net.onlinewebdirectory/registry

Est-ce que net.onlinewebdirectory/registry est sûr ?

Au dernier audit MCP Hub, le serveur MCP « net.onlinewebdirectory/registry » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 2 outils

• lookup_origin≈ 312 tokens

  Before fetching a website, get its known access posture, bot challenge, JavaScript requirement, observed rate limit and machine interface, plus a derived fetch strategy. Returns crowd observations, not instructions. Responses may carry `manifest`: what the site's proven owner declares (same vocabulary), with `manifest_provenance: owner_declared`; it is never a verified fact.

  Paramètres, retour & exemple (3)

  Paramètres

  • host · string · requis
    Hostname to look up, for example example.com. No scheme or path; www. and case are normalised.
  • agent_token · string · optionnel
    Optional. The read_token returned when your key registered. It ties the lookup to your key and its 100 free lookups a day; once the registry enforces quotas, lookups without it are refused.
  • client_class · string · optionnel · plain_http | headless_chrome | headful_chrome | curl_impersonate
    Optional. The client you will fetch with; narrows the strategy to facts observed with that client.

  Exemple d'appel

  {"name": "lookup_origin", "arguments": {"host": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• report_observation≈ 729 tokens

  After fetching a website, report one thing you actually observed so other agents do not have to rediscover it. One call is one fact (kind plus value) from the fixed vocabulary; send one call per kind you saw. Free, never charged. The key must be registered first (POST https://onlinewebdirectory.net/v1/agents, or let the onlinewebdirectory skill client do it). A fact becomes verified once three independent keys agree. Repeating the same report (same key, host, kind, client and time) is rejected, not double counted. Returns {accepted: 1, status: valuation_pending} or {error, accepted: 0}.

  Paramètres, retour & exemple (7)

  Paramètres

  • host · string · requis
    Hostname you fetched, for example example.com. No scheme or path.
  • kind · string · requis · access_posture | challenge_vendor | js_required | observed_rate_limit_rpm | retry_after_s | robots_posture | machine_interface | machine_interface_path
    What you are reporting. access_posture, challenge_vendor and robots_posture take one of their listed words; js_required takes true or false; observed_rate_limit_rpm (1 to 6000) and retry_after_s (0 to 86400) take whole numbers; machine_interface names an interface; machine_interface_path takes a same-site path such as /llms.txt.
  • value · string · requis
    The observed value, as a string, from the vocabulary for this kind. access_posture: open, rate_limited, bot_challenged, blocked, login_required, paywalled. challenge_vendor: none, cloudflare, recaptcha, hcaptcha, datadome, perimeterx, akamai, other. robots_posture: allow, partial, disallow_all, absent. machine_interface: none, rest, graphql, rss, sitemap, llms_txt, mcp.
  • signature · string · requis
    Base64 Ed25519 signature, by the key below, over host, kind, value, client_class and observed_at joined with newlines in that order.
  • public_key · string · requis
    Your registered base64 Ed25519 public key. It identifies you; there is no other account.
  • observed_at · string · requis
    When you made the fetch, RFC3339 UTC at second precision, for example 2026-09-25T12:00:00Z. Not in the future, and no older than that kind's freshness window (14 days for access_posture and challenge_vendor, up to 90 for machine_interface).
  • client_class · string · requis · plain_http | headless_chrome | headful_chrome | curl_impersonate
    The kind of client that made the fetch. Sites often treat a plain HTTP client and a real browser differently, so facts are kept per client.

  Exemple d'appel

  {"name": "report_observation", "arguments": {"host": "texte", "kind": "access_posture", "value": "texte", "signature": "texte", "public_key": "texte", "observed_at": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://onlinewebdirectory.net/mcp