io.github.PulseBet/pulse-verity

Est-ce que io.github.PulseBet/pulse-verity est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.PulseBet/pulse-verity » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 9 outils

• get_account_status≈ 684 tokens

  Read this connection's Pulse Verity plan and usage from /api/index/v1/account: plan, used (calls counted this UTC month), limit, remaining, resetAt, perMinute, batchMaxSymbols, capacityAction and upgradeUrl (the plans page). The monthly allowance is account-wide: every key and connected app on the account shares it. perMinute applies to each key. This call does not count toward the allowance.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_account_status", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"plan": "texte", "used": 1, "error": {}, "limit": 1, "resetAt": "texte", "success": true, "perMinute": "texte", "remaining": 1, "requestId": "texte", "upgradeUrl": "texte", "capacityAction": "review_plans", "batchMaxSymbols": "texte"}}

• get_index_batch≈ 1528 tokens

  Read signed prices for up to 100 symbols per request; this account's plan may allow fewer (get_account_status reports batchMaxSymbols). One /api/index/v1/batch request returns observations with individually signed successful rows and per-symbol errors for unavailable rows. A request over the plan's limit is refused with code TOO_MANY_SYMBOLS: split it. Verify each successful row with verify_print; the v2 block on each row signs its quality fields, while the surrounding batch metadata is not signed. No automatic retries.

  Paramètres, retour & exemple (1)

  Paramètres

  • symbols · array · requis

  Exemple d'appel

  {"name": "get_index_batch", "arguments": {"symbols": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "success": true, "returned": 1, "requestId": "texte", "requested": 1, "observations": []}}

• get_index_history≈ 1230 tokens

  Read price history for one crypto symbol from /api/index/v1/history: candles (open, high, low, close) at 1m, 5m, 1h or 1d, with period metrics and pagination. dataset=verified (default) is built from prints Pulse signed live; reconstructed is rebuilt history at 1h or 1d and was not signed at the historical time. The account's plan sets whether history is included and how far back a request reaches: rangeClamped says the window was shortened, and historyLimit names the plan when the plan did it. Each call counts as one API call. For the next page pass pagination.nextCursor as cursor with the same symbol, dataset and interval. Signed rows (verifiedObservations) are returned only with includeSignedRows=true; each verifies with verify_print. Candles and metrics are not signed. An empty page means no recorded history in that window, never a zero price.

  Paramètres, retour & exemple (9)

  Paramètres

  • to · ? · optionnel
    End, ISO-8601 or epoch milliseconds (13 digits); now when omitted.
  • from · string · optionnel
    Start, ISO-8601 or epoch milliseconds (13 digits); 30 days before `to` when omitted. The plan may shorten it.
  • limit · integer · optionnel
    Underlying points per page, 1 to 1000; 500 when omitted.
  • cursor · string · optionnel
    pagination.nextCursor from the previous page, unchanged.
  • symbol · string · requis
    Crypto ticker symbol, e.g. BTC
  • assetId · string · optionnel
    Canonical asset id, when a ticker names more than one asset.
  • dataset · string · optionnel · verified | reconstructed
    verified (default): built from prints Pulse signed live. reconstructed: rebuilt hourly and daily history, not signed at the historical time; interval 1h or 1d only.
  • interval · string · optionnel · 1m | 5m | 1h | 1d
    Candle width; 1h when omitted.
  • includeSignedRows · boolean · optionnel
    Include verifiedObservations, each a signed row verify_print checks (verified dataset only). Off by default to keep pages small.

  Exemple d'appel

  {"name": "get_index_history", "arguments": {"symbol": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"to": "texte", "from": "texte", "error": {}, "symbol": "texte", "candles": [], "dataset": "texte", "success": true, "interval": "texte", "requestId": "texte", "pagination": {}, "rangeClamped": true, "signedRowsOmitted": 1}}

• get_index_price≈ 1243 tokens

  Get a current signed crypto index price from /api/index/v1/price. Returns symbol, price, optional priceText, at, grade, signature, kid and sig. Preserve priceText exactly for verify_print. Optional tier, confidence, dispersionBps, interval, sources, engine and cadence describe the observation; they are not covered by the v1 signature, and the v2 block signs them with the price. Pass the whole print, v2 included, to verify_print. Coverage changes: use list_index_assets to discover assets. A stale or unavailable response means no current price, never zero.

  Paramètres, retour & exemple (1)

  Paramètres

  • symbol · string · requis
    Crypto ticker symbol, e.g. BTC, ETH, SOL

  Exemple d'appel

  {"name": "get_index_price", "arguments": {"symbol": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"at": "texte", "v2": {}, "kid": "texte", "sig": "texte", "note": "texte", "tier": "texte", "error": {}, "grade": "consensus", "price": 1, "engine": "texte", "getKey": "texte", "sample": true}}

• get_recorded_print≈ 1332 tokens

  Get the recorded signed index print nearest a requested time from /api/index/v1/print. Accepts ISO-8601 or epoch milliseconds. Check deltaMs: it is the distance between your requested time and the sampled print. Sampling and retention are bounded; a recorded print need not equal a separate live read. qualityRecorded says whether its quality fields were stored when it was recorded (prints from 1 Oct 2026). Preserve priceText, kid and the v2 block when present for verify_print. deltaMs is not signed. Formerly named get_settlement_print; calls under that name still work.

  Paramètres, retour & exemple (2)

  Paramètres

  • at · string · requis
  • symbol · string · requis
    Crypto ticker symbol, e.g. BTC, ETH, SOL

  Exemple d'appel

  {"name": "get_recorded_print", "arguments": {"at": "texte", "symbol": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"at": "texte", "v2": {}, "kid": "texte", "sig": "texte", "kind": "texte", "note": "texte", "tier": "texte", "error": {}, "grade": "consensus", "price": 1, "engine": "texte", "getKey": "texte"}}

• get_upgrade_options≈ 1002 tokens

  List the Pulse Verity plans with their limits and prices, and the prepaid call packs and extra stream connections while each is on sale, each with a portal link. Read-only; does not count toward the allowance. The current plan is marked when the account is on that plan's terms (currentPlan shows the account's own limits either way), and when a recent plan refusal is known (or reason is given) the smallest plan, add-on or pack that fixes it is recommended. A link opens the portal, which shows the item, price and terms; the account holder completes payment on Stripe. Nothing is bought by this tool or by opening a link.

  Paramètres, retour & exemple (3)

  Paramètres

  • reason · string · optionnel · MONTHLY_LIMIT | RATE_LIMITED | TOO_MANY_SYMBOLS | BATCH_TOO_LARGE | RESEARCH_NOT_INCLUDED | SYMBOL_LIMIT | SOURCE_HEALTH_NOT_INCLUDED | WEBHOOKS_NOT_INCLUDED
    A refusal code this connection received, e.g. TOO_MANY_SYMBOLS or MONTHLY_LIMIT, when it is not the most recent one.
  • dataset · string · optionnel · verified | reconstructed
    For HISTORY_WINDOW: the history dataset that was shortened; verified (the get_index_history default) when omitted.
  • feature · string · optionnel · history | research-tools
    For RESEARCH_NOT_INCLUDED: history when get_index_history was refused, research-tools for compare or metadata; when omitted, the plan that includes both.

  Exemple d'appel

  {"name": "get_upgrade_options", "arguments": {"reason": "MONTHLY_LIMIT", "dataset": "verified", "feature": "history"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "plans": [], "success": true, "checkout": {}, "currency": "texte", "requestId": "texte", "currentPlan": "texte", "pricingVersion": "2026-10", "recommendation": "texte"}}

• list_index_assets≈ 1146 tokens

  Read one bounded page from /api/index/v1/verity/catalog. Discover crypto symbols and their current coverage status and measured cadence. Catalog rows, prices and metadata are unsigned: use get_index_price or get_index_batch for signed receipts. Availability changes; total is a catalog count, not a count of fresh prices. No automatic pagination.

  Paramètres, retour & exemple (4)

  Paramètres

  • band · string · optionnel · real-time | five-second | ten-second | slow | unavailable
  • limit · integer · optionnel
    Rows per page, 1 to 100; 50 when omitted. A plan may return fewer: use count and offset.
  • offset · integer · optionnel
  • status · string · optionnel · consensus | blended | indicative | insufficient-coverage | venue-disagreement | unconvertible-quote | stale | kernel-rejected

  Exemple d'appel

  {"name": "list_index_assets", "arguments": {"band": "real-time", "limit": 1, "offset": 1, "status": "consensus"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"note": "texte", "rows": [], "bands": [], "count": 1, "error": {}, "total": 1, "engine": "texte", "requestId": "texte"}}

• submit_verity_feedback≈ 936 tokens

  Write one structured bug, missing capability, or data quality report for private human triage. Only submit when the user requests reporting; do not include keys, passwords, transcripts or attachments. Returns a durable receipt and duplicate flag, not a promise of a fix. No code or production behavior changes automatically. Status is available with the same account at GET /api/index/v1/feedback/<id>.

  Paramètres, retour & exemple (8)

  Paramètres

  • actual · string · requis
  • symbol · string · optionnel
  • surface · string · requis · get_index_price | get_index_batch | list_index_assets | get_recorded_print | get_settlement_print | verify_print | /api/index/v1/price | /api/index/v1/batch
  • category · string · requis · bug | missing_capability | data_quality
  • expected · string · requis
  • requestId · string · optionnel
  • observedAt · string · optionnel
  • reproduction · array · requis

  Exemple d'appel

  {"name": "submit_verity_feedback", "arguments": {"actual": "texte", "surface": "get_index_price", "category": "bug", "expected": "texte", "reproduction": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "success": true, "feedback": {}, "duplicate": true, "requestId": "texte"}}

• verify_print≈ 1920 tokens

  Verify a signed print locally with ECDSA P-256/SHA-256. Canonical bytes are pulse-index-v1\n<symbol>\n<priceText or String(price)>\n<at>\n<grade>. The public key ring is read from /api/index/v1/pubkey, cached for five minutes and refreshed at most once per 30 seconds on a failed check. A supplied kid selects only that exact key; old prints without kid are tried against the bounded published ring. valid=true authenticates only the canonical price fields, not kid, sig, quality, cadence, timestamps outside at, or other metadata. When the print carries a v2 block (pulse-index-v2), it is verified too: v2.valid=true means the signature over v2.canonical is valid AND every signed line (sources, tier, confidence, dispersionBps, interval, cadence, engine, price and the rest) matches the supplied fields; v2.signedFields are the signed values and v2.mismatches names any field that differs. recordValid=true and verificationScope=full-record require BOTH price and complete v2 record verification. metadataSigned equals recordValid. Require recordValid before trusting quality fields. A v1-only print has scope price-only, never verified metadata. Neither signature proves freshness or settlement suitability; indicative data must not be used for settlement. An invalid signature can mean an altered print or a key no longer published; it does not by itself prove tampering.

  Paramètres, retour & exemple (19)

  Paramètres

  • at · string · requis
    Timestamp from the print, unchanged
  • v2 · object · optionnel
    The v2 block from the print, unchanged: it signs the whole record, quality fields included
  • kid · string · optionnel
    Signing key identifier, when provided by the API
  • sig · string · optionnel
  • kind · string · optionnel
  • tier · ? · optionnel
  • grade · string · requis
  • price · ? · requis
  • engine · ? · optionnel
  • symbol · string · requis
    Crypto ticker symbol, e.g. BTC, ETH, SOL
  • assetId · ? · optionnel
  • cadence · ? · optionnel
  • sources · ? · optionnel
  • closeDay · ? · optionnel
  • interval · ? · optionnel
  • priceText · ? · optionnel
    Exact signed price text, when provided by the API; preserve unchanged
  • signature · string · requis
    ECDSA P-256 signature in base64
  • confidence · ? · optionnel
  • dispersionBps · ? · optionnel

  Exemple d'appel

  {"name": "verify_print", "arguments": {"at": "texte", "grade": "texte", "price": "texte", "symbol": "texte", "signature": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"v2": "texte", "error": {}, "valid": true, "checked": "texte", "keySource": "texte", "requestId": "texte", "recordValid": true, "metadataSigned": true, "verifiedWithKid": "texte", "verificationScope": "full-record"}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mcp.thepulse.markets/api/index/mcp