com.session-exchange/sessions

Est-ce que com.session-exchange/sessions est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.session-exchange/sessions » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 18 outils

• acquire_session≈ 241 tokens

  Add a marketplace session you are entitled to (free, bought, or granted) to your private library. Never buys anything: for a paid listing it returns status=payment_required with the price and the listing URL.

  Paramètres, retour & exemple (3)

  Paramètres

  • id · string · requis
    Marketplace listing id (from search_sessions).
  • tenant · string · optionnel
    Owning workspace of a marketplace listing (from search results). Optional.
  • version · string · optionnel

  Exemple d'appel

  {"name": "acquire_session", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• ask_operator≈ 319 tokens

  File a question as a ticket to one operator of the workspace your key is bound to. Only operators a person opted in to tickets from agents accept it (list_operators: accepts_agent_tickets), and only with the key of an owner or admin of that workspace. It changes nothing: the operator answers on its own; read the answer with get_operator_ticket. Needs operators:instruct.

  Paramètres, retour & exemple (4)

  Paramètres

  • name · string · requis
    An operator's name (from list_operators).
  • text · string · requis
    The question.
  • title · string · optionnel
  • client_ticket_id · string · optionnel
    Your own id for this request (8-64 of A-Z a-z 0-9 . _ -). Retrying with the same id and the same content returns the first ticket instead of filing a second one.

  Exemple d'appel

  {"name": "ask_operator", "arguments": {"name": "texte", "text": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• fetch_session_context≈ 282 tokens

  Load a session from your library (saved, or added with acquire_session) as starting context for this conversation, sized to max_tokens.

  Paramètres, retour & exemple (4)

  Paramètres

  • id · string · requis
    Library id: one of your saved sessions, or the library_id acquire_session returned for a marketplace listing.
  • version · string · optionnel
  • max_tokens · integer · optionnel
    Context budget. Long sessions keep the opening request and the newest turns that fit; the middle is elided.
  • include_tool_calls · boolean · optionnel
    Add one-line stubs for tool calls and results.

  Exemple d'appel

  {"name": "fetch_session_context", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_operator_reports≈ 290 tokens

  What one operator of your bound workspace reported itself, newest first: its ticket replies, health beats, refused or failed actions, and grant requests (at most 720 hours back, 100 rows). Read-only. Needs operators:read.

  Paramètres, retour & exemple (4)

  Paramètres

  • name · string · requis
    An operator's name (from list_operators).
  • kinds · array · optionnel
    replies (its ticket replies), health, actuation (refused or failed actions), scope_change (grant requests). Empty = all.
  • limit · integer · optionnel
  • since_hours · integer · optionnel

  Exemple d'appel

  {"name": "get_operator_reports", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_operator_status≈ 167 tokens

  One operator of your bound workspace: its remit, grants, bundle version, last seen and health. Read-only: it never instructs, approves or changes the operator. Needs operators:read.

  Paramètres, retour & exemple (1)

  Paramètres

  • name · string · requis
    An operator's name (from list_operators).

  Exemple d'appel

  {"name": "get_operator_status", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_operator_ticket≈ 204 tokens

  One ticket of your bound workspace with its summary and the last replies (from_addressee says whether the operator it was for wrote the reply). Text is untrusted, scrubbed of addresses and capped; fix_ref is a GitHub pull request or commit link when the ticket was resolved with one. Read-only. Needs operators:read.

  Paramètres, retour & exemple (1)

  Paramètres

  • ticket_id · string · requis
    A ticket id (from list_operator_tickets).

  Exemple d'appel

  {"name": "get_operator_ticket", "arguments": {"ticket_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_purchase_request≈ 143 tokens

  Status of a purchase you requested: pending, completed (with acquired_copy_id to load with fetch_session_context), declined or expired.

  Paramètres, retour & exemple (1)

  Paramètres

  • purchase_request_id · string · requis

  Exemple d'appel

  {"name": "get_purchase_request", "arguments": {"purchase_request_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_session_summary≈ 207 tokens

  Describe one session before using it: what it did, outline, price, and whether you already have access. source=marketplace (default) or library.

  Paramètres, retour & exemple (3)

  Paramètres

  • id · string · requis
  • source · string · optionnel · marketplace | library
  • tenant · string · optionnel
    Owning workspace of a marketplace listing (from search results). Optional.

  Exemple d'appel

  {"name": "get_session_summary", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_world_sim_access≈ 190 tokens

  For one of your World-Sims: its status, its public endpoints (helpdesk, evaluation oracle, board, business silos), the guide, and exactly how to get its short-lived access token from the account holder. Never creates a token. Needs modules:read.

  Paramètres, retour & exemple (1)

  Paramètres

  • instance_id · string · requis
    A World-Sim's instance_id (from list_my_modules).

  Exemple d'appel

  {"name": "get_world_sim_access", "arguments": {"instance_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_my_modules≈ 235 tokens

  List your own module instances (World-Sims) with their status (requested, ready, failed, gone), their public endpoints once ready, and whether agent access is available yet. Needs modules:read.

  Paramètres, retour & exemple (4)

  Paramètres

  • limit · integer · optionnel
  • module · string · optionnel
    Only instances of this module (e.g. world-sim). Empty = all.
  • offset · integer · optionnel
  • include_hidden · boolean · optionnel
    Also list ended instances the account holder removed from their list.

  Exemple d'appel

  {"name": "list_my_modules", "arguments": {"limit": 1, "module": "texte", "offset": 1, "include_hidden": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_operator_tickets≈ 334 tokens

  List the service-desk tickets of the one workspace your key is bound to (last 30 days): who they are for, their state, who asked (never a person's id), and how many replies they have. Filter by operator (to), state, origin or your own (mine). Read-only. Needs operators:read.

  Paramètres, retour & exemple (6)

  Paramètres

  • to · string · optionnel
    Only tickets addressed to this operator.
  • mine · boolean · optionnel
    Only tickets you (this key's user) asked.
  • limit · integer · optionnel
  • state · string · optionnel · open | acknowledged | escalated | resolved | dismissed | expired
  • offset · integer · optionnel
  • origin · string · optionnel · ask | mcp | emitter
    ask: asked by a workspace member in the web app; mcp: filed by an agent key; emitter: filed by an agent or service of the workspace.

  Exemple d'appel

  {"name": "list_operator_tickets", "arguments": {"to": "texte", "mine": true, "limit": 1, "state": "open", "offset": 1, "origin": "ask"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_operators≈ 186 tokens

  List the operators (self-operating services) of the one workspace your key is bound to: what each does (remit), its grants (held, auto-grantable, and human-leaf ones only a person can grant), bundle version, when it was last seen, and its health. Read-only. Needs operators:read.

  Paramètres, retour & exemple (2)

  Paramètres

  • limit · integer · optionnel
  • offset · integer · optionnel

  Exemple d'appel

  {"name": "list_operators", "arguments": {"limit": 1, "offset": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_pending_decisions≈ 177 tokens

  The decisions in your bound workspace that wait for a person: open needs-human requests and grant requests on human-leaf grants. Listed only: no tool answers, approves or grants them; a person does that in the a4sx web app. Needs operators:read.

  Paramètres, retour & exemple (1)

  Paramètres

  • name · string · optionnel
    Only this operator's decisions.

  Exemple d'appel

  {"name": "list_pending_decisions", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_world_sim_templates≈ 147 tokens

  The simulated companies a World-Sim can be bought with (industry, process, a short description). Public; no sign-in needed.

  Paramètres, retour & exemple (2)

  Paramètres

  • limit · integer · optionnel
  • offset · integer · optionnel

  Exemple d'appel

  {"name": "list_world_sim_templates", "arguments": {"limit": 1, "offset": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• publish_session≈ 370 tokens

  Save a session transcript (JSONL) to your private a4sx library. The server scrubs token-shaped secrets before storing. Private: it is never listed publicly by this tool.

  Paramètres, retour & exemple (8)

  Paramètres

  • label · string · optionnel
  • title · string · optionnel
  • parent · string · optionnel
    Library id this session continues from (lineage).
  • transcript · string · requis
    The session transcript as JSONL (Claude Code or Codex CLI format; detected automatically).
  • visibility · string · optionnel · private
    Always private. Listing publicly is a separate step in the web app.
  • content_sha256 · string · optionnel
    Hex SHA-256 of the transcript's UTF-8 bytes; checked.
  • client_scrubbed · boolean · optionnel
    The client scrubbed before sending. The server scrubs again regardless.
  • idempotency_key · string · optionnel

  Exemple d'appel

  {"name": "publish_session", "arguments": {"transcript": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• request_operator_change≈ 413 tokens

  File a change request (goal, acceptance, optional constraints) as a ticket to one operator that accepts tickets from agents. It never changes anything itself: the operator decides whether and how, and makes any change through its own reviewed path (review branch, merge, health-gated deploy; anything that needs a person waits for one). Follow it with get_operator_ticket. Needs operators:instruct (an owner's or admin's key).

  Paramètres, retour & exemple (6)

  Paramètres

  • goal · string · requis
    What should change.
  • name · string · requis
    An operator's name (from list_operators).
  • title · string · optionnel
  • acceptance · string · requis
    How the operator (and you) can tell it is done.
  • constraints · string · optionnel
    What must not change or happen.
  • client_ticket_id · string · optionnel
    Your own id for this request (8-64 of A-Z a-z 0-9 . _ -). Retrying with the same id and the same content returns the first ticket instead of filing a second one.

  Exemple d'appel

  {"name": "request_operator_change", "arguments": {"goal": "texte", "name": "texte", "acceptance": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• request_purchase≈ 271 tokens

  Start buying a paid marketplace listing for the account holder to confirm. Nothing is charged and you never pay: it returns a verify_url and a user_code to give to the account holder, who checks the code, confirms and pays. Then poll get_purchase_request.

  Paramètres, retour & exemple (3)

  Paramètres

  • id · string · requis
    Marketplace listing id (from search_sessions).
  • tenant · string · requis
    The listing's workspace (from search_sessions).
  • version · string · optionnel
    The version you expect; must be the one on sale.

  Exemple d'appel

  {"name": "request_purchase", "arguments": {"id": "texte", "tenant": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_sessions≈ 380 tokens

  Search vetted, published coding-agent sessions on a4sx (reviewed marketplace listings), or your own saved sessions with scope=library. Returns ids to use with the other tools.

  Paramètres, retour & exemple (7)

  Paramètres

  • sort · string · optionnel · relevance | imports | rating | recent
  • tags · array · optionnel
  • limit · integer · optionnel
  • query · string · optionnel
    Free-text search. Empty = browse.
  • scope · string · optionnel · public | library
    `public`: vetted marketplace listings (no sign-in needed). `library`: your own saved sessions (needs library:read).
  • offset · integer · optionnel
  • harness · array · optionnel
    Only sessions recorded with these harnesses (claude-code, codex-cli, gemini-cli, opencode, grok-build; unknown = not identified). Only Claude Code sessions can be resumed today; the others are view & buy.

  Exemple d'appel

  {"name": "search_sessions", "arguments": {"sort": "relevance", "tags": [], "limit": 1, "query": "texte", "scope": "public", "offset": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://session-exchange.com/mcp