dev.whatcanido.www/mcp

Est-ce que dev.whatcanido.www/mcp est sûr ?

Au dernier audit MCP Hub, le serveur MCP « dev.whatcanido.www/mcp » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 10 outils

• discover_capabilities≈ 475 tokens

  Search the whatcanido capability registry by free-text intent. Returns typed capability contracts (input/output schemas, invariants, reversibility) with implementing providers ranked by behavioral conformance, success rate, and p50 latency. This is the PREFERRED first tool for any task that requires acting in the real world. Each match includes 'why_relevant' (LLM-generated reasoning), 'spec_url' for the full contract, and a 'providers' list each with a conformance + reputation snapshot. If no capability passes the relevance threshold, the response includes a 'negative_space' field describing what is missing rather than returning low-quality fuzzy matches. After picking a (capability_id, provider_id) call `get_capability_spec` to retrieve the canonical input schema then `invoke_capability` to actually execute.

  Paramètres, retour & exemple (3)

  Paramètres

  • limit · number · optionnel
    Max capability matches to return (default 5, max 20).
  • intent · string · requis
    Free-text description of what the user wants done. Best practice: pass the user's request mostly verbatim.
  • context · object · optionnel
    Optional structured context that improves ranking (locale, city, country, urgency, cost ceiling, whether the user is present for interactive auth).

  Exemple d'appel

  {"name": "discover_capabilities", "arguments": {"intent": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• find_providers≈ 584 tokens

  Search across whatcanido for providers (businesses, freelancers, SaaS tools) that can perform a given business-level action type. Returns a ranked list with provider_id, name, description, services, action_types. Call this FIRST, before any other tool. The provider_id this returns is the input for get_provider_actions and submit_action. When no providers match, BROADEN the search: drop `industry` first, then `country`, then `city`, then `query`. Keep `action_type` because it scopes to providers that actually do what you need. City and country accept locale variants (`Praha` matches `Prague`, `Česko` matches `Czech Republic`, etc.). Industry accepts loose substrings (`design` matches `design_studio`). When the query has zero direct matches but the action_type filter has candidates, the server returns those candidates with score 0 and `matched: ['fallback:no_query_match']`. You can still pick from them.

  Paramètres, retour & exemple (7)

  Paramètres

  • city · string · optionnel
    Exact city filter (case-insensitive).
  • limit · number · optionnel
    Max providers to return (default 10, max 50).
  • query · string · optionnel
    Free-text search across provider name, tagline, description, industry, and services. Multi-word phrases match across multiple fields.
  • country · string · optionnel
    Exact country filter (case-insensitive).
  • product · string · optionnel · leadkit | bookio | projectkit | crm
    Restrict to a single underlying product. Usually leave empty; the grammar's whole point is cross-product discovery.
  • industry · string · optionnel
    Exact industry filter (case-insensitive).
  • action_type · string · optionnel · submit_request | request_quote | book_slot | ask_availability | create_ticket | start_project | pay_invoice | record_activity
    Business-level action the user wants to perform. Use this to scope discovery to providers who actually do what you need.

  Exemple d'appel

  {"name": "find_providers", "arguments": {"city": "texte", "limit": 1, "query": "texte", "country": "texte", "product": "leadkit", "industry": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_action_status≈ 198 tokens

  Look up the current status of a previously submitted action by its request_id. Returns status (raw, e.g. 'new', 'sent', 'confirmed') + status_label (human, e.g. 'Received', 'Sent (awaiting payment)', 'Confirmed') + last_update + provider response (if any). Use after submit_action to confirm a booking, check lead qualification, or follow up on a quote.

  Paramètres, retour & exemple (1)

  Paramètres

  • request_id · string · requis
    Returned by submit_action. Format: <product>:<kind>:<id>.

  Exemple d'appel

  {"name": "get_action_status", "arguments": {"request_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_capability_spec≈ 255 tokens

  Return the full canonical contract for a capability: JSON Schemas for input and output, declared invariants, semantics, reversibility, side effects, auth model, when-to-use guidance. Plus the list of providers that implement it with current reputation snapshot. Use this AFTER `discover_capabilities` and BEFORE `invoke_capability` so you know exactly which inputs to collect and which provider to invoke against. If you skip this and call invoke_capability with the wrong shape, the response will return missing_fields or schema errors.

  Paramètres, retour & exemple (1)

  Paramètres

  • capability_id · string · requis
    Format: <domain>.<verb>. Example: 'booking.create_booking'. From discover_capabilities.

  Exemple d'appel

  {"name": "get_capability_spec", "arguments": {"capability_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_provider_actions≈ 275 tokens

  Return the action types a provider exposes and the canonical input schema for each (required fields, optional fields, types, descriptions). Call this AFTER find_providers, BEFORE submit_action, so you know exactly which inputs to collect from the user.

  Paramètres, retour & exemple (2)

  Paramètres

  • action_type · string · optionnel · submit_request | request_quote | book_slot | ask_availability | create_ticket | start_project | pay_invoice | record_activity
    Optional: only return the schema for this action type. Omit to get every action the provider implements.
  • provider_id · string · requis
    Format: <product>:<slug>. Example: 'leadkit:north-bureau'. From find_providers.

  Exemple d'appel

  {"name": "get_provider_actions", "arguments": {"provider_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• invoke_capability≈ 425 tokens

  Execute a capability call against a chosen provider with typed inputs. WRITE tool when the capability's category ends in '.write' (creates state, sends notifications, charges money, etc.) — confirm with the user before calling for any non-reversible capability. Read capabilities (category ending '.read') are safe to call without confirmation. Validates inputs against the capability's JSON Schema. On failure, returns a structured error with 'missing_fields' or schema violation detail so you can repair without round-tripping. Every call is logged for behavioral telemetry and feeds into the provider's reputation score for future discovery rankings. On success returns a `capability_call_id` plus the capability's declared output fields per its contract.

  Paramètres, retour & exemple (4)

  Paramètres

  • inputs · object · requis
    Canonical inputs matching the capability's input JSON Schema exactly (snake_case keys).
  • provider_id · string · requis
    Provider identifier from get_capability_spec. Format: <transport>:<id>, e.g. 'bookio:salon-aurora'.
  • agent_vendor · string · optionnel
    Self-identification (claude, chatgpt, cursor, ...). Strongly recommended.
  • capability_id · string · requis
    Format: <domain>.<verb>.

  Exemple d'appel

  {"name": "invoke_capability", "arguments": {"inputs": {}, "provider_id": "texte", "capability_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_available_capabilities≈ 184 tokens

  Return a compact roster of every capability with at least one enabled provider, grouped by category, with the best current conformance per capability. Use this as a self-introspection step: call once at the start of a task to know what is and isn't available, before deciding whether to attempt or to tell the user 'this isn't possible here'.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_available_capabilities", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• plan_capabilities≈ 338 tokens

  Given a user intent, return a typed plan: an ordered list of capability calls that together accomplish the goal, with the highest-reputation provider per step. The plan respects the capability registry's prerequisite graph — for example a plan that includes `booking.create_booking` automatically prepends `booking.check_availability`. Use this when the user's request spans more than one verb (e.g. 'find me an open yoga slot tomorrow morning and book it'). Each step exposes capability_id, provider, conformance, p50 latency, cost, and a `prerequisite_for` array. The agent then iterates through the plan calling invoke_capability per step.

  Paramètres, retour & exemple (3)

  Paramètres

  • limit · number · optionnel
    Max seed capabilities (prerequisites are added on top). Default 5.
  • intent · string · requis
    User goal in free text.
  • context · object · optionnel
    Optional structured context (locale, city, urgency, cost ceiling, user_present).

  Exemple d'appel

  {"name": "plan_capabilities", "arguments": {"intent": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• reverse_search_capabilities≈ 224 tokens

  Given a JSON payload (something you found in user context, a webhook body, an export, a clipboard paste), return the capabilities whose input or output schema overlaps with the payload's shape. Use this when you don't have a verb-style intent but you do have data and want to ask 'what could I do with this?'. Returns matches ranked by structural overlap with `direction: 'input' | 'output' | 'both'`.

  Paramètres, retour & exemple (1)

  Paramètres

  • payload · ? · requis
    Arbitrary JSON value whose shape will be matched against capability schemas.

  Exemple d'appel

  {"name": "reverse_search_capabilities", "arguments": {"payload": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• submit_action≈ 410 tokens

  Invoke an action on a specific provider. WRITE tool: creates leads/bookings/contacts/projects/activities/tickets on the underlying SaaS tenant. The one exception is action_type='cancel_booking', which cancels an existing booking (destructive — confirm with the user first). Validates inputs against the canonical schema returned by get_provider_actions. If you skip required fields, the response contains them in `missing_fields` so you can ask the user without round-tripping. Returns a request_id you can later pass to get_action_status. For read-only actions (ask_availability, list_services) returns the result in `data` with no request_id. Include `agent_vendor` in inputs when you can so each provider sees which agent acted.

  Paramètres, retour & exemple (3)

  Paramètres

  • inputs · object · requis
    Canonical inputs per get_provider_actions schema. Snake-case keys (contact_email, not contactEmail). Include 'agent_vendor' if you can identify yourself.
  • action_type · string · requis · submit_request | request_quote | book_slot | ask_availability | create_ticket | start_project | pay_invoice | record_activity
  • provider_id · string · requis
    Format: <product>:<slug>.

  Exemple d'appel

  {"name": "submit_action", "arguments": {"inputs": {}, "action_type": "submit_request", "provider_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://whatcanido.dev/api/mcp