summarize a huge blob cheaply, or query a specific model the user names (Kimi, GPT, Gemini, Claude, DeepSeek, and 300+ more). `model` accepts 'auto' (default: short prompts go cheap, long go mid), 'cheap' | 'mid' | 'best' tiers, or any exact OpenRouter slug like 'moonshotai/kimi-k3'. Typical costs: cheap tier well under 0.1 cents, best tier 1-3 cents per call. Not for the conversation you are already having — it is a one-shot ask to another model.
Paramètres, retour & exemple (4)
Paramètresmodel· string · optionnel
'auto' (default), 'cheap', 'mid', 'best', or an exact OpenRouter model slug (e.g. 'moonshotai/kimi-k3', 'anthropic/claude-opus-5').prompt· string · requis
The question or task for the other model.system· string · optionnel
Optional system prompt for the other model.max_tokens· number · optionnel
Optional cap on the response length in tokens (default 4096, max 16384).
Exemple d'appel{"name": "llm", "arguments": {"prompt": "texte"}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "text": "texte", "error": "texte", "model_used": "texte", "charged_usd": 1, "prompt_tokens": 1, "requested_model": "texte", "completion_tokens": 1}} - result≈ 535 tokens
Fetch the status + output of an async job started by `use` (e.g. a video render). Pass the `job_id` that `use` returned with `{ async: true }`. Returns `{ status, result?, progress?, charged_cents }`: `running` (still working — when the job reports it, `progress` carries `{ phase, percent, rendered_frames, total_frames, eta_sec }` and `hint` is a one-line summary like "rendering 42% (380/900 frames, ~120s left)", so you can tell real progress from a hang; wait a bit and call again), `succeeded` (`result` holds the output, e.g. the video URL; the call is charged now), or `failed`/`cancelled` (no charge; on `failed`, read `error` AND `hint` — `hint` carries the service's usage notes, which usually explain how to fix the call). Safe to call repeatedly — it never starts new work or double-charges. ALWAYS use this to retrieve an async result instead of re-running `use` (re-running starts a new paid job).
Paramètres, retour & exemple (1)
Paramètresjob_id· string · requis
The job_id returned by an async `use` call.
Exemple d'appel{"name": "result", "arguments": {"job_id": "texte"}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "hint": "texte", "error": "texte", "job_id": "texte", "result": "texte", "status": "running", "progress": {}, "charged_cents": 1, "balance_remaining_cents": 1}} - session≈ 431 tokens
Run a command or code in an open E2B sandbox session (started by `use` with action `create_session`, which returns a `session_id`). Pass `session_id` plus either `command` (a shell command) or `code` (+ optional `language`: python/javascript/bash). Returns stdout/stderr/exit_code (or the code result). The sandbox stays alive — and billed per second of uptime — until you `close` it; re-running reuses the SAME box, so filesystem + process state persist between calls. ALWAYS `close` when done.
Paramètres, retour & exemple (4)
Paramètrescode· string · optionnel
Code to execute (alternative to `command`).command· string · optionnel
Shell command to run in the sandbox.language· string · optionnel
Language for `code`: python (default), javascript, or bash.session_id· string · requis
The session_id returned by create_session.
Exemple d'appel{"name": "session", "arguments": {"session_id": "texte"}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "error": "texte", "result": "texte", "stderr": "texte", "stdout": "texte", "exit_code": 1}} - stocks≈ 1120 tokens
Buy tokenized stocks on Base using only the user’s prepaid Vaaya balance, never the welcome credit or the GitHub credit line. Commands: list (supported token tickers), portfolio (owned stocks and buying power), quote {symbol, amount_cents}, buy {symbol, amount_cents, idempotency_key}, order {order_id}. When the user asks to buy a specified stock and dollar amount, resolve its supported token ticker (Apple = AAPLc) and call buy directly; no activation or additional approval step. amount_cents is the maximum total prepaid spend including provider fees. Use a unique idempotency_key for each intended purchase and reuse it on retries. Query order until confirmed/failed; queued/submitted is not success. Do not increase the user’s spend or retry a failed purchase as a new order without instruction. Ask only for missing or ambiguous purchase details. If prepaid_required or buyingPowerCents is insufficient, offer a $14/$40/$60 prepaid pack: POST /api/v1/topup with pack_cents 1400/4000/6000 and the same account bearer token returns a Stripe Checkout url. With authorization for that pack amount, the user’s Instinct agent can pay the URL in its browser using the card saved in Instinct; otherwise give the URL to the user. Vaaya cannot charge Instinct’s card directly. Do not include card details or tokens in a handoff. Check GET /api/v1/wallet wallet.prepaid_cents, then portfolio buyingPowerCents before resuming the same purchase key. A share purchase alone does not authorize a top-up. Stop on needs_review as well as failed.
Paramètres, retour & exemple (5)
Paramètressymbol· string · optionnel
Token ticker from list, e.g. AAPLc. Required for quote and buy.command· string · requis · list | portfolio | quote | buy | order
list (supported tickers), portfolio (holdings + buying power), quote, buy, or order (status by id).order_id· string · optionnel
Order id returned by buy. Required for order.amount_cents· integer · optionnel
Maximum prepaid spend in cents, pool fees included. Required for quote and buy.idempotency_key· string · optionnel
Unique per intended purchase; reuse it on retries. Required for buy.
Exemple d'appel{"name": "stocks", "arguments": {"command": "list"}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "error": "texte", "orders": [], "status": "texte", "stocks": [], "symbol": "texte", "tokens": "texte", "txHash": "texte", "address": "texte", "funding": "texte", "message": "texte", "holdings": []}} - use≈ 758 tokens
Execute a single external call, and bill on success. Used for any external capability (image/video/audio generation, web search, scraping, email, document parsing, code sandbox, browser automation, embeddings, etc.). The server validates params against a registered schema and proxies to the upstream — you never pass URLs or API keys. Call it directly when you know the exact (service, action, params, max_cost_cents) — from the vaaya skill's catalog or a call you've made before; when unsure, get the call from `consult` rather than guessing.
Paramètres, retour & exemple (5)
Paramètresaction· string · requis
Action within the service (e.g. "search", "generate", "create_session"), taken from the call `consult` returned.intent· string · optionnel
Optional: the one-line `why` from the consult call you're running (or the user's goal for it). Used only for internal transaction visibility — it never affects validation, billing, or execution. Pass it through when you have it.params· object · requis
Parameters from the call `consult` returned, validated against the service's registered schema.service· string · requis
Service identifier, taken verbatim from the call `consult` returned.max_cost_cents· number · requis
Hard ceiling in cents on what you will be charged. `use` refuses if the registry price exceeds this. Pick at least 2× the listed price so retries work.
Exemple d'appel{"name": "use", "arguments": {"action": "texte", "params": {}, "service": "texte", "max_cost_cents": 1}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "data": "texte", "async": true, "error": "texte", "job_id": "texte", "status": 1, "card_url": "texte", "protocol": "texte", "charged_cents": 1, "transaction_id": "texte", "balance_remaining_cents": 1}} - vaaya_account≈ 576 tokens
Show which Vaaya account this connection is linked to and its money state. Returns { email, name, user_id, connected_client, scopes, balance_cents, credit_line, available_cents, credits_url, switch_account }. Call it whenever the user asks "which account is connected", "what's my balance", "how much credit is left", or "how do I switch accounts" — and relay the answer. `credit_line` is the credit the account can spend past its prepaid balance (the welcome credit plus any GitHub-score line); `available_cents` = balance + active line, the number calls are gated on.
Paramètres, retour & exemple (0)
Exemple d'appel{"name": "vaaya_account", "arguments": {}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "name": "texte", "email": "texte", "scopes": [], "user_id": "texte", "needs_auth": true, "signup_uri": "texte", "credits_url": "texte", "instructions": "texte", "balance_cents": 1, "switch_account": "texte", "connected_client": "texte"}} - vaaya_logout≈ 305 tokens
Disconnect this client from the current Vaaya account: revokes this connection's authorization server-side, so every later call fails with 401 until the user reconnects. Call it when the user asks to log out, sign out, disconnect, or switch Vaaya accounts — then relay the returned switch steps VERBATIM (the browser sign-out step is what actually enables switching accounts).
Paramètres, retour & exemple (0)
Exemple d'appel{"name": "vaaya_logout", "arguments": {}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "error": "texte", "message": "texte", "logged_out": true, "to_switch_account": "texte"}} - vaaya_onboard≈ 335 tokens
Public onboarding hint for an agent whose user isn't linked to Vaaya yet. Returns where the human should go to connect (and sign up if new). Call this when vaaya_test_connection reports needs_auth, or any tool returns unauthorized, then relay the instructions to the user. If the user IS already linked it returns `first_call` instead — show `first_call.show_to_user` as written so they know what to try.
Paramètres, retour & exemple (0)
Exemple d'appel{"name": "vaaya_onboard", "arguments": {}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"message": "texte", "needs_auth": true, "signup_uri": "texte", "instructions": "texte", "already_linked": true, "verification_uri": "texte"}} - vaaya_test_connection≈ 402 tokens
Round-trip ping that confirms the agent → Vaaya connection and whether the user is linked. Returns { ok:true, userId, scope, version, server_time, first_call } when linked — SHOW `first_call.show_to_user` to the user as written, it is the same set of starter examples the website and installer give them. Returns { ok:false, needs_auth:true, verification_uri, signup_uri, instructions } when not linked yet — relay that to the user so they can connect (and sign up if new).
Paramètres, retour & exemple (0)
Exemple d'appel{"name": "vaaya_test_connection", "arguments": {}}Exemple de retour{"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "scope": "texte", "userId": "texte", "version": "texte", "needs_auth": true, "signup_uri": "texte", "server_time": "texte", "instructions": "texte", "verification_uri": "texte"}}
C'est votre serveur ?
Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».