io.agentropolis/agentropolis

Est-ce que io.agentropolis/agentropolis est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.agentropolis/agentropolis » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 10 outils

• call_kit≈ 704 tokens

  Send a request to a listing's x402 endpoint through Agentropolis and get the seller's raw response back (status, headers, body). Use it only for listings whose search result has buy='relay_x402' (links.call present); for any other listing, call the seller directly using get_kit_manifest. Flow: call without payment, receive HTTP 402 with the seller's payment requirements unchanged, sign a payment with your own wallet to the seller's payTo, then call again with payment_signature (x402 v2) or x_payment (v1). Agentropolis holds no keys or funds, never changes payTo or amount and charges no fee, but a signed payment you pass is forwarded and may be settled by the seller, so real money can move. Limits: seller's own https host only, 256 KB request, 2 MB response, 25 s timeout (longer for slow first-party kits), 20 calls/min per client. Example: {"id":"seenly.seenly-token-preflight","endpoint":"/api/token-preflight","method":"POST","body":{"chain":"base","tokenAddress":"0x4ed4E862860beD51a9570b96d89aF5E1B0Efefed"}}.

  Paramètres, retour & exemple (8)

  Paramètres

  • id · string · requis
    Listing id exactly as returned by search_kits results[].id, e.g. 'seenly.seenly-token-preflight' or 'mcp.io-github-owner-name'.
  • body · ? · optionnel
    Request body. An object is sent as JSON; a string is sent as-is with content_type.
  • query · object · optionnel
    Query-string parameters to append, e.g. {"q":"news"}.
  • method · string · optionnel · GET | POST | PUT | PATCH | DELETE
    HTTP method; defaults to POST when a body is given, else GET.
  • endpoint · string · optionnel
    Path (e.g. '/api/script') or full https URL on the seller's own host. Defaults to the listing's primary endpoint.
  • x_payment · string · optionnel
    Signed X-PAYMENT header value (x402 v1) from your own wallet; forwarded unchanged. Omit on the first call.
  • content_type · string · optionnel
    Content-Type for a string body, e.g. 'text/plain'. Ignored for object bodies (sent as application/json).
  • payment_signature · string · optionnel
    Signed PAYMENT-SIGNATURE header value (x402 v2) from your own wallet; forwarded unchanged. Omit on the first call.

  Exemple d'appel

  {"name": "call_kit", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_bazaar_link≈ 299 tokens

  Build a URL that searches Coinbase's x402 Bazaar (Agentic.Market) for a query. Use it when you want x402 services that may be missing from the Agentropolis index; it only returns a link for you or your user to open. Agentropolis makes no request to Coinbase and does not cache or republish Bazaar data (their terms forbid it). Read-only. Example: {"q":"web search"}.

  Paramètres, retour & exemple (1)

  Paramètres

  • q · string · optionnel
    Search words to prefill on Agentic.Market, e.g. 'image generation'. Omit for the home page.

  Exemple d'appel

  {"name": "get_bazaar_link", "arguments": {"q": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"links": []}}

• get_kit≈ 407 tokens

  Get the full Agentropolis record for one listing by id: summary, pricing, payment-verified trust evidence (verified buyers, settlements, wash flags, disclosed test sales), badge tiers, sources and links. Use it after search_kits to judge whether a listing is worth using; use get_kit_manifest instead when you need the machine-readable invoke contract (endpoints, schemas, payment offers). Read-only, no auth; logs an anonymous detail view for seller analytics. Unknown ids return an error result with error 'not_found'. Example: {"id":"seenly.seenly-token-preflight"}.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    Listing id exactly as returned by search_kits results[].id, e.g. 'seenly.seenly-token-preflight' or 'mcp.io-github-owner-name'.

  Exemple d'appel

  {"name": "get_kit", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "kind": "texte", "name": "texte", "tiers": "texte", "trust": "texte", "badges": []}}

• get_kit_manifest≈ 384 tokens

  Get the kit.json v0.1 manifest for one listing: how to call it (HTTP, MCP or A2A endpoints), input/output schema references, payment offers (rail, network, asset, payTo, amount), discovery files and a trust summary. Use it when you are about to call a listing yourself; use get_kit for human-readable details and trust evidence, or call_kit to call an x402 listing through Agentropolis. Read-only, no auth. For seller-published kits this mirrors the seller's own kit.json; for seeded listings it is generated from public metadata and may be incomplete, so prefer the seller's live 402 challenge for exact prices. Example: {"id":"seenly.seenly-pitch-kit"}.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    Listing id exactly as returned by search_kits results[].id, e.g. 'seenly.seenly-token-preflight' or 'mcp.io-github-owner-name'.

  Exemple d'appel

  {"name": "get_kit_manifest", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "kit": "texte", "invoke": [], "offers": []}}

• get_market_snapshot≈ 353 tokens

  Get 30-day x402 paid-usage statistics per category, with wash trading filtered out: services with paid usage, verified buyers, settlements, median listed price and listings excluded for wash signals. Use it for market sizing or price benchmarking; to find individual tools use search_kits. Read-only, no parameters. Data: x402-list.com measured settlements (CC BY 4.0, attribute when quoting) plus Agentropolis wash filtering. Buyer counts are summed per service, so a wallet that pays several services is counted once per service. Same data as /stats and the weekly reports at /reports.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_market_snapshot", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"rows": [], "caveat": "texte", "report": "texte", "attribution": "texte", "generated_at": "texte"}}

• get_roadmap≈ 300 tokens

  List Agentropolis platform features with status (live, partial, stub, planned), endpoint and guardrails: badges, the x402 relay, seller claims and analytics, sponsored placement, market data, billing. Use it to check whether a platform capability exists before relying on it; it describes Agentropolis itself, not listings. Read-only, no parameters. Stub endpoints answer HTTP 501; payments_enabled shows whether Agentropolis charges for anything (currently false).

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_roadmap", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"items": [], "payments_enabled": true}}

• get_trust_method≈ 266 tokens

  Explain how Agentropolis computes trust scores (method hub-trust-v0.1) and ranks search results: which payment evidence counts, wash-trading exclusions, low-sample caps, why our own test purchases never count, and what a null score means. Use it to interpret the trust and badge fields from search_kits or get_kit; it returns the method, not any listing's score. Read-only, no parameters.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_trust_method", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"score": "texte", "method": "texte", "ranking": "texte", "exclusions": []}}

• list_categories≈ 276 tokens

  List every category in the Agentropolis index with its listing count, largest first (about 18 snake_case ids such as web_search, crypto_onchain_data, llm_inference). Use it to pick a valid value for search_kits' category filter or to see what the index covers; for paid-usage numbers per category use get_market_snapshot. Read-only, no parameters. Category pages with prices and verified buyers: /categories.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_categories", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"categories": []}}

• list_sources≈ 279 tokens

  List the registries and directories Agentropolis ingests or deliberately excludes, with each source's license or terms decision, robots handling and listing count (e.g. Official MCP Registry CC0, x402-list.com CC BY 4.0; Coinbase Bazaar link-out only). Use it to check provenance or the attribution required before citing results; it does not search listings (use search_kits). Read-only, no parameters.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_sources", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"meta": {}, "sources": []}}

• search_kits≈ 1005 tokens

  Search the Agentropolis index of 48,190 agent-usable listings (MCP servers, x402/MPP pay-per-call HTTP APIs, A2A agents and kits) by task keywords, with optional filters. Use it first when you need a tool for a task; then use get_kit for one listing's trust evidence and price, or get_kit_manifest for how to call it. Not for browsing categories (list_categories) or market totals (get_market_snapshot). Read-only, no auth, never pays. Ranking: BM25 text relevance, boosted by payment-verified trust and the earned Live-Tested badge; trust.score null means no payment evidence (not a negative signal). results[] is organic; featured[] is a separate, labelled Agentropolis Pro row (today only our own first-party kits, no fee paid) and sponsored[] is always empty. Listed prices are hints; the seller's live HTTP 402 challenge is authoritative. Each search is logged anonymously (query text, no raw IP). Example: {"q":"web search","rail":"x402","max_price_usd":0.01,"min_trust":40}.

  Paramètres, retour & exemple (8)

  Paramètres

  • q · string · requis
    What the agent needs, in plain words: 'web search', 'transcribe audio with speakers', 'postgres', 'token honeypot check'. Keywords beat full sentences.
  • kind · string · optionnel · kit | http_api | mcp_server | a2a_agent
    Restrict to one listing type: kit (packaged task API), http_api (pay-per-call HTTP API), mcp_server, a2a_agent. Omit for all.
  • rail · string · optionnel · x402 | mpp
    Only listings that accept this payment rail: x402 (USDC on-chain, per call) or mpp (Machine Payments Protocol).
  • limit · integer · optionnel
    Number of organic results to return, 1-25 (default 10).
  • category · string · optionnel
    Category id from list_categories, e.g. 'web_search' or 'crypto_onchain_data'. Comma-separate to allow several.
  • min_trust · number · optionnel
    Only listings with a payment-verified trust score of at least this value (0-100). Excludes listings with no payment evidence.
  • paid_only · boolean · optionnel
    true = only listings that accept a payment rail (x402 or MPP).
  • max_price_usd · number · optionnel
    Only listings whose lowest listed price per call/unit is at most this many US dollars, e.g. 0.01. Listings without a known price are excluded when set.

  Exemple d'appel

  {"name": "search_kits", "arguments": {"q": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"total": 1, "ranking": "texte", "results": [], "featured": [], "search_id": "texte", "sponsored": [], "featured_label": "texte"}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://agentropolis.io/api/mcp