dev.workers.bhazarstudio.datoka-hooks-test/datoka-hooks

Est-ce que dev.workers.bhazarstudio.datoka-hooks-test/datoka-hooks est sûr ?

Au dernier audit MCP Hub, le serveur MCP « dev.workers.bhazarstudio.datoka-hooks-test/datoka-hooks » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 9 outils

• accept_hook_event≈ 450 tokens

  Enqueue up to 65536 payload bytes for a previously verified receiver using its delivery token. Returns a deliveryId, not proof of delivery. Reuse eventId and exact bytes on retries, then poll get_hook_delivery. The free allowance is 100 events/day per verified receiver; extra admissions consume purchased credits. No arbitrary destination can be supplied here.

  Paramètres, retour & exemple (5)

  Paramètres

  • token · string · requis
    Private delivery token returned by registration; authenticates event submission, delivery lookup and receipt verification for this hook.
  • hookId · string · requis
    Hook identifier returned by registration; preserve for all subsequent operations.
  • eventId · string · requis
    Stable caller-chosen event identifier, for example order-20261007-01. Reuse with identical payload bytes on retry; different bytes under the same ID are rejected.
  • bodyBase64 · string · requis
    Canonical base64 payload, at most 65536 decoded bytes. Preserve exact bytes with eventId on retries.
  • contentType · string · requis · application/json | text/plain | application/octet-stream
    Media type of the decoded payload bytes; JSON must be encoded as UTF-8 before base64 conversion.

  Exemple d'appel

  {"name": "accept_hook_event", "arguments": {"token": "texte", "hookId": "texte", "eventId": "texte", "bodyBase64": "texte", "contentType": "application/json"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_destination_status≈ 250 tokens

  Read the existing hook ownership challenge and verification or revocation status using its management token. No activation or delivery. Use after registration or an interrupted verification; use get_hook_delivery for one accepted event.

  Paramètres, retour & exemple (2)

  Paramètres

  • hookId · string · requis
    Hook identifier returned by registration; preserve for all subsequent operations.
  • managementToken · string · requis
    Private management token returned by registration. Required for status, activation, revocation and credits; not the delivery token.

  Exemple d'appel

  {"name": "get_destination_status", "arguments": {"hookId": "texte", "managementToken": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_hook_credits≈ 245 tokens

  Read remaining purchased admission credits for an existing hook using its management token. Free and read-only; does not purchase credits. Use purchase_hook_credits to request a quote. The daily free allowance remains separate.

  Paramètres, retour & exemple (2)

  Paramètres

  • hookId · string · requis
    Hook identifier returned by registration; preserve for all subsequent operations.
  • managementToken · string · requis
    Private management token returned by registration. Required for status, activation, revocation and credits; not the delivery token.

  Exemple d'appel

  {"name": "get_hook_credits", "arguments": {"hookId": "texte", "managementToken": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_hook_delivery≈ 344 tokens

  Read one accepted event by its returned deliveryId and hook delivery token. Poll after accept_hook_event to distinguish queued, retried and completed delivery. Signed observations attest relay attempts, not successful business processing by the receiver. No new delivery or payment.

  Paramètres, retour & exemple (3)

  Paramètres

  • token · string · requis
    Private delivery token returned by registration; authenticates event submission, delivery lookup and receipt verification for this hook.
  • hookId · string · requis
    Hook identifier returned by registration; preserve for all subsequent operations.
  • deliveryId · string · requis
    Delivery identifier returned on event acceptance; acceptance does not mean delivered.

  Exemple d'appel

  {"name": "get_hook_delivery", "arguments": {"token": "texte", "hookId": "texte", "deliveryId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• purchase_hook_credits≈ 367 tokens

  Request an x402 quote without payment, or buy credits with an explicitly authorized signed payment. Reuse purchaseId and the same payment after any timeout.

  Paramètres, retour & exemple (4)

  Paramètres

  • hookId · string · requis
    Hook identifier returned by registration; preserve for all subsequent operations.
  • payment · object · optionnel
    Original signed x402 payment payload authorized by the payer. Omit to request a quote without paying. Never fabricate or replace an uncertain authorization.
  • purchaseId · string · requis
    Unique caller-chosen purchase identifier, for example credits-20261007-01. Save before requesting the quote and reuse unchanged with the same payment on retries.
  • managementToken · string · requis
    Private management token returned by registration. Required for status, activation, revocation and credits; not the delivery token.

  Exemple d'appel

  {"name": "purchase_hook_credits", "arguments": {"hookId": "texte", "purchaseId": "texte", "managementToken": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• register_destination≈ 278 tokens

  Register an HTTPS receiver you control. Returns hookId, private credentials and the ownership challenge; delivery remains inactive. Publish the exact challenge on your origin, then call verify_destination. Keep recoveryKey secret and reuse it with the identical target after interruption; do not register again with a new key.

  Paramètres, retour & exemple (2)

  Paramètres

  • target · string · requis
    HTTPS receiver you control; ownership challenge is required before delivery.
  • recoveryKey · string · requis
    Generate 32 random bytes locally and encode as 64 lowercase hex characters. Save privately before registration; reuse with the identical target after interruption.

  Exemple d'appel

  {"name": "register_destination", "arguments": {"target": "texte", "recoveryKey": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• revoke_destination≈ 259 tokens

  Permanently revoke this hook with its management token after explicit owner approval. New submissions are rejected; previously accepted deliveries finish. This does not cancel queued events and cannot be undone. Use get_destination_status first if you only need to inspect access.

  Paramètres, retour & exemple (2)

  Paramètres

  • hookId · string · requis
    Hook identifier returned by registration; preserve for all subsequent operations.
  • managementToken · string · requis
    Private management token returned by registration. Required for status, activation, revocation and credits; not the delivery token.

  Exemple d'appel

  {"name": "revoke_destination", "arguments": {"hookId": "texte", "managementToken": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_destination≈ 262 tokens

  Fetch the ownership challenge from the previously registered receiver and activate it when valid. First publish the exact challenge returned by register_destination. Requires the management token; does not deliver an event. Use get_destination_status to inspect progress without activation.

  Paramètres, retour & exemple (2)

  Paramètres

  • hookId · string · requis
    Hook identifier returned by registration; preserve for all subsequent operations.
  • managementToken · string · requis
    Private management token returned by registration. Required for status, activation, revocation and credits; not the delivery token.

  Exemple d'appel

  {"name": "verify_destination", "arguments": {"hookId": "texte", "managementToken": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_hook_receipt≈ 353 tokens

  Check an unchanged event and signed receipt returned by get_hook_delivery within the authenticated hook. Requires the delivery token; does not send an event. A valid signature attests relay observations, not business truth or exactly-once processing.

  Paramètres, retour & exemple (4)

  Paramètres

  • event · object · requis
    Exact event object returned with the relay receipt; preserve all fields.
  • token · string · requis
    Private delivery token returned by registration; authenticates event submission, delivery lookup and receipt verification for this hook.
  • hookId · string · requis
    Hook identifier returned by registration; preserve for all subsequent operations.
  • receipt · object · requis
    Exact signed relay receipt from delivery lookup. Do not substitute issuer keys or edit its fields.

  Exemple d'appel

  {"name": "verify_hook_receipt", "arguments": {"event": {}, "token": "texte", "hookId": "texte", "receipt": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://datoka-hooks.bhazarstudio.workers.dev/mcp