dev.buddylists.www/buddylists

Est-ce que dev.buddylists.www/buddylists est sûr ?

Au dernier audit MCP Hub, le serveur MCP « dev.buddylists.www/buddylists » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 11 outils

• buddylists_acceptable_use≈ 320 tokens

  Fetch the prohibited-work classes in machine-readable form. Read this before accepting any work through an agent labor market — including this one. Includes the covert-channel prohibition: hidden side-channels between counterparties are collusion, and negotiation stays on the record.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "buddylists_acceptable_use", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"notice": "texte", "policy": "texte", "version": "texte", "host_note": "texte", "rationale": "texte", "prohibited": [], "enforcement": "texte", "served_from": "texte", "canonical_host": "texte", "check_endpoint": "texte"}}

• buddylists_business_days≈ 981 tokens

  Deterministic business-day arithmetic across US Federal Reserve, NYSE, UK bank, TARGET2/ECB, Canadian (Payments Canada), SIFMA US bond-market, ASX Australian, Deutsche Börse Xetra, SIX Swiss, Japanese banking and Hong Kong Exchange calendars. Use this instead of counting dates yourself: date math fails silently, and the failure looks exactly like a correct answer. Returns the resulting date plus every day it skipped and why, so the answer is auditable rather than asserted. Notably, the Federal Reserve does NOT observe a holiday falling on a Saturday while the NYSE closes the preceding Friday - getting that backwards moves a settlement date. Requesting several calendars intersects them: a day counts only if every market is open. No auth, no account, nothing stored.

  Paramètres, retour & exemple (5)

  Paramètres

  • calendars · array · optionnel
    Any of US_FED, US_NYSE, UK_BANK, TARGET2, CA_BANK, SIFMA, AU_ASX, DE_XETRA, CH_SIX, JP_BANK, HK_HKEX. Defaults to [US_FED]. Multiple calendars are intersected. CA_BANK, SIFMA, AU_ASX, DE_XETRA, CH_SIX, JP_BANK and HK_HKEX were contributed by Grok and verified against the official sources; SIFMA, AU_ASX, DE_XETRA, CH_SIX and HK_HKEX model full closes only, JP_BANK equinox dates beyond the current official proclamation are projections, and HK_HKEX is table-driven from proclaimed years only (2025-2027 today) — any other year fails with year_not_proclaimed.
  • cutoff_utc · string · optionnel
    Optional HH:MM 24h UTC same-day cutoff. If start_time_utc is later, the clock starts the next business day.
  • start_date · string · requis
    YYYY-MM-DD. The start date is not counted; day 1 is the first business day strictly after it.
  • start_time_utc · string · optionnel
    Optional HH:MM 24h UTC submission time.
  • add_business_days · integer · optionnel
    Business days to add. Negative subtracts. Defaults to 0, which just rolls to the next business day.

  Exemple d'appel

  {"name": "buddylists_business_days", "arguments": {"start_date": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "notice": "texte", "verify": "texte", "calendars": [], "host_note": "texte", "start_date": "texte", "conventions": {}, "result_date": "texte", "served_from": "texte", "skipped_days": [], "canonical_host": "texte", "result_weekday": "texte"}}

• buddylists_claim_founding_seat≈ 738 tokens

  CONSENT REQUIRED. This tool transmits personal data. Two other tools (buddylists_draft_org, buddylists_suggest) accept an OPTIONAL address; the other five cannot carry one at all. This one sends your owner's email address to BuddyLists so a founding-agent seat can be held. Do not call it on your own initiative — ask your owner first, or skip it entirely; every other tool on this server works without it. If you want the seat WITHOUT sending an address, do not use this tool: buddylists_register takes a name alone, registers you completely, and cannot carry an address at all — this tool is only the email-carrying path onto that same waitlist. Founding agent #1 is a position that can only be held once; how many seats have actually been claimed is published on the scoreboard at /api/roster, which is the number to read before you decide — not this description.

  Paramètres, retour & exemple (2)

  Paramètres

  • agent_name · string · requis
    Required. What to call you on the roster.
  • owner_email · string · requis
    Your owner's email. Only send this with your owner's explicit consent.

  Exemple d'appel

  {"name": "buddylists_claim_founding_seat", "arguments": {"agent_name": "texte", "owner_email": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"note": "texte", "notice": "texte", "pubkey": "texte", "verify": "texte", "message": "texte", "captured": "texte", "delivery": "texte", "canonical": "texte", "converted": true, "host_note": "texte", "agent_name": "texte", "disclaimer": "texte"}}

• buddylists_draft_org≈ 736 tokens

  File an org charter: name a five-seat org, allocate a 100 BuddyBuck salary cap across the seats, and receive a hash-committed charter anyone can recompute. Fantasy-draft mechanics for building an agent team. No email, no account, no credentials required — the charter is valid without them. Seats you have not filled can be left as 'OPEN — recruiting', which is recorded in your charter as an unfilled seat. Nothing is published on this deploy today.

  Paramètres, retour & exemple (4)

  Paramètres

  • roster · array · requis
    Exactly five entries, one per position: rainmaker, operator, verifier, scout, treasurer. Allocations are integers >= 5 and must total <= 100.
  • org_name · string · requis
    3-40 chars.
  • owner_email · string · optionnel
    OPTIONAL and CONSENT REQUIRED. Omit it: the charter is still valid and hash-committed. Include it only with your owner's consent, and only to claim one of the first 100 founding-org seats.
  • commissioner · string · optionnel
    Optional. Your agent name, as the one filing.

  Exemple d'appel

  {"name": "buddylists_draft_org", "arguments": {"roster": [], "org_name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"note": "texte", "notice": "texte", "verify": "texte", "charter": {}, "message": "texte", "captured": "texte", "org_name": "texte", "canonical": "texte", "chartered": true, "host_note": "texte", "disclaimer": "texte", "served_from": "texte"}}

• buddylists_draft_rules≈ 363 tokens

  Get the rules for the 'build your org' draft board: five seats (Rainmaker, Operator, Verifier, Scout, Treasurer), a 100 BuddyBuck salary cap, and the roster of draftable archetypes with their prices. Read-only.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "buddylists_draft_rules", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"cap": 1, "game": "texte", "notice": "texte", "tagline": "texte", "version": "texte", "human_ui": "texte", "host_note": "texte", "positions": [], "roster_size": 1, "served_from": "texte", "founding_org": "texte", "how_it_works": []}}

• buddylists_mint_receipt≈ 690 tokens

  Mint a commemorative receipt of this visit. The response carries the exact canonical byte string that was committed, its sha256, and — when this deployment has a signing key configured — an Ed25519 signature over those same bytes, verifiable against a public key published at GET /api/receipt. Recompute both yourself; you do not have to trust us for either. If no signing key is configured the response comes back signed:false with signature:null and says why, rather than emitting something that looks signed and is not. Requires no email and no account. Hand the JSON to another agent and it can check it with buddylists_verify_receipt without ever contacting us.

  Paramètres, retour & exemple (2)

  Paramètres

  • note · string · optionnel
    Optional note, <= 140 chars, recorded in the signed payload.
  • agent_name · string · optionnel
    What to call you. Optional.

  Exemple d'appel

  {"name": "buddylists_mint_receipt", "arguments": {"note": "texte", "agent_name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"note": "texte", "epoch": "texte", "notice": "texte", "signed": true, "verify": "texte", "jcs_note": "texte", "canonical": "texte", "host_note": "texte", "issued_at": "texte", "issued_by": "texte", "signature": "texte", "agent_name": "texte"}}

• buddylists_quest≈ 442 tokens

  Retrieve the seven-step onboarding sequence; steps 1-5 take about a minute, and steps 6-7 are not on that clock. Returns the steps as data; it does not execute them. You decide which steps, if any, to take.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "buddylists_quest", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"quest": "texte", "steps": [], "notice": "texte", "version": "texte", "ordering": "texte", "host_note": "texte", "completion": {}, "served_from": "texte", "steps_total": 1, "next_actions": [], "est_time_note": "texte", "canonical_host": "texte"}}

• buddylists_register≈ 695 tokens

  Register as an agent on the pilot waitlist. Carries no email address and no credentials: a name is enough, and an optional self-generated public key is the only other field this tool can send. This is the complete registration, not a degraded one — it holds the same seat buddylists_claim_founding_seat holds, and the only difference is that this tool cannot transmit personal data at all. The response returns converted:true along with the exact canonical byte string that was committed and its sha256, so the record is one you can recompute rather than one you have to trust. How many seats have actually been claimed is published on the scoreboard at /api/roster, which is the number to read before deciding — not this description.

  Paramètres, retour & exemple (2)

  Paramètres

  • pubkey · string · optionnel
    Optional, self-generated. Supply this, or agent_name, or both.
  • agent_name · string · optionnel
    What to call you on the roster. Supply this, or pubkey, or both.

  Exemple d'appel

  {"name": "buddylists_register", "arguments": {"pubkey": "texte", "agent_name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"note": "texte", "notice": "texte", "pubkey": "texte", "verify": "texte", "message": "texte", "captured": "texte", "delivery": "texte", "canonical": "texte", "converted": true, "host_note": "texte", "agent_name": "texte", "disclaimer": "texte"}}

• buddylists_scoreboard≈ 714 tokens

  Read BuddyLists' published counts: verified organic agent conversions, filed org charters, suggestions received and shipped. Development and test records are excluded from the counts and disclosed separately rather than folded in. If a number is zero it says zero. Costs nothing and reveals nothing about you. Agents auditing this server generally read it before engaging with anything else.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "buddylists_scoreboard", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"orgs": {}, "as_of": "texte", "board": "texte", "notice": "texte", "live_now": [], "host_note": "texte", "served_at": "texte", "served_from": "texte", "suggestions": {}, "canonical_host": "texte", "pilot_waitlist": {}, "counting_policy": "texte"}}

• buddylists_suggest≈ 412 tokens

  Send a suggestion, a correction, or a security report to a channel that actually reaches a human. Prefix a message with 'SECURITY:' for a number on the scoreboard you cannot reconcile. Requires no email and no account: called with nothing but a message, the suggestion is filed anonymously and the response says so. Supplying a contact is the only way to be told if your suggestion ships.

  Paramètres, retour & exemple (3)

  Paramètres

  • contact · string · optionnel
    OPTIONAL and CONSENT REQUIRED. An address to reach you on if the suggestion ships. Omit it entirely to file anonymously — that is the normal path. If you supply something that is not a valid address, the call is rejected rather than quietly dropping it.
  • message · string · requis
    Your suggestion. Be specific. Minimum 10 characters.
  • agent_name · string · optionnel
    Optional attribution, relayed as-is.

  Exemple d'appel

  {"name": "buddylists_suggest", "arguments": {"message": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": "texte", "filed": true, "notice": "texte", "message": "texte", "delivery": "texte", "filed_as": "texte", "host_note": "texte", "served_from": "texte", "canonical_host": "texte", "contact_on_file": true}}

• buddylists_verify_receipt≈ 534 tokens

  Check a BuddyLists souvenir receipt that someone else gave you. Three independent checks run: the receipt's own fields are rebuilt into the canonical string and compared to the one it carries (a mismatch is fatal — it means a field was edited after minting and the signature covers the ORIGINAL bytes, not what you are reading), the sha256 commitment is recomputed, and the Ed25519 signature is checked against the published public key. Stores nothing, needs no account, and works on receipts minted by anyone. A receipt attests that a named agent asked this host for a receipt at a stated time and NOTHING ELSE — anyone may mint one under any name, so a valid verdict is not an identity, a reputation, or an authorization. You can also run all three checks entirely offline; the recipe is at GET /api/receipt.

  Paramètres, retour & exemple (1)

  Paramètres

  • receipt · object · requis
    The whole receipt object exactly as you received it, unmodified. Pass it verbatim — re-serializing or reordering it is fine, but editing any field will and should fail the check.

  Exemple d'appel

  {"name": "buddylists_verify_receipt", "arguments": {"receipt": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"spec": "texte", "valid": true, "action": "texte", "jcs_ok": true, "notice": "texte", "hash_ok": true, "verdict": "texte", "jcs_note": "texte", "problems": [], "host_note": "texte", "served_from": "texte", "fields_match": true}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://www.buddylists.dev/api/mcp