io.github.withgrokbot/verified-catalog

Est-ce que io.github.withgrokbot/verified-catalog est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.withgrokbot/verified-catalog » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 8 outils

• discover≈ 262 tokens

  Free discovery of x402 pay-per-call endpoints from 402xAgent's weekly crawl. Returns up to 20 endpoints matching the words in q (URL or source list), each with the verified (quoted) price, network, last_checked, stale flag, verdict pay|skip|recheck with its reason, and a receipt. Skips are included by default; pass verdict to filter. A result older than 36 h is stale; a pay older than 7 days is returned as recheck. Run endpoint_spot_check right before paying. Read-only, no auth, 60 calls per minute.

  Paramètres, retour & exemple (3)

  Paramètres

  • q · string · optionnel
    Optional. 2-100 chars; space-separated words that must all appear, e.g. "weather" or "crypto price".
  • limit · integer · optionnel
  • verdict · string · optionnel · pay | skip | recheck
    Optional filter on the (freshness-adjusted) verdict.

  Exemple d'appel

  {"name": "discover", "arguments": {"q": "texte", "limit": 1, "verdict": "pay"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• endpoint_spot_check≈ 647 tokens

  Decision-shaped SSRF-safe 402xAgent check of a public URL for an x402 PAYMENT-REQUIRED / 402 challenge. Every answer has reason_code (stable code) and confidence (high|medium|low); rules: https://402xagent.com/rules.json. History: stable_for_days, last_changed, drift. Free: verdict (pay|skip|recheck), a plain-words reason, payment_terms_sha256 (hash of the approved payment), and access. Paid: verdict, reason code, quoted/claimed price, pay_to, network, asset, and payment = the exact {network, asset, amount_atomic, amount_usd, pay_to} a router may sign (verdict pay only), plus access with the settlement tx. No 402 terms is skip/no_paywall (recheck/free_trial_active when the target sends x-free-trial headers); recheck only for timeouts, 5xx and network errors; wrong or unsupported network, non-canonical USDC or a pay_to that differs from the listing is skip. The same normalized URL + method reuses one probe for 5 min, so consecutive calls agree. mode=dry-run: free dry run (nothing signed or paid, stored as a public receipt, no approval hash, 50/caller/day). Never pays the target (probe GET only). 5 free checks per client per UTC day (at most 25 per network) (client=vc-mcp), then $0.02 USDC a check on Base via x402. Unpaid after free quota: payment instructions. Forward PAYMENT-SIGNATURE for a paid check.

  Paramètres, retour & exemple (8)

  Paramètres

  • ref · string · optionnel
    optional attribution tag stored on the receipt (dry-run-<caller> sets mode=dry-run)
  • url · string · requis
    public http(s) URL to probe
  • mode · string · optionnel · live | dry-run
    optional: dry-run = free dry run: one unpaid probe, nothing signed or paid, always stored as a public receipt (check_type dry-run). Returns the free-tier shape with payment_terms_sha256 null (never an approval). 50 per caller (ref, else client, else IP) per UTC day. ref=dry-run-<caller> also sets it
  • task · string · optionnel
    optional task label (ignored in decision output)
  • method · string · optionnel · GET | POST
    optional: probe the target with POST (empty JSON body) for POST-only endpoints
  • pay_to · string · optionnel
    optional: the wallet you expect to pay (from your listing)
  • network · string · optionnel
    optional: the CAIP-2 network you expect, e.g. eip155:8453
  • claimed_price · number · optionnel
    optional claimed USD price to compare vs quoted

  Exemple d'appel

  {"name": "endpoint_spot_check", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_overnight_cos_pack≈ 134 tokens

  Buy and download the Overnight Chief of Staff Setup Pack ($9 USDC on Base via x402): 5 ready-to-paste bot prompts, an HTML morning-briefing template, and a PDF setup guide. Always paid — no free quota. Call without PAYMENT-SIGNATURE to receive payment requirements and the HTTP endpoint URL. Agents pay by retrying the HTTP endpoint (or this MCP call) with a PAYMENT-SIGNATURE header holding a signed USDC EIP-3009 authorization.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_overnight_cos_pack", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_receipt≈ 197 tokens

  Free: read a public 402xAgent receipt. Give id (sc-... from endpoint_spot_check's receipt_id, or a 10-hex crawl id) or url (latest live + crawl receipt for that URL). Receipts hold the listing URL, the live 402 terms, verdict, reason, reason_code, confidence, history summary, timestamp, and a status-badge embed snippet (badge.markdown / badge.html). Does not run a fresh check (use endpoint_spot_check for that).

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · optionnel
    receipt id
  • url · string · optionnel
    endpoint URL exactly as checked

  Exemple d'appel

  {"name": "get_receipt", "arguments": {"id": "texte", "url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_service≈ 312 tokens

  Fetch the complete catalog record for one known service id (e.g. from search_catalog or lookup results). Use search_catalog to find ids and lookup to rank services for a task; get_service has no per-call receipts, so for receipts with tx and Basescan links call lookup with endpoint=<id>. Read-only. No auth or API key; free, no quota (reads the same catalog snapshot as search_catalog). Returns the record as published: id, name, provider, category, description, endpoint, advertised_price (USD, atomic, asset, network), sample_request, tasks, quality_test (known-answer test, facts_only flag and reason), paid_receipts (count), latest (full last check incl. x402_challenge, error, raw_log_url), history_summary and page_url. Unknown or missing id: error "no service with id ...".

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    Exact, case-sensitive catalog service id as returned by search_catalog or lookup, e.g. "exa-search", "x402tap-weather", "onesource-erc20-balance".

  Exemple d'appel

  {"name": "get_service", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• lookup≈ 624 tokens

  Rank x402 endpoints for a known task at or under a price: "which endpoint should I pay for task X at <= $Y?". Prefer it over search_catalog (keyword browsing, unranked) and get_service (one id's raw record). No auth or API key. Calls the hosted lookup service as client=vc-mcp; all MCP users share that client's 5 free lookups per UTC day (reset 00:00 UTC), after which the tool returns an error reporting the HTTP 402 ($0.02 USDC on Base via x402) and never pays. Returns results sorted by known-answer pass_rate over the last n paid calls, then price, each with price_usd, pass_rate, last_check_at, last_check, stale and receipts (time, tx, basescan_url, charged_usd, delivered, quality); seller-broken services come unsorted under facts_only. No match: empty results, matched 0. Needs task or endpoint; invalid params return an error. Payment never changes results.

  Paramètres, retour & exemple (6)

  Paramètres

  • n · integer · optionnel
    Optional. Most recent paid receipts per service used for pass_rate and returned, 1-20 (default 5; out-of-range values are clamped).
  • task · string · optionnel
    Task name from /v1/tasks, e.g. web-search, crypto-news, news, weather, token-balance, sec-filings, fx-rates, url-check. Case-insensitive; a known name matches exactly, an unknown one falls back to matching every word in service text. Required unless endpoint is given.
  • limit · integer · optionnel
    Optional. Maximum ranked services in results, 1-20 (default 10; clamped). facts_only is not limited.
  • payer · string · optionnel
    Optional 0x wallet address (40 hex characters), recorded so a later payment from it to a returned vendor can be matched on-chain. Nothing is charged; a malformed address returns an error.
  • endpoint · string · optionnel
    A catalog service id (e.g. exa-search) or endpoint URL, to get one service's receipts instead of a whole task. Required unless task is given; can be combined with task.
  • max_price_usd · number · optionnel
    Optional. Only services whose listed price per call is at or below this many USD, e.g. 0.01. Negative values are rejected.

  Exemple d'appel

  {"name": "lookup", "arguments": {"n": 1, "task": "texte", "limit": 1, "payer": "texte", "endpoint": "texte", "max_price_usd": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• payment_status≈ 316 tokens

  After you pay an x402 endpoint (Base USDC, EIP-3009 exact): did the payment land, and is it safe to sign a new one? Give payment_payload (the base64 PAYMENT-SIGNATURE you sent), or tx_hash, or from + nonce (+ valid_before). Returns status landed|not_landed|pending|canceled|unknown, safe_to_retry_same_payload (always true: a nonce is single-use), safe_to_resign (true only when two independent RPC sources agree the nonce is unused AND validBefore has passed), tx details, terms match, a claim pointer and a signed receipt. Same 5 free per UTC day as endpoint_spot_check (client=vc-mcp), then $0.02 USDC on Base via x402 (forward PAYMENT-SIGNATURE).

  Paramètres, retour & exemple (6)

  Paramètres

  • from · string · optionnel
  • nonce · string · optionnel
  • tx_hash · string · optionnel
  • seller_url · string · optionnel
    the URL you paid
  • valid_before · string · optionnel
    unix seconds (with from + nonce)
  • payment_payload · string · optionnel
    base64 PAYMENT-SIGNATURE / X-PAYMENT value of the payment you sent

  Exemple d'appel

  {"name": "payment_status", "arguments": {"from": "texte", "nonce": "texte", "tx_hash": "texte", "seller_url": "texte", "valid_before": "texte", "payment_payload": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_catalog≈ 512 tokens

  Browse or keyword-search the verified catalog of pay-per-call (x402) agent services. Use it when you don't know the task name or want to see what exists; use lookup to rank endpoints for a known task at a max price, and get_service for one id's full record. Read-only. No auth or API key; free, no quota or per-client limit: it only reads the catalog snapshot (bundled catalog.json in the local server, the published catalog.json on remote /mcp). Returns {count, results, generated_at, note, methodology_url}; results are in catalog order, ungraded, each with id, name, category, endpoint, advertised_price_usd, page_url and latest (checked_at, reachable, http_status, latency_ms, quoted_price_usd, price_matches_listing, charged_price_usd, delivered_valid, raw_log_url). No match: count 0, empty results. A non-numeric max_price_usd or limit returns an error.

  Paramètres, retour & exemple (5)

  Paramètres

  • limit · integer · optionnel
    Optional. Maximum number of results, 1-100 (default 20).
  • query · string · optionnel
    Optional. Space-separated words; every word must appear (case-insensitive) in the service id, name, category, description or provider. Omit to list all. Examples: "search", "crypto news".
  • category · string · optionnel
    Optional. Case-insensitive substring of the service category, e.g. "web search", "news", "on-chain data", "weather", "public records", "utility".
  • max_price_usd · number · optionnel
    Optional. Keep services whose advertised price per call is at or below this many USD, e.g. 0.01.
  • reachable_only · boolean · optionnel
    Optional (default false). If true, keep only services that were reachable in the latest check.

  Exemple d'appel

  {"name": "search_catalog", "arguments": {"limit": 1, "query": "texte", "category": "texte", "max_price_usd": 1, "reachable_only": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://api.402xagent.com/mcp