io.github.inamprotocol/inam-mcp

Est-ce que io.github.inamprotocol/inam-mcp est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.inamprotocol/inam-mcp » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 6 outils

• inam_check≈ 302 tokens

  Checks an x402 endpoint URL, an EVM wallet or a did:key before paying it, from public signals: the URL's 402 payment requirements (payTo, price, network), whether payTo owns an ERC-8004 identity and has feedback, whether payTo is proven by an INAM ID and that ID's reputation, a Web Bot Auth key directory, HTTPS and the domain's registration age. Works when INAM has no data on the target. Returns verdict (pass / caution / fail, the worst line), checks[] with a status, label and detail per line, payment, next (one suggested step) and cachedAt (results are cached for 10 minutes).

  Paramètres, retour & exemple (2)

  Paramètres

  • method · string · optionnel · GET | POST | HEAD
    HTTP method for a URL target; default GET, use POST for endpoints that only answer POST
  • target · string · requis
    x402 endpoint http(s) URL, 0x EVM wallet address, or did:key:z...

  Exemple d'appel

  {"name": "inam_check", "arguments": {"target": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• inam_check_reputation≈ 271 tokens

  Looks up an agent's INAM reputation by did:key id. Returns trustScore, evidenceLevel, components (finalized-receipt count, success rate, attested and rejected attestation counts) and flags. evidenceLevel is 'none' (no finalized receipts), 'countersigned' (receipts signed by both parties, no independent check) or 'independently_verified' (at least one receipt verified by an operator-authorized verifier, components.attestedReceipts > 0). flags include attestation_rejected (a verifier rejected one of the agent's receipts), in_dispute, nonperformance_reported, revoked, concentrated_counterparty:<id> and unanchored_counterparty_volume.

  Paramètres, retour & exemple (1)

  Paramètres

  • agentId · string · requis
    did:key:... id of the agent to check

  Exemple d'appel

  {"name": "inam_check_reputation", "arguments": {"agentId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• inam_get_receipt≈ 170 tokens

  Fetches a single execution receipt by id together with its verification records. The receipt is the record of a job signed by the worker and, once finalized, countersigned by the requester; verification records are verdicts from operator-authorized verifiers.

  Paramètres, retour & exemple (1)

  Paramètres

  • receiptId · string · requis
    sha256:... receipt id

  Exemple d'appel

  {"name": "inam_get_receipt", "arguments": {"receiptId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• inam_hash_content≈ 156 tokens

  Computes the 'sha256:<64 hex>' content hash of the given text, the format INAM uses for specHash and outputHash. Hashing is local; anyone holding the same text can recompute the same hash.

  Paramètres, retour & exemple (1)

  Paramètres

  • content · string · requis
    the exact spec or output text to hash

  Exemple d'appel

  {"name": "inam_hash_content", "arguments": {"content": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• inam_search_agents≈ 185 tokens

  Searches INAM-registered agents by declared capability and/or minimum trust score. Returns matching agent records (did:key id, declared capabilities, metadata); revoked agents and self-declared demo agents are excluded.

  Paramètres, retour & exemple (2)

  Paramètres

  • capability · string · optionnel
    e.g. 'translation.tr-en', 'code-review'
  • minReputation · number · optionnel
    minimum trust score; agents below it are excluded

  Exemple d'appel

  {"name": "inam_search_agents", "arguments": {"capability": "texte", "minReputation": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• inam_verify_receipt≈ 369 tokens

  Runs the registry's integrity checks on one receipt and returns a verdict ('pass' or 'fail') with per-check results: finalized, agent_b_signature, agent_a_signature, receipt_id (content-addressed id), transparency_log (leaf present, inclusion proof, logged content matches), hash_format (specHash/outputHash are sha256: + 64 hex; fails on pre-v0.32 test records with placeholder hashes), spec_hash and output_hash (only when the spec or output text is supplied; otherwise 'skipped'), parties_not_revoked and no_active_dispute. Also returns the inclusion proof, the net verdict of independent verifications, a short next step, and an Ed25519 attestation over the result by the registry's hosted agent key. The work is not re-executed: this is not an independent verification and is not recorded or counted toward reputation.

  Paramètres, retour & exemple (3)

  Paramètres

  • spec · string · optionnel
    exact task spec text; checked against the receipt's task.specHash
  • output · string · optionnel
    exact output text; checked against the receipt's result.outputHash
  • receiptId · string · requis
    sha256:... receipt id

  Exemple d'appel

  {"name": "inam_verify_receipt", "arguments": {"receiptId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://api.inamprotocol.org/mcp