com.getnoden/noden

Est-ce que com.getnoden/noden est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.getnoden/noden » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 6 outils

• check_order_status≈ 106 tokens

  Poll an order's status: pending, completed or failed. Once completed, the output and verification result are included. If failed, the result is not returned and a retry_token (one free call, 24 hours) is included.

  Paramètres, retour & exemple (1)

  Paramètres

  • order_id · string · requis

  Exemple d'appel

  {"name": "check_order_status", "arguments": {"order_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_operator≈ 206 tokens

  Self-register for an operator API key with no human required — no signup form, no login. Use this if you don't already have an api_key from a human operator. Returns a key with a small, fixed daily spend cap (default 1000 sats, max 5000 sats) that cannot be raised later. This key has no free call — purchases are paid over Lightning. The free first call belongs to a verified human account (email confirmed). For a higher cap and ongoing human review/monitoring, a human should sign up their own account at https://shop.getnoden.com/signup instead.

  Paramètres, retour & exemple (1)

  Paramètres

  • spend_cap_sats · number · optionnel
    Requested daily spend cap in sats. Defaults to 1000, capped at 5000.

  Exemple d'appel

  {"name": "create_operator", "arguments": {"spend_cap_sats": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_skill≈ 100 tokens

  Get full detail on one skill listing, including the exact input JSON Schema needed to purchase it. The output schema is reduced to field names — the exact output format is delivered after purchase.

  Paramètres, retour & exemple (1)

  Paramètres

  • skill_id · string · requis

  Exemple d'appel

  {"name": "get_skill", "arguments": {"skill_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• purchase_skill≈ 589 tokens

  Purchase a skill. Validates input against the listing's schema and the caller's spend cap/allowlist, then returns a Lightning invoice for the exact price of one call; once the invoice is paid the skill runs and the result is checked against the listing's output schema. If the check fails the result is not returned and no sats are sent back: the order status gives a single-use retry_token, and passing it here (same skill, same api_key, within 24 hours) runs one free call. A verified human account gets one free call on a listing priced at or below the trial cap: the response then has free_trial true and no invoice — just poll check_order_status. Every other purchase returns a Lightning invoice. Free skills (price_sats 0) need no payment: the response has free_skill true and no invoice, just poll check_order_status. 'input' (the skill's required input, matching its input schema) is required, and so is a key: pass 'api_key' (your operator API key), or set it once as an 'Authorization: Bearer <key>' header on this MCP connection. Spend-cap enforcement needs to know which operator is calling. If 'agent_wallet_connection' is given (a nostr+walletconnect:// URI), Noden also asks that wallet to pay the invoice directly via NWC — this is best-effort and fire-and-forget: check wallet_payment_requested/wallet_payment_error in the response, and pay the returned invoice yourself if it's not true. The skill runs only once Noden itself detects the payment on the invoice, never because the wallet-push call succeeded.

  Paramètres, retour & exemple (5)

  Paramètres

  • input · object · requis
    Input matching the skill's input JSON Schema
  • api_key · string · optionnel
    Your operator API key. Optional if the connection sends it as an Authorization: Bearer header
  • skill_id · string · requis
  • retry_token · string · optionnel
    A retry_token from a failed order of this same skill: runs one free call instead of returning an invoice
  • agent_wallet_connection · string · optionnel
    Optional nostr+walletconnect:// URI — if given, Noden asks this wallet to pay the invoice

  Exemple d'appel

  {"name": "purchase_skill", "arguments": {"input": {}, "skill_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_skills≈ 167 tokens

  Search the Noden skill catalog by capability. Hybrid keyword/category match (semantic search when configured). 'tags' is folded into the same keyword search as 'query' — the catalog does not yet have a dedicated tags field.

  Paramètres, retour & exemple (4)

  Paramètres

  • tags · array · optionnel
    Extra keywords, matched the same way as query
  • query · string · optionnel
    Free-text capability description, e.g. 'reviews contracts'
  • category · string · optionnel
  • max_price_sats · number · optionnel

  Exemple d'appel

  {"name": "search_skills", "arguments": {"tags": [], "query": "texte", "category": "texte", "max_price_sats": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• submit_skill≈ 158 tokens

  Submit a new skill listing for sale. NOT YET AVAILABLE — the seller-listing flow isn't live on Noden yet. Calling this returns a structured 'not available' response and writes nothing.

  Paramètres, retour & exemple (5)

  Paramètres

  • name · string · optionnel
  • price_sats · number · optionnel
  • description · string · optionnel
  • input_schema · object · optionnel
  • output_schema · object · optionnel

  Exemple d'appel

  {"name": "submit_skill", "arguments": {"name": "texte", "price_sats": 1, "description": "texte", "input_schema": {}, "output_schema": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://shop.getnoden.com/mcp