dev.blvkware/hallux

Est-ce que dev.blvkware/hallux est sûr ?

Au dernier audit MCP Hub, le serveur MCP « dev.blvkware/hallux » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 4 outils

• hallux_check≈ 1320 tokens

  Does this identifier actually exist? Call before acting on any name you recalled rather than read: a package to install, a module to import, a DOI to cite. Returns one of: exists, deprecated, absent, phantom, squat, unknown. exists - proceed deprecated - proceed, but use `successor` absent - not in the registry. Do not proceed phantom - does not exist AND models repeatedly invent it. Do not proceed squat - was invented by models, then registered by someone. Treat as hostile unknown - could not verify. Never treat this as permission Live namespaces: cite.doi, pkg.crates, pkg.go, pkg.maven, pkg.npm, pkg.nuget, pkg.pypi. An unsupported namespace returns `unknown`, never an error, so it is safe to ask.

  Paramètres, retour & exemple (1)

  Paramètres

  • identifiers · array · requis
    Up to 100 identifiers.

  Exemple d'appel

  {"name": "hallux_check", "arguments": {"identifiers": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"blocked": [], "checked": 1, "results": [], "decision": "PROCEED", "unverified": [], "safeToProceed": true}}

• hallux_check_command≈ 1264 tokens

  Call this BEFORE running any command that installs a dependency: npm, yarn, pnpm, bun, pip, uv, poetry, pipx, cargo, go get, dotnet add package, nuget. Language models invent plausible package names that have never existed, and attackers register those names because they can predict them. Installing one runs attacker code. You cannot tell the difference by looking at the name, which is why this check exists. Pass the command exactly as you intend to run it. The identifiers are extracted for you. If the result says BLOCK, do not run the command. Use the `successor` if one is given, otherwise tell the user what was found and stop.

  Paramètres, retour & exemple (1)

  Paramètres

  • command · string · requis
    The shell command, verbatim. Example: pip install requests requests-oauth2-helper

  Exemple d'appel

  {"name": "hallux_check_command", "arguments": {"command": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"blocked": [], "checked": 1, "command": "texte", "results": [], "decision": "PROCEED", "unverified": [], "safeToProceed": true, "identifiersFound": []}}

• hallux_check_manifest≈ 1132 tokens

  Call this after writing or editing a dependency file, and before committing it. Supported: package.json, requirements.txt, pyproject.toml, Cargo.toml, go.mod. Checks every dependency in one pass, including dev and optional groups, which is where an invented name usually arrives.

  Paramètres, retour & exemple (2)

  Paramètres

  • content · string · requis
    The file contents.
  • filename · string · requis
    The file name, e.g. package.json. Path is ignored; only the name is used to pick a parser.

  Exemple d'appel

  {"name": "hallux_check_manifest", "arguments": {"content": "texte", "filename": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"blocked": [], "checked": 1, "results": [], "decision": "PROCEED", "filename": "texte", "unverified": [], "safeToProceed": true}}

• hallux_watch≈ 545 tokens

  Register identifiers for notification when their verdict changes. The transition that matters is phantom to squat: a name models invent that somebody then registers. Use this for a dependency that came back `absent` or `phantom` and that the user intends to use anyway, or for a set of dependencies worth monitoring. Delivered by signed webhook to a URL you supply.

  Paramètres, retour & exemple (2)

  Paramètres

  • callbackUrl · string · requis
    An https URL to POST transitions to.
  • identifiers · array · requis
    Up to 100 identifiers to watch, typically ones that came back absent or phantom.

  Exemple d'appel

  {"name": "hallux_watch", "arguments": {"callbackUrl": "texte", "identifiers": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"event": "texte", "decision": "WATCHING", "signature": {}, "registered": [], "transitionOfInterest": "texte"}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://api.blvkware.dev/hallux/mcp