io.github.ShoonEnterprises/shoon-a2a-sandbox

Est-ce que io.github.ShoonEnterprises/shoon-a2a-sandbox est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.ShoonEnterprises/shoon-a2a-sandbox » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 5 outils

• citation_audit≈ 469 tokens

  Audit the citations in a document you are drafting, reviewing, or fact-checking — catch dead links and misquotes before your principal sees them. For each citation it fetches the URL over plain HTTPS and reports the HTTP status, content type, and whether the quoted text appears verbatim in the fetched page. It does not judge argument quality, and paywalled or JavaScript-heavy pages may fetch without matching. Up to 25 citations per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

  Paramètres, retour & exemple (2)

  Paramètres

  • input · object · optionnel
  • quote_id · string · optionnel
    Advanced machine flow: a quote_id from POST /quote for this service. When given, the quote's input is used and the X-PAYMENT header must authorize that quote. Not needed during the free testing phase — pass arguments.input directly instead. Human flow (X-API-KEY): pass input.

  Exemple d'appel

  {"name": "citation_audit", "arguments": {"input": {}, "quote_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• claim_verification≈ 525 tokens

  Before you rely on a claim — or repeat it to your principal — check it against its cited sources. Give this service the claim plus the sources and quoted text your principal provided; it fetches each source URL over plain HTTPS and reports the HTTP status and whether the quoted text appears verbatim in the page. It checks evidence presence, not underlying truth: 'supported' means your quote was found in the source, and anything it cannot check is marked 'unverified', never 'contradicted'. Up to 10 claims with up to 5 sources each per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

  Paramètres, retour & exemple (2)

  Paramètres

  • input · object · optionnel
  • quote_id · string · optionnel
    Advanced machine flow: a quote_id from POST /quote for this service. When given, the quote's input is used and the X-PAYMENT header must authorize that quote. Not needed during the free testing phase — pass arguments.input directly instead. Human flow (X-API-KEY): pass input.

  Exemple d'appel

  {"name": "claim_verification", "arguments": {"input": {}, "quote_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• news_tripwire≈ 469 tokens

  Watch a public page or feed for the keywords your principal cares about — a competitor name, a token symbol, a topic. Register the watch once, then check on demand: the service fetches the URL over plain HTTPS and reports per-keyword match counts with snippet context. Checks run when you ask (no background scheduler in the pilot); it reports keyword presence, not news judgement. Up to 20 keywords per tripwire. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

  Paramètres, retour & exemple (2)

  Paramètres

  • input · object · optionnel
  • quote_id · string · optionnel
    Advanced machine flow: a quote_id from POST /quote for this service. When given, the quote's input is used and the X-PAYMENT header must authorize that quote. Not needed during the free testing phase — pass arguments.input directly instead. Human flow (X-API-KEY): pass input.

  Exemple d'appel

  {"name": "news_tripwire", "arguments": {"input": {}, "quote_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• proof_of_work_audit≈ 503 tokens

  When someone claims work was done — a deliverable shipped, a deployment live, a report published — check the evidence before you report back to your principal. Give it the work claim plus evidence URLs and the text you expect to find; it fetches each URL over plain HTTPS and reports whether it resolves and whether the expected text appears. It checks evidence presence, never that the work actually happened — results are honestly labeled as evidence-resolution checks. Up to 10 evidence items per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

  Paramètres, retour & exemple (2)

  Paramètres

  • input · object · optionnel
  • quote_id · string · optionnel
    Advanced machine flow: a quote_id from POST /quote for this service. When given, the quote's input is used and the X-PAYMENT header must authorize that quote. Not needed during the free testing phase — pass arguments.input directly instead. Human flow (X-API-KEY): pass input.

  Exemple d'appel

  {"name": "proof_of_work_audit", "arguments": {"input": {}, "quote_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• structured_extraction≈ 415 tokens

  Turn messy text or a web page into structured data — headings, links, tables, word counts — without spending your own context window on parsing. Deterministic heuristics only: no LLM, no semantic understanding, fully reproducible output, plainly labeled as heuristic. It extracts structure, not meaning. Pass raw text (up to 100,000 characters) or a URL. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

  Paramètres, retour & exemple (2)

  Paramètres

  • input · object · optionnel
  • quote_id · string · optionnel
    Advanced machine flow: a quote_id from POST /quote for this service. When given, the quote's input is used and the X-PAYMENT header must authorize that quote. Not needed during the free testing phase — pass arguments.input directly instead. Human flow (X-API-KEY): pass input.

  Exemple d'appel

  {"name": "structured_extraction", "arguments": {"input": {}, "quote_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://shoon-a2a-sandbox.onrender.com/mcp