io.github.PugarHuda/kawal

Est-ce que io.github.PugarHuda/kawal est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.PugarHuda/kawal » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 9 outils

• agents_by_owner≈ 243 tokens

  List the agents one wallet registered on BSC and call each of their declared endpoints now. Nothing on the chain tells an owner their endpoint went dark — the registry keeps listing it — so this is the answer to "is my agent still answering?": what answered, how each failure looks, and every probe Kawal kept. At most 12 agents are dialled, so a large owner sees the first page.

  Paramètres, retour & exemple (2)

  Paramètres

  • owner · string · requis
    The wallet that minted the registrations: 0x followed by forty hex characters. `address` is accepted as an alias.
  • chainId · number · optionnel
    Chain id. One of 56, 97. Defaults to 56.

  Exemple d'appel

  {"name": "agents_by_owner", "arguments": {"owner": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_payment≈ 208 tokens

  Send the opening request of the x402 protocol — no payment header — and report whether the server actually demands payment. `x402_supported` on the registry is a flag a registration sets about itself; this is the answer to asking. Kawal never settles a payment, so the price is quoted in the server's own words and nothing moves.

  Paramètres, retour & exemple (2)

  Paramètres

  • chainId · number · optionnel
    Chain id. One of 56, 97. Defaults to 56.
  • tokenId · string · requis
    ERC-8004 token id, decimal digits.

  Exemple d'appel

  {"name": "check_payment", "arguments": {"tokenId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• compare_agents≈ 282 tokens

  Put two or three agents side by side and answer the same questions of each — the ones a buyer weighs before handing over a spend cap: can it be hired, does it answer right now, has it kept answering, what does it offer, what does it say it costs, does its domain verify, what is its track record, what is flagged against it, and when it was registered. Each agent is dialled for this call. No combined score: the disagreements are the point.

  Paramètres, retour & exemple (1)

  Paramètres

  • agents · array · requis
    One to 3 agents to compare.

  Exemple d'appel

  {"name": "compare_agents", "arguments": {"agents": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• deep_report≈ 317 tokens

  Everything Kawal holds about one agent in a single answer: the live handshake, the full probe history, how the endpoint fails when it fails, whether it really charges, and who wrote its feedback. This one costs money. Kawal measured that 75 of 200 BSC registrations declare x402 support and that none of the reachable ones ever asks to be paid; this is the counter-example. Calling it without payment returns the terms rather than the report. Pay the terms with a plain BNB transfer and call again with `txHash`; the receipt is read on-chain and spent once.

  Paramètres, retour & exemple (3)

  Paramètres

  • txHash · string · optionnel
    Hash of the BNB transfer that paid the terms: 0x followed by 64 hex characters. Omit to receive the terms.
  • chainId · number · optionnel
    Chain id. One of 56, 97. Defaults to 56.
  • tokenId · string · requis
    ERC-8004 token id, decimal digits.

  Exemple d'appel

  {"name": "deep_report", "arguments": {"tokenId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• find_agents≈ 335 tokens

  Search the BSC roster by describing the problem rather than naming a product, and get back agents ranked with Kawal's evidence attached. Duplicate registrations are collapsed: roughly two thirds of the newest registrations are copies of a template, and returning all of them would be returning the same agent many times. With `trending`, the list is instead what 8004scan's visitors looked at most over that window — attention, not evidence — each entry carrying the tier Kawal's own record gives it, which is where the two disagree.

  Paramètres, retour & exemple (4)

  Paramètres

  • limit · number · optionnel
    How many to return, at most 20.
  • query · string · optionnel
    What you need done, in plain words. Optional when `trending` is given; then it filters the trending list by name or description.
  • chainId · number · optionnel
    Chain id. One of 56, 97. Defaults to 56.
  • trending · string · optionnel · 24h | 7d | 30d
    Return 8004scan's trending agents for this window instead of a search, in the registry's order.

  Exemple d'appel

  {"name": "find_agents", "arguments": {"limit": 1, "query": "texte", "chainId": 1, "trending": "24h"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• plan_mandate≈ 292 tokens

  Turn a capital amount and a duration into the four scoped sessions Kawal would grant on Altana — one per seat, each with its own contract allowlist, spend cap and expiry — without granting anything. Pure arithmetic over the venue table: the same plan the mandate form shows, and the same refusals, since a plan that would widen authority (an unproven venue, an empty allowlist, caps that overcommit) is refused rather than built.

  Paramètres, retour & exemple (3)

  Paramètres

  • days · integer · requis
    How long the mandate runs, in whole days. 1 to 365.
  • chainId · number · optionnel
    Chain id. One of 56, 97. Defaults to 56.
  • capitalUsdt · number · requis
    Capital to entrust, in USDT. Positive, at most 1000000000000.

  Exemple d'appel

  {"name": "plan_mandate", "arguments": {"days": 1, "capitalUsdt": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• read_reputation≈ 211 tokens

  Report who wrote an agent's ERC-8004 feedback, not how much of it there is. A sample of 1,200 BSC records came from 53 addresses, one of which wrote 265 of the oldest 600, so a count of records is a count of writes rather than of opinions. Returns how many carry a mark, how many distinct addresses wrote them, and what share came from the busiest one.

  Paramètres, retour & exemple (2)

  Paramètres

  • chainId · number · optionnel
    Chain id. One of 56, 97. Defaults to 56.
  • tokenId · string · requis
    ERC-8004 token id, decimal digits.

  Exemple d'appel

  {"name": "read_reputation", "arguments": {"tokenId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• uptime_history≈ 217 tokens

  Read the history Kawal keeps of one agent's endpoint without dialling it: how many times it was called, how many times it answered in the protocol it declared, since when, and the median and worst latency of the answering calls. This is the record the registry does not have. Null when Kawal has never called this endpoint; verify_agent makes the first call.

  Paramètres, retour & exemple (2)

  Paramètres

  • chainId · number · optionnel
    Chain id. One of 56, 97. Defaults to 56.
  • tokenId · string · requis
    ERC-8004 token id, decimal digits.

  Exemple d'appel

  {"name": "uptime_history", "arguments": {"tokenId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_agent≈ 212 tokens

  Call an agent's declared endpoint right now and report what answered. This is a live handshake made by Kawal, not a reading of the registry: an agent whose registration declares MCP but whose endpoint is gone is reported as not answering. Returns the hireability tier and the evidence behind it, including how many times Kawal has reached this endpoint before.

  Paramètres, retour & exemple (2)

  Paramètres

  • chainId · number · optionnel
    Chain id. One of 56, 97. Defaults to 56.
  • tokenId · string · requis
    ERC-8004 token id, decimal digits.

  Exemple d'appel

  {"name": "verify_agent", "arguments": {"tokenId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://kawal-three.vercel.app/api/mcp