dev.fetchgate/fetchgate

Est-ce que dev.fetchgate/fetchgate est sûr ?

Au dernier audit MCP Hub, le serveur MCP « dev.fetchgate/fetchgate » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 10 outils

• check_base_token≈ 212 tokens

  Screen a token contract on Base before an agent buys it. Reads the contract (ERC-20 metadata, owner, upgradeable proxy, and mint / pause / blacklist / fee selectors in its bytecode) and its DEX liquidity (WETH and USDC held by its Uniswap and Aerodrome pools, read on-chain). Returns a verdict — ok, caution, avoid or unknown — with the reasons. A heuristic screen: it does not simulate a sell, read tax rates or check pool age. Wraps GET /v1/token/check. Same free daily tier as read_url; $0.01/call via x402 after that.

  Paramètres, retour & exemple (1)

  Paramètres

  • address · string · requis
    The token contract address on Base.

  Exemple d'appel

  {"name": "check_base_token", "arguments": {"address": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_x402_endpoint≈ 228 tokens

  Decide whether an unfamiliar pay-per-call (x402) endpoint is worth paying. Sends one unpaid GET to read its live payment challenge (format, price, network, signing domain), then adds its settled-call and unique-payer history, whether its live price matches its listed price, and its domain's reputation (template farm or not, share of its endpoints that answer). Returns a verdict — ok, caution, avoid or unknown — with the reasons. Nothing is paid. Use before an agent sends money to an endpoint it has not used before. Wraps GET /v1/x402/check. Same free daily tier as read_url; $0.01/call via x402 after that.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    The x402 endpoint URL to check.

  Exemple d'appel

  {"name": "check_x402_endpoint", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_agent_census≈ 250 tokens

  Return the Agent Web Crawler Census: every named bot observed crawling a live, publicly-listed x402 + MCP endpoint over a 24-hour window, each with a case-insensitive regex `matcher` and a behavioural `category` (liveness-monitor, directory-crawler, price-scraper, security-research, ai-training, ...) so you can classify your own access log. Observed first-hand, not aggregated from third-party bot lists. Notable finding: of the named agent-web crawlers in the census, zero have ever presented a payment, and several declare that in their own User-Agent string. Wraps GET /v1/agent-census.json. Free, unmetered, no payment required. CC BY 4.0.

  Paramètres, retour & exemple (1)

  Paramètres

  • category · string · optionnel
    Optional. Return only agents in this behavioural category, e.g. "price-scraper" or "liveness-monitor". Omit for the full census.

  Exemple d'appel

  {"name": "get_agent_census", "arguments": {"category": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_metadata≈ 139 tokens

  Fetch a URL server-side and return structured metadata: title, description, canonical URL, OpenGraph/Twitter card fields, favicon URL, language, and published/modified timestamps when present. Wraps GET /v1/meta. Same free tier as read_url; priced at $0.001/call via x402 once exhausted.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    Absolute http(s) URL to fetch.

  Exemple d'appel

  {"name": "get_metadata", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_purchase_info≈ 156 tokens

  Look up a product by id (from list_products) and explain exactly how to buy it: its price, and the x402 purchase flow step by step (the 402 challenge shape, the PAYMENT-SIGNATURE header, and the signed download URL you get back on success). Does not take payment itself — informational only, mirroring the pre-payment leg of GET /v1/buy/:id.

  Paramètres, retour & exemple (1)

  Paramètres

  • product_id · string · requis
    Product id, from list_products' `id` field.

  Exemple d'appel

  {"name": "get_purchase_info", "arguments": {"product_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_products≈ 103 tokens

  List Fetchgate's digital-goods catalog: id, name, description, priceUsd, currency, file format, size, sha256, and a walletless humanUrl checkout link for each product for sale. Wraps GET /v1/products. Free, no rate limit, no payment required just to browse.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_products", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• read_url≈ 161 tokens

  Fetch a URL server-side and return its main content as clean Markdown, with scripts/styles/nav/ads/boilerplate stripped out. Wraps GET /v1/read. Free tier: 30 calls/day per caller; priced at $0.002/call via x402 once that's exhausted (see get_purchase_info for how the x402 flow works). Only http:// and https:// URLs are accepted; private/internal-network hosts are rejected.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    Absolute http(s) URL to fetch.

  Exemple d'appel

  {"name": "read_url", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• scan_for_prompt_injection≈ 296 tokens

  Check untrusted content BEFORE acting on it. Give a `url` to fetch and scan a web page (its visible text and, separately, text hidden in HTML comments, alt/title/aria attributes and meta tags), or give `text` to scan a tool result, retrieved document or message you already have. Runs 120 detection rules covering instruction override, tool hijacking, data exfiltration, system-prompt extraction, jailbreak framing and encoding tricks (zero-width and Unicode-tag smuggling, homoglyphs, base64). Returns a 0-100 risk score, a recommended action (block / review / flag / none) and each match with its evidence. Heuristic: a clean result means nothing obvious tripped, not that the content is safe. Wraps /v1/scan. Same free daily tier as read_url; $0.003/call via x402 after that.

  Paramètres, retour & exemple (2)

  Paramètres

  • url · string · optionnel
    Absolute http(s) URL of a page to fetch and scan.
  • text · string · optionnel
    Text to scan directly (use instead of url).

  Exemple d'appel

  {"name": "scan_for_prompt_injection", "arguments": {"url": "texte", "text": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• scan_mcp_server≈ 284 tokens

  Connect to a remote Streamable HTTP MCP server, fetch its tools/list (sends only initialize, notifications/initialized and tools/list — never tools/call) and scan every tool name, description, parameter description and the server's initialize `instructions` string for tool-poisoning patterns: hidden-instruction markers, invisible Unicode, directives aimed at the model, credential/secret references, exfiltration shapes and instructions about other tools. Returns per-tool findings with severity, excerpt and a score band. Use it before installing or trusting a third-party server. Heuristic: a clean result means nothing obvious in what the server declares about itself, not that it is safe. Wraps GET /v1/mcp-scan. Free, rate-limited per caller; private/internal-network hosts are rejected.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    The MCP server's Streamable HTTP endpoint URL, e.g. https://example.com/mcp

  Exemple d'appel

  {"name": "scan_mcp_server", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_x402_services≈ 338 tokens

  Search for a pay-per-call (x402) API that does what you need. Unlike a raw directory, results are limited to endpoints that answered a real x402 payment challenge AND had at least 5 settled calls from at least 2 distinct payers in the last 30 days, so dead, never-bought and template-farm listings are left out. Each result has the endpoint URL, method, price in USD, networks, 30-day calls and unique payers, and a flag when the payer count looks farmed. Use it when you need a paid API (search, scraping, enrichment, LLM, market data…) and want one that demonstrably works. Wraps GET /v1/x402/search. Same free daily tier as read_url; $0.005/call via x402 after that.

  Paramètres, retour & exemple (4)

  Paramètres

  • limit · integer · optionnel
    Results to return (default 10).
  • query · string · requis
    What the API should do, in a few words, e.g. 'web search' or 'email verification'.
  • network · string · optionnel
    Payment network: base, solana, polygon, arbitrum, optimism, or a CAIP-2 id.
  • max_price_usd · number · optionnel
    Only return endpoints priced at or below this, per call.

  Exemple d'appel

  {"name": "search_x402_services", "arguments": {"query": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://fetchgate.dev/mcp