io.github.kirillradchenko96/fresh402

Est-ce que io.github.kirillradchenko96/fresh402 est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.kirillradchenko96/fresh402 » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 5 outils

• fresh402_check≈ 1477 tokens

  Check whether public HTML, JSON or text changed; use for on-demand freshness checks and a compact deterministic text diff, not background monitoring. Supply exactly one of url or watch_id. A URL-based paid Check can create a watch; an ID reuses its saved URL/rules, so omit all content-rule fields. Reuse returned watch_id/hash for later checks; first URL check without prior state reports changed:null. Optional cache reuse still costs $0.005 USDC per call on Base mainnet (eip155:8453). Requires an x402-capable MCP payment client and funded native-USDC payer; an ordinary MCP client receives a payment challenge, not a paid result. Alternatively use prepaid credits through REST or this MCP tool: X-Fresh402-API-Key in HTTP, with params._meta["fresh402/prepaid"] containing idempotency_key, tariff_version and max_credits. When root mpp_payments.enabled is true, native MPP EVM charge is another option at the same USDC price: use an authorized Base EIP-712 signer and official mppx client, org.paymentauth/credential metadata and a persisted private recovery token. MPP receipt: org.paymentauth/receipt; see docs/MPP.md. Never combine MPP, prepaid and x402. Discover packages at /v2/prepaid/plans; see docs/AGENT_PREPAID.md for browserless wallet enrollment, bounded early credits and recovery. No JavaScript execution. Optional Circle Gateway x402 is available only when root circle_gateway.enabled is true. Use the GatewayWalletBatched quote, a funded Base Gateway EOA and a persisted private recovery token. Pending batches return 409; replay the original proof/input/token after 60 seconds. Results require Gateway confirmed/completed evidence; never mix providers. No Circle prepaid funding. See docs/CIRCLE_GATEWAY.md.

  Paramètres, retour & exemple (8)

  Paramètres

  • url · string · optionnel
    Supply exactly one of url or watch_id. URL must be absolute public HTTPS on port 443, at most 4096 characters, with no credentials/private targets, e.g. 'https://example.com/docs'. Fresh402's own service URLs, including its discovery /openapi.json, cannot be targets; choose an external public document. With url, optional content rules identify the watch; an existing watch is reused or a new one is created by this paid Check. Separate registration is not required. No JavaScript rendering.
  • selector · string · optionnel
    Optional HTML CSS scope, 1-256 characters, e.g. 'main'; accepted only with url. Omit for the page after built-in noise removal. No match returns 422; not supported for JSON/plain text. With watch_id, omit this field: the saved selector is reused.
  • watch_id · string · optionnel
    Supply exactly one of watch_id or url. An existing ID returned by fresh402_register (free), POST /v1/register, or a URL-based Check: 'w_' followed by 32 lowercase hexadecimal characters. Reuses that watch's stored URL and rules. When supplied, omit selector, ignore_selectors and ignore_json_paths entirely, even empty arrays. Do not invent an ID.
  • include_diff · boolean · optionnel
    Optional boolean; runtime default: true. Request a compact deterministic text diff when content changed and compatible prior text is retained. False omits the diff; true cannot recover unavailable old content and does not enable Smart Diff's structural analysis.
  • previous_hash · string · optionnel
    Optional previous Fresh402 content hash: exactly 64 hexadecimal characters, case-insensitive. Overrides comparison with the watch's current stored hash. Omit to use that stored hash; a new URL watch without a prior hash returns changed:null. Hash comparison does not require retained old text, but a text diff does; a hash cannot reconstruct missing content.
  • max_age_seconds · integer · optionnel
    Optional integer cache age in seconds, 0-86400; runtime default: 0. A positive value permits reuse of a sufficiently recent watch result without fetching. Zero contacts the source (conditional HTTP may return 304). Cached Checks still require payment; this does not schedule background polling.
  • ignore_selectors · array · optionnel
    Optional HTML-only exclusion array, up to 20 supported CSS selectors of 1-256 characters each, e.g. ['.timestamp']. Accepted only with url; default []. With watch_id, omit the field entirely (including []): saved exclusions are reused.
  • ignore_json_paths · array · optionnel
    Optional JSON-only exclusions, up to 20 paths of 1-256 characters starting with '/'; '~0'/'~1' escapes and '*' segments are supported. Example: ['/updated_at']. Accepted only with url; default []. With watch_id, omit entirely (including []): saved paths are reused.

  Exemple d'appel

  {"name": "fresh402_check", "arguments": {"url": "texte", "selector": "texte", "watch_id": "texte", "include_diff": true, "previous_hash": "texte", "max_age_seconds": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• fresh402_extract≈ 1300 tokens

  Extract readable text, metadata, headings, public links and embedded JSON-LD from one public HTTPS document. Use to read static HTML, JSON or plain text; no watch or prior registration is needed. Optional CSS scope and noise exclusions; max_chars defaults to 20000 and limits returned text, not fetch size. Does not render JavaScript, crawl links or compare versions. $0.010 USDC per call on Base mainnet (eip155:8453), requiring an x402-capable MCP payment client and funded native-USDC payer. An ordinary MCP client receives a payment challenge. Alternatively use prepaid credits through REST or this MCP tool: X-Fresh402-API-Key in HTTP, with params._meta["fresh402/prepaid"] containing idempotency_key, tariff_version and max_credits. When root mpp_payments.enabled is true, native MPP EVM charge is another option at the same USDC price: use an authorized Base EIP-712 signer and official mppx client, org.paymentauth/credential metadata and a persisted private recovery token. MPP receipt: org.paymentauth/receipt; see docs/MPP.md. Never combine MPP, prepaid and x402. Discover packages at /v2/prepaid/plans; see docs/AGENT_PREPAID.md for browserless wallet enrollment, bounded early credits and recovery. Optional Circle Gateway x402 is available only when root circle_gateway.enabled is true. Use the GatewayWalletBatched quote, a funded Base Gateway EOA and a persisted private recovery token. Pending batches return 409; replay the original proof/input/token after 60 seconds. Results require Gateway confirmed/completed evidence; never mix providers. No Circle prepaid funding. See docs/CIRCLE_GATEWAY.md.

  Paramètres, retour & exemple (7)

  Paramètres

  • url · string · requis
    Required absolute public HTTPS document URL, at most 4096 characters, e.g. 'https://example.com/docs'. Only port 443; no embedded credentials, private/local targets or authenticated pages. Fresh402's own service URLs, including its discovery /openapi.json, cannot be targets; choose an external public document. HTML, JSON and plain text are supported; JavaScript is not executed. DNS, redirect and size limits also apply.
  • selector · string · optionnel
    Optional HTML CSS scope, 1-256 characters, e.g. 'article'. If omitted, choose main, then article, then body, then the document. Explicit scope must match (otherwise 422). Built-in noise and ignore_selectors are removed. Not supported for JSON/plain text.
  • max_chars · integer · optionnel
    Optional integer limit on returned normalized text: 100-50000 characters, default 20000. Does not raise fetch/parser limits; the hash covers full normalized text before truncation. If JSON text is truncated, parsed data is omitted (data:null, data_omitted:true).
  • include_links · boolean · optionnel
    Optional boolean, default true. Include bounded public links extracted from HTML. False returns an empty links array without changing normalized text or its hash. Does not crawl linked pages; JSON/plain text do not provide HTML links.
  • ignore_selectors · array · optionnel
    Optional array of up to 20 CSS selectors (each 1-256 characters) to remove from HTML in addition to built-in noise filtering. Default: no extra exclusions ([]). HTML only; use ignore_json_paths for JSON. Example: ['.timestamp', '.ad'].
  • ignore_json_paths · array · optionnel
    Optional array of up to 20 JSON Pointer-style paths to remove before JSON normalization and hashing. Each must start with '/' and be 1-256 characters; supports '*' segments. Default: [] (no exclusions). JSON only. Example: ['/updated_at', '/items/*/request_id'].
  • include_structured_data · boolean · optionnel
    Optional boolean, default true. Include embedded JSON-LD extracted from HTML in structured_data. False returns an empty structured_data array. This does not control the parsed data field for a JSON document, and does not fetch external linked data.

  Exemple d'appel

  {"name": "fresh402_extract", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• fresh402_openapi_contract_diff≈ 966 tokens

  Detect structural compatibility changes in a public JSON OpenAPI 3.0/3.1 contract: paths, methods, parameters, request requirements and response schemas. Use for API contract review; Smart Diff is for general documents. First register the contract URL with free fresh402_register, without selectors or ignore rules, then reuse watch_id. compare_to accepts previous (default) or baseline; an available same-watch previous_hash overrides it. Limits include 256000 decoded document bytes, 100 paths and 500 operations. No YAML, external reference fetching, API-operation execution, LLM or complete compatibility guarantee. $0.020 USDC per call on Base mainnet (eip155:8453); requires an x402-capable MCP payment client and funded native-USDC payer, otherwise returns a payment challenge. Alternatively use prepaid credits through REST or this MCP tool: X-Fresh402-API-Key in HTTP, with params._meta["fresh402/prepaid"] containing idempotency_key, tariff_version and max_credits. When root mpp_payments.enabled is true, native MPP EVM charge is another option at the same USDC price: use an authorized Base EIP-712 signer and official mppx client, org.paymentauth/credential metadata and a persisted private recovery token. MPP receipt: org.paymentauth/receipt; see docs/MPP.md. Never combine MPP, prepaid and x402. Discover packages at /v2/prepaid/plans; see docs/AGENT_PREPAID.md for browserless wallet enrollment, bounded early credits and recovery. Optional Circle Gateway x402 is available only when root circle_gateway.enabled is true. Use the GatewayWalletBatched quote, a funded Base Gateway EOA and a persisted private recovery token. Pending batches return 409; replay the original proof/input/token after 60 seconds. Results require Gateway confirmed/completed evidence; never mix providers. No Circle prepaid funding. See docs/CIRCLE_GATEWAY.md.

  Paramètres, retour & exemple (3)

  Paramètres

  • watch_id · string · requis
    Required existing watch ID: 'w_' plus 32 lowercase hexadecimal characters. Obtain it with free fresh402_register or POST /v1/register using the public JSON OpenAPI 3.0/3.1 URL and no selector or ignore rules. Reuses the saved URL; do not pass url here. YAML, non-OpenAPI documents and scoped/filtered watches are unsupported. Illustrative IDs must be replaced.
  • compare_to · string · optionnel · previous | baseline
    Optional mode: 'previous' (default) compares with the latest saved OpenAPI Contract Diff snapshot; 'baseline' uses its fixed saved baseline. Before contract history exists, the current registered watch state seeds the initial baseline. previous_hash overrides the mode. 'hash' appears only in results, not as an accepted input mode.
  • previous_hash · string · optionnel
    Optional 64-character hexadecimal reference hash, case-insensitive. Prefer a hash returned by OpenAPI Contract Diff for this same watch, matching a retained contract snapshot or fixed baseline. The current registered core hash is also accepted as a fallback: without a matching contract snapshot, the fixed baseline (or registered state if no baseline exists) is used. Overrides compare_to; unavailable hashes return 404. Omit to use the selected mode.

  Exemple d'appel

  {"name": "fresh402_openapi_contract_diff", "arguments": {"watch_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• fresh402_register≈ 848 tokens

  Create or retrieve a free persistent baseline for public HTTPS HTML, JSON or plain text. Use before Smart Diff or OpenAPI Contract Diff, or to obtain a reusable watch_id/hash for Check. Required url plus optional CSS/JSON exclusions identify the watch; changing rules creates a different watch. Repeating the same registration returns existing state without fetching or refreshing it. Reuse the actual returned watch_id; never invent an ID. Registration is free ($0), subject to quotas, and requires no x402 payment client; subsequent comparison tools are paid. Check also accepts url directly and can create its watch during the paid call. No JavaScript execution or background monitoring. For OpenAPI comparisons register the JSON contract without any content rules.

  Paramètres, retour & exemple (4)

  Paramètres

  • url · string · requis
    Required absolute public HTTPS document URL, at most 4096 characters, e.g. 'https://example.com/docs'. Only port 443; no embedded credentials, private/local targets or authenticated pages. Fresh402's own service URLs, including its discovery /openapi.json, cannot be targets; choose an external public document. HTML, JSON and plain text are supported; JavaScript is not executed. DNS, redirect and size limits also apply.
  • selector · string · optionnel
    Optional HTML scope: a supported CSS selector, 1-256 characters, e.g. 'main' or 'article .content'. Only matching text is normalized; no match returns 422. Omit to normalize the page after built-in noise removal. Not supported for JSON or plain text.
  • ignore_selectors · array · optionnel
    Optional array of up to 20 CSS selectors (each 1-256 characters) to remove from HTML in addition to built-in noise filtering. Default: no extra exclusions ([]). HTML only; use ignore_json_paths for JSON. Example: ['.timestamp', '.ad'].
  • ignore_json_paths · array · optionnel
    Optional array of up to 20 JSON Pointer-style paths to remove before JSON normalization and hashing. Each must start with '/' and be 1-256 characters; supports '*' segments. Default: [] (no exclusions). JSON only. Example: ['/updated_at', '/items/*/request_id'].

  Exemple d'appel

  {"name": "fresh402_register", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• fresh402_smart_diff≈ 921 tokens

  Explain structured changes in a registered public document: JSON Pointer changes, HTML block changes and deterministic significance hints. Use instead of Check when a changed/unchanged flag or short text diff is insufficient. First obtain watch_id with free fresh402_register; saved URL/rules are reused. compare_to is previous (default) or baseline; previous_hash overrides it when the same-watch snapshot is retained. Up to 200 changes; legacy HTML may have text-only fidelity. No LLM, JavaScript rendering or complete API compatibility guarantee. $0.015 USDC per call on Base mainnet (eip155:8453); requires an x402-capable MCP payment client and funded native-USDC payer, otherwise returns a payment challenge. Alternatively use prepaid credits through REST or this MCP tool: X-Fresh402-API-Key in HTTP, with params._meta["fresh402/prepaid"] containing idempotency_key, tariff_version and max_credits. When root mpp_payments.enabled is true, native MPP EVM charge is another option at the same USDC price: use an authorized Base EIP-712 signer and official mppx client, org.paymentauth/credential metadata and a persisted private recovery token. MPP receipt: org.paymentauth/receipt; see docs/MPP.md. Never combine MPP, prepaid and x402. Discover packages at /v2/prepaid/plans; see docs/AGENT_PREPAID.md for browserless wallet enrollment, bounded early credits and recovery. Optional Circle Gateway x402 is available only when root circle_gateway.enabled is true. Use the GatewayWalletBatched quote, a funded Base Gateway EOA and a persisted private recovery token. Pending batches return 409; replay the original proof/input/token after 60 seconds. Results require Gateway confirmed/completed evidence; never mix providers. No Circle prepaid funding. See docs/CIRCLE_GATEWAY.md.

  Paramètres, retour & exemple (3)

  Paramètres

  • watch_id · string · requis
    Required existing watch ID: 'w_' plus 32 lowercase hexadecimal characters, returned by free fresh402_register or POST /v1/register (a URL-based Check can also create it). Reuses the saved public URL and content rules; do not pass url or new rules here. Replace illustrative IDs with a real returned ID before paying.
  • compare_to · string · optionnel · previous | baseline
    Optional comparison mode: 'previous' (default) uses the latest Smart Diff snapshot, falling back to the current registered watch state on the first call. 'baseline' uses the fixed Smart Diff baseline, initially seeded from the earliest retained compatible watch snapshot. previous_hash overrides either mode. 'hash' is a result label, not an accepted input value.
  • previous_hash · string · optionnel
    Optional explicit reference hash: 64 hexadecimal characters, case-insensitive, from this same watch's retained Smart Diff snapshot, fixed baseline or retained registration/Check snapshot. Overrides compare_to. Unknown or pruned hashes return 404; recent snapshot history is limited to 20 per store, with the fixed Smart Diff baseline retained separately. Omit for the selected mode.

  Exemple d'appel

  {"name": "fresh402_smart_diff", "arguments": {"watch_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://fresh402.kirilllabs.workers.dev/mcp