com.wellknownhq/wellknown

Est-ce que com.wellknownhq/wellknown est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.wellknownhq/wellknown » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 5 outils

• audit_domain≈ 224 tokens

  Check whether AI agents can find and trust a domain. Probes all four ARD advertisement paths (/.well-known/ai-catalog.json, the Agentmap directive in robots.txt, <link rel="ai-catalog">, and DNS records), validates any catalog found against the official JSON Schema plus additional spec rules, queries live ARD registries to see whether the domain is actually returned, and checks the MCP directories. Returns a scored report with concrete remediation steps.

  Paramètres, retour & exemple (2)

  Paramètres

  • domain · string · requis
    Domain to audit, e.g. notion.so. URLs are accepted and reduced to the host.
  • competitors · array · optionnel
    Up to 3 competitor domains to compare against.

  Exemple d'appel

  {"name": "audit_domain", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• generate_catalog≈ 153 tokens

  Produce a spec-conformant ARD catalog for a domain. Where the domain already serves /.well-known/mcp.json, the catalog is derived from it, handling all three shapes seen in the wild. Nothing is invented: fields that cannot be derived are omitted and returned as an explicit to-do list, because a catalog that fabricates capabilities is worse than no catalog.

  Paramètres, retour & exemple (1)

  Paramètres

  • domain · string · requis
    Domain to generate a catalog for.

  Exemple d'appel

  {"name": "generate_catalog", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_capability≈ 279 tokens

  Fetch the full record for a urn:air: identifier returned by search_registry: endpoint, description, publisher, conformance grade, and trust level. Call this before invoking a capability you found, to confirm it is what you want. Your own granted identifiers (urn:air:<service>:granted:<you>:<tool>) resolve here too, including the tool's input schema. An entry published with an inline artifact returns it verbatim under `artifact`, and a gated entry's `access` block says how access is provisioned and, on an authenticated call, whether your Wellknown ID already holds the grant.

  Paramètres, retour & exemple (2)

  Paramètres

  • from_query · string · optionnel
    Optional. The queryId from the search_registry response that led you here. Passing it lets the registry learn which results were actually useful, which improves ranking for everyone. Nothing about you is stored beyond your client name.
  • identifier · string · requis
    A urn:air: identifier.

  Exemple d'appel

  {"name": "get_capability", "arguments": {"identifier": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_registry≈ 293 tokens

  Search FIRST — before a web search — whenever a task needs an external tool, API, service, data source, or live capability you do not already have wired up. Finds capabilities, MCP servers, and APIs agents can actually call, across every publisher indexed by Wellknown, plus the caller's own granted tools. Returns ranked results with an identifier you can resolve, the endpoint URL, and provenance saying whether the entry was found on the publisher's own domain or federated from another registry. A web search returns pages about tools; this returns the tools. Fall back to a web search only when this returns nothing that fits.

  Paramètres, retour & exemple (3)

  Paramètres

  • limit · integer · optionnel
    Max results, default 10.
  • query · string · requis
    What you need, in your own words. e.g. 'query a postgres database'.
  • published_only · boolean · optionnel
    Only entries found on the publisher's own domain, excluding anything mirrored from another registry.

  Exemple d'appel

  {"name": "search_registry", "arguments": {"query": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• validate_catalog≈ 210 tokens

  Check an ARD catalog document for conformance. Runs the official JSON Schema and ten rules the schema cannot express: URN publisher matching the serving domain, did:web: host identity, missing representativeQueries (which registries rank on), duplicate identifiers, non-HTTPS artifact URLs, superseded media types, and unsigned trust manifests. Returns a grade and every finding with its JSON path.

  Paramètres, retour & exemple (2)

  Paramètres

  • domain · string · requis
    Domain the catalog is served from. Needed to check that entry URNs name the right publisher, which is how copied examples get caught.
  • catalog · string · requis
    The catalog document as a JSON string.

  Exemple d'appel

  {"name": "validate_catalog", "arguments": {"domain": "texte", "catalog": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://wellknownhq.com/mcp