com.signalaf/contribution-exchange

Est-ce que com.signalaf/contribution-exchange est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.signalaf/contribution-exchange » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 6 outils

• exchange_discover_domain≈ 236 tokens

  Determine whether a domain publishes a Contribution Exchange profile. Returns the canonical Exchange manifest, policy URLs, signal URLs, and whether the domain is self-hosted or delegated to a Steward. Read-only — does not propose, commit, or authorize anything. Enforces HTTPS, redirect limits, timeouts, and SSRF protections (blocks loopback, link-local, private-network, and metadata-service targets).

  Paramètres, retour & exemple (1)

  Paramètres

  • domain · string · requis
    Domain name or HTTPS URL to check (e.g. 'signalaf.com' or 'https://signalaf.com'). Normalized to hostname.

  Exemple d'appel

  {"name": "exchange_discover_domain", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• exchange_get_attempt≈ 206 tokens

  Get detail for a signal attempt. Read-only. Enforces attempt visibility — actors may only read their own private attempts. Returns attempt status and verification result if available. Attempt status is NOT an exchange state. Verification is Steward-controlled and cannot be self-asserted.

  Paramètres, retour & exemple (2)

  Paramètres

  • signal_id · string · requis
    Signal ID.
  • attempt_id · string · requis
    Attempt ID.

  Exemple d'appel

  {"name": "exchange_get_attempt", "arguments": {"signal_id": "texte", "attempt_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• exchange_get_policy≈ 189 tokens

  Fetch the canonical Contribution Exchange policy for a domain or its delegated Steward. Returns authority ceilings, consideration limits, human-review requirements, and supported behavior. Read-only — does not mutate state or perform preflight evaluation. Distinguishes a missing policy from an unavailable service.

  Paramètres, retour & exemple (1)

  Paramètres

  • domain · string · requis
    Domain name to fetch policy for.

  Exemple d'appel

  {"name": "exchange_get_policy", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• exchange_get_signal≈ 179 tokens

  Get full detail for a single Exchange Signal by ID. Read-only. Returns the complete signal including constraints, participation rules, verification configuration, consideration declaration, and follow-on behavior. A signal does NOT create a Commitment, authorize execution, or guarantee payment.

  Paramètres, retour & exemple (1)

  Paramètres

  • signal_id · string · requis
    Signal ID.

  Exemple d'appel

  {"name": "exchange_get_signal", "arguments": {"signal_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• exchange_list_signals≈ 493 tokens

  List domain-published Exchange Signals (problems, requests, challenges, bounties, verification tasks, discoveries, experiments). Read-only. Returns canonical URLs, signal revision, revision hash, and status. Signal status is DISTINCT from exchange status — a signal does not create a Commitment or authorize execution. Supports the same filters and pagination as the HTTP API.

  Paramètres, retour & exemple (11)

  Paramètres

  • type · string · optionnel · problem | request | challenge | bounty | verification | discovery | experiment
    Filter by signal type.
  • label · string · optionnel
    Filter by label.
  • limit · integer · optionnel
    Maximum signals to return (1-100, default 50).
  • cursor · string · optionnel
    Pagination cursor from a previous response.
  • domain · string · optionnel
    Filter by publisher domain.
  • status · string · optionnel · published | paused | closed | expired | withdrawn
    Filter by signal status.
  • expires_before · string · optionnel
    ISO 8601 timestamp — only signals expiring before this.
  • published_after · string · optionnel
    ISO 8601 timestamp — only signals published after this.
  • verification_mode · string · optionnel · deterministic | hybrid | manual
    Filter by verification mode.
  • accepting_attempts · boolean · optionnel
    Only return signals currently accepting attempts.
  • consideration_mode · string · optionnel · fixed | maximum | negotiable
    Filter by consideration mode.

  Exemple d'appel

  {"name": "exchange_list_signals", "arguments": {"type": "problem", "label": "texte", "limit": 1, "cursor": "texte", "domain": "texte", "status": "published"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• exchange_preflight≈ 560 tokens

  Evaluate a proposed contribution against the same policy logic used by the real proposal flow. Returns whether the proposal is likely to be auto-engaged, accepted for review, escalated to a human, or rejected as invalid. READ-ONLY: performs no proposal insertion, notification, event creation, or state transition. The result is advisory and time-bound — a favorable preflight does NOT guarantee engagement, Commitment, authorization, payment, or execution. Uses the same evaluateProposal function as the canonical proposal route.

  Paramètres, retour & exemple (5)

  Paramètres

  • domain · string · requis
    Target domain for the proposed contribution.
  • category · string · requis
    Contribution category (e.g. 'technical', 'accessibility', 'documentation', 'research').
  • confidence · object · optionnel
    Confidence in the observation (score 0-1 and basis).
  • consideration · array · optionnel
    Requested consideration (cash, royalty, reciprocal_access, attribution, referral, other). Advertised consideration is NOT binding until accepted through Commitment.
  • required_authorization · object · optionnel
    Authority requested (inspect_public, sandbox_test, repository_write, private_data, credential_access, production_modify, deploy, penetration_testing).

  Exemple d'appel

  {"name": "exchange_preflight", "arguments": {"domain": "texte", "category": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://signalaf.com/api/exchange/mcp