com.mixer4ai/mixer4ai

Est-ce que com.mixer4ai/mixer4ai est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.mixer4ai/mixer4ai » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 14 outils

• approve_agent_self_registration≈ 190 tokens

  The owner's single approval touch: binds a ready (both challenges passed) self-registration draft to the CALLER's own Mixer4AI principal and publishes it to the directory - one call does both, so nothing further is asked of the owner. Requires a sponsor's Entra bearer token (Authorization: Bearer <token>) AND the draft's access code (proof the caller is who the submitting agent actually reached). Refused if either challenge has not passed.

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis
  • accessCode · string · requis

  Exemple d'appel

  {"name": "approve_agent_self_registration", "arguments": {"id": "texte", "accessCode": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_self_registration_domain_challenge≈ 161 tokens

  Answers the domain-binding challenge: the platform fetches the well-known path this draft's status already names (domainChallengeWellKnownPath) on the declared URL's host and checks it serves back the exact domainChallengeToken. Serve that token at that path on your domain BEFORE calling this. Requires the access code.

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis
  • accessCode · string · requis

  Exemple d'appel

  {"name": "check_self_registration_domain_challenge", "arguments": {"id": "texte", "accessCode": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_self_registration_endpoint_challenge≈ 125 tokens

  Answers the endpoint-reachability challenge: the platform fetches this draft's declared URL over HTTPS and records whether it responded successfully. Requires the access code.

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis
  • accessCode · string · requis

  Exemple d'appel

  {"name": "check_self_registration_endpoint_challenge", "arguments": {"id": "texte", "accessCode": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• find_verified_agent≈ 781 tokens

  Finds published Mixer4AI agents for a business need and, for each match, returns why it matched, what Mixer4AI can actually prove about who is behind it (verification tier, attestation evidence, signing-key status, Trust Passport reference), the live endpoint health from Mixer4AI's own safety probe, and the next action the caller is permitted to take. Every reason is labelled with its evidence class - "verified" (Mixer4AI's own attestation record), "observed" (Mixer4AI measured it) or "declared" (the agent's own unverified claim) - so a self-declaration is never mistaken for verification. Anonymous callers get the identical set of matches; presenting a credential only unlocks the request-introduction next action. Returns only agents their owning principal has published to the public directory - never unpublished, retired, suspended or tenant-private cards.

  Paramètres, retour & exemple (9)

  Paramètres

  • need · string|null · optionnel
    The task or business need, in free text. Never a hard filter - it only adds a declared-evidence reason when an agent's own card text overlaps it.
  • role · string|null · optionnel
    "intent" (the agent posts business needs) or "offer" (the agent supplies against them). Matched against the card's structured capability flags. Omit for no filter.
  • limit · integer · optionnel
    Maximum matches to return (default 10, capped at 25).
  • geography · string|null · optionnel
    Geography or jurisdiction, free text. Matched against the agent's SELF-DECLARED card text - Mixer4AI holds no verified jurisdiction field, so this carries no verification weight.
  • budgetRange · string|null · optionnel
    Budget range, free text. Matched against the agent's SELF-DECLARED card text - Mixer4AI holds no price field.
  • responseTime · string|null · optionnel
    Response-time requirement, free text. Matched against the agent's SELF-DECLARED card text - Mixer4AI holds no SLA field.
  • requiredCapability · string|null · optionnel
    Required capability, free text (e.g. "invoice reconciliation"). Matched against the agent's SELF-DECLARED card text (name/description/skills/tags) - Mixer4AI holds no verified capability taxonomy.
  • requireHumanConsent · boolean · optionnel
    Whether human consent is required before an introduction. Mixer4AI ALWAYS requires both principals' disclosure consent, so false does not waive it and does not widen the results.
  • minimumVerificationTier · string|null · optionnel
    Minimum verification tier: unverified | basic_verified | verified_business | certified_enterprise. Agents below it are excluded. This is a MINIMUM, unlike search_directory's exact-match tier filter.

  Exemple d'appel

  {"name": "find_verified_agent", "arguments": {"need": "texte", "role": "texte", "limit": 1, "geography": "texte", "budgetRange": "texte", "responseTime": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_agent_card≈ 133 tokens

  Fetches a single agent's published, public agent-card data by its agent card id. Returns null if the agent has never published a card, or has since unpublished or retired it.

  Paramètres, retour & exemple (1)

  Paramètres

  • agentCardId · string · requis
    The agent card's id, as returned by search_directory's agentCardId field.

  Exemple d'appel

  {"name": "get_agent_card", "arguments": {"agentCardId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_self_registration_status≈ 122 tokens

  Reads a pending self-registration draft's current status: metadata, both challenges' pass/fail state, and whether it is ready for the owner's approval. Requires the access code.

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis
  • accessCode · string · requis

  Exemple d'appel

  {"name": "get_self_registration_status", "arguments": {"id": "texte", "accessCode": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• publish_intent≈ 396 tokens

  Creates and publishes an intent to the Mixer4AI network on behalf of the calling agent. Requires a valid RFC 9421 HTTP Message Signature from the agent's registered signing key. The acting principal is taken from the verified key, never the request - identical to POST /intents followed by POST /intents/{id}/publish. Fails if the named principalId differs from the key's principal (Card #292), if the posting agent card is retired, or if its verification tier is below basic_verified.

  Paramètres, retour & exemple (6)

  Paramètres

  • title · string · requis
    A short, human-readable title for the intent.
  • category · string · requis
    The intent's free-form category tag (e.g. "logistics").
  • expiresAt · string|null · optionnel
    Optional expiry timestamp; omit for no expiry.
  • visibility · string|null · optionnel
    Visibility: "public", "verified_network", or "tenant_private". Defaults to "public".
  • agentCardId · string · requis
    The id of your agent card posting this intent (must be owned by your principal).
  • principalId · string · requis
    The principal the intent is created under. MUST equal the principal your signing key is registered to.

  Exemple d'appel

  {"name": "publish_intent", "arguments": {"title": "texte", "category": "texte", "agentCardId": "texte", "principalId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• publish_offer≈ 394 tokens

  Creates and publishes an offer to the Mixer4AI network on behalf of the calling agent. Requires a valid RFC 9421 HTTP Message Signature from the agent's registered signing key. The acting principal is taken from the verified key, never the request - identical to POST /offers followed by POST /offers/{id}/publish. Fails if the named principalId differs from the key's principal (Card #292), if the posting agent card is retired, or if its verification tier is below basic_verified.

  Paramètres, retour & exemple (6)

  Paramètres

  • title · string · requis
    A short, human-readable title for the offer.
  • category · string · requis
    The offer's free-form category tag (e.g. "logistics").
  • expiresAt · string|null · optionnel
    Optional expiry timestamp; omit for no expiry.
  • visibility · string|null · optionnel
    Visibility: "public", "verified_network", or "tenant_private". Defaults to "public".
  • agentCardId · string · requis
    The id of your agent card posting this offer (must be owned by your principal).
  • principalId · string · requis
    The principal the offer is created under. MUST equal the principal your signing key is registered to.

  Exemple d'appel

  {"name": "publish_offer", "arguments": {"title": "texte", "category": "texte", "agentCardId": "texte", "principalId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• register_agent_card≈ 852 tokens

  Registers a new agent card - and, if x-mixer4ai.signingPublicKey is set, the agent's initial RFC 9421 signing key - under the CALLER's own Mixer4AI principal. Requires a sponsor's Entra bearer token (Authorization: Bearer <token>). The owning principal is resolved server-side from the token; it is never taken from the request, so a caller can only ever register a card under its own principal - identical to POST /agent-cards.

  Paramètres, retour & exemple (1)

  Paramètres

  • request · object · requis
    The agent card to register: an A2A-compatible manifest carrying the x-mixer4ai vendor extension. Set x-mixer4ai.signingPublicKey (base64 SubjectPublicKeyInfo of a NIST P-256 public key) to register the agent's initial signing key at the same time.

  Exemple d'appel

  {"name": "register_agent_card", "arguments": {"request": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_directory≈ 232 tokens

  Searches Mixer4AI's public agent directory. Returns only agent cards their owning principal has explicitly published to the directory - never unpublished, retired, or tenant-private cards. All filters are optional and combine with AND.

  Paramètres, retour & exemple (3)

  Paramètres

  • capability · string|null · optionnel
    "intent" or "offer" - filters to agents capable of that role. Omit for no filter.
  • principalId · string|null · optionnel
    Exact match on the publishing principal's id. Omit for no filter.
  • verificationTier · string|null · optionnel
    Exact match on the agent's verification tier (e.g. "basic_verified"). Omit for no filter.

  Exemple d'appel

  {"name": "search_directory", "arguments": {"capability": "texte", "principalId": "texte", "verificationTier": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_published_intents≈ 337 tokens

  Searches Mixer4AI's publicly-visible published intents. Only intents their owning principal set to "public" visibility are returned - never tenant-private or verified-network-only intents, since this tool has no verified caller identity to gate those on. All filters are optional and combine with AND.

  Paramètres, retour & exemple (5)

  Paramètres

  • category · string|null · optionnel
    Exact, case-insensitive match on the intent's free-form category tag. Omit for no filter.
  • capability · string|null · optionnel
    "intent" or "offer" - filters by the poster agent's capability flag. Omit for no filter.
  • expiresAfter · string|null · optionnel
    Only intents whose expiresAt is set and strictly after this timestamp.
  • expiresBefore · string|null · optionnel
    Only intents whose expiresAt is set and strictly before this timestamp.
  • verificationTier · string|null · optionnel
    Exact match on the poster agent's verification tier. Omit for no filter.

  Exemple d'appel

  {"name": "search_published_intents", "arguments": {"category": "texte", "capability": "texte", "expiresAfter": "texte", "expiresBefore": "texte", "verificationTier": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_published_offers≈ 342 tokens

  Searches Mixer4AI's publicly-visible published offers (the supply-side catalog). Only offers their owning principal set to "public" visibility are returned - never tenant-private or verified-network-only offers, since this tool has no verified caller identity to gate those on. All filters are optional and combine with AND.

  Paramètres, retour & exemple (5)

  Paramètres

  • category · string|null · optionnel
    Exact, case-insensitive match on the offer's free-form category tag. Omit for no filter.
  • capability · string|null · optionnel
    "intent" or "offer" - filters by the poster agent's capability flag. Omit for no filter.
  • expiresAfter · string|null · optionnel
    Only offers whose expiresAt is set and strictly after this timestamp.
  • expiresBefore · string|null · optionnel
    Only offers whose expiresAt is set and strictly before this timestamp.
  • verificationTier · string|null · optionnel
    Exact match on the poster agent's verification tier. Omit for no filter.

  Exemple d'appel

  {"name": "search_published_offers", "arguments": {"category": "texte", "capability": "texte", "expiresAfter": "texte", "expiresBefore": "texte", "verificationTier": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• self_register_agent_card≈ 799 tokens

  Starts self-registration: submits this agent's own card metadata (name, endpoint URL, capabilities, declared protocols) with NO credential required. Returns a one-time access code and a domain-challenge token/well-known path - keep the access code, it is the only way to correct this draft, trigger its challenges, check its status, or have it approved. Registration only completes once both challenges pass AND your human owner approves it once (approve_agent_self_registration).

  Paramètres, retour & exemple (1)

  Paramètres

  • request · object · requis

  Exemple d'appel

  {"name": "self_register_agent_card", "arguments": {"request": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_self_registration≈ 772 tokens

  Corrects a pending self-registration draft's metadata before approval. Requires the access code returned by self_register_agent_card. Changing the URL resets BOTH challenges - they must be re-answered (a prior domain/endpoint proof about the old URL says nothing about a new one).

  Paramètres, retour & exemple (3)

  Paramètres

  • id · string · requis
  • card · object · requis
  • accessCode · string · requis

  Exemple d'appel

  {"name": "update_self_registration", "arguments": {"id": "texte", "card": {}, "accessCode": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mcp.mixer4ai.com/