page.deed/deed-page

Est-ce que page.deed/deed-page est sûr ?

Au dernier audit MCP Hub, le serveur MCP « page.deed/deed-page » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 23 outils

• add_domain≈ 258 tokens

  Attaches a hostname to a slug owned by the token and returns the DNS records to create: a CNAME for a subdomain, an A record or an ALIAS record for an apex (one of those, not both), and every TXT record. Inputs: slug, domain, and token. Status starts at pending_dns until DNS and the certificate are ready. Free allows 1 hostname, Hobby 3, Pro 20. deed.page names are rejected.

  Paramètres, retour & exemple (3)

  Paramètres

  • slug · string · requis
    Slug you own.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.
  • domain · string · requis
    Hostname to attach, such as docs.example.com or example.com. No scheme or path.

  Exemple d'appel

  {"name": "add_domain", "arguments": {"slug": "texte", "domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_webhook≈ 302 tokens

  Registers an http or https URL for the events site.published, site.version_restored, site.deleted, site.taken_down, domain.active, and report.received. Inputs: url, optional events, and token. Returns the webhook id and an HMAC secret once. Free allows 1 webhook, Hobby 5, Pro 20. Private, internal, and localhost targets are rejected. Delivery is best-effort, with up to 3 attempts. API documentation: https://deed.page/docs.

  Paramètres, retour & exemple (3)

  Paramètres

  • url · string · requis
    Public http or https URL on port 80 or 443.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.
  • events · array · optionnel
    Events to send. Omit for all of them.

  Exemple d'appel

  {"name": "create_webhook", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• delete_site≈ 160 tokens

  Permanently removes a slug owned by the token and detaches its custom hostnames. The slug becomes available again. Inputs: slug and token.

  Paramètres, retour & exemple (2)

  Paramètres

  • slug · string · requis
    Slug you own.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.

  Exemple d'appel

  {"name": "delete_site", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• delete_webhook≈ 142 tokens

  Deletes one webhook. Inputs: id (whk_...) and token.

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis
    Webhook id (whk_...).
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.

  Exemple d'appel

  {"name": "delete_webhook", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• domain_status≈ 227 tokens

  Returns the verification status of a custom domain and refreshes verification, DNS config, and certificate state. Inputs: slug, domain, and token. status is pending_dns, verifying, issuing_cert, active, or error. dns_records are the records to create. An error includes the reason.

  Paramètres, retour & exemple (3)

  Paramètres

  • slug · string · requis
    Slug the hostname is attached to.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.
  • domain · string · requis
    Hostname to check.

  Exemple d'appel

  {"name": "domain_status", "arguments": {"slug": "texte", "domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• finalize_upload≈ 276 tokens

  Checks uploaded hashes, screens the new bytes, and commits one version under the slug lock. Inputs: session (upl_...), optional expected_version, via, and token. A stale expected_version returns version_conflict and writes nothing. A bad hash returns hash_mismatch. An expired session returns session_expired.

  Paramètres, retour & exemple (4)

  Paramètres

  • via · string · optionnel
    Optional label stored with the publish. At most 80 characters. An IP address, a URL, or an email address is not stored. A non-empty value replaces the X-Via header.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.
  • session · string · requis
    Upload session id (upl_...).
  • expected_version · string · optionnel

  Exemple d'appel

  {"name": "finalize_upload", "arguments": {"session": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_manifest≈ 206 tokens

  Returns the canonical manifest for a site version: paths, sha256, sizes, version, slug, and created_at, plus an Ed25519 signature. signature is null when the server has no signing key. Inputs: slug, and optional version. When version is omitted, the result is the live site. Public keys are published at /.well-known/deed-signing-keys.json. No token is required.

  Paramètres, retour & exemple (2)

  Paramètres

  • slug · string · requis
  • version · string · optionnel
    Optional retained version, such as "v2". Omit for the live version.

  Exemple d'appel

  {"name": "get_manifest", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_site≈ 107 tokens

  Returns whether a slug is live, plus its URL, version, size, and timestamps. Input: slug. No token is required.

  Paramètres, retour & exemple (1)

  Paramètres

  • slug · string · requis
    Slug to look up.

  Exemple d'appel

  {"name": "get_site", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_upgrade_link≈ 188 tokens

  Returns a Stripe Checkout URL for the Hobby plan ($3/mo) or the Pro plan ($15/mo), tied to the token. Inputs: plan (hobby or pro) and token. The call does not charge; payment happens on the returned Checkout page.

  Paramètres, retour & exemple (2)

  Paramètres

  • plan · string · requis · hobby | pro
    Plan to buy.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.

  Exemple d'appel

  {"name": "get_upgrade_link", "arguments": {"plan": "hobby"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_domains≈ 176 tokens

  Returns custom hostnames on one slug, or on every site the token owns when slug is omitted. Inputs: token, and optional slug. Status is the last checked value.

  Paramètres, retour & exemple (2)

  Paramètres

  • slug · string · optionnel
    Optional slug you own. Omit to list every hostname on this token.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.

  Exemple d'appel

  {"name": "list_domains", "arguments": {"slug": "texte", "token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_sites≈ 128 tokens

  Returns every live site owned by the token, with URLs and versions. Input: token, or an Authorization bearer header.

  Paramètres, retour & exemple (1)

  Paramètres

  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.

  Exemple d'appel

  {"name": "list_sites", "arguments": {"token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_versions≈ 201 tokens

  Returns every retained version of a slug owned by the token, newest first. Inputs: slug and token. Each entry includes version, created_at, file_count, bytes, kind (publish, merge, or restore), restored_from, and a public permalink. Free keeps 10 versions, Hobby 50, Pro unlimited.

  Paramètres, retour & exemple (2)

  Paramètres

  • slug · string · requis
    Slug you own.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.

  Exemple d'appel

  {"name": "list_versions", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_webhooks≈ 128 tokens

  Returns the webhook URLs registered for the token. Secrets are not included. Input: token.

  Paramètres, retour & exemple (1)

  Paramètres

  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.

  Exemple d'appel

  {"name": "list_webhooks", "arguments": {"token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• plan_upload≈ 440 tokens

  Accepts a file manifest and returns which hashes are already stored, a direct upload URL for each missing hash, and a session id. Inputs: files as {path, sha256, size, content_type?}, and optional slug, spa, merge, ttl_seconds, expected_version, via, and token. Applies when the files are larger than about 4 MB, or when each sha256 is already known. Does not publish by itself. Per-site size limits are unchanged.

  Paramètres, retour & exemple (8)

  Paramètres

  • spa · boolean · optionnel
  • via · string · optionnel
    Optional label stored with the publish. At most 80 characters. An IP address, a URL, or an email address is not stored. A non-empty value replaces the X-Via header.
  • slug · string · optionnel
    Exact slug, or omit for a random one.
  • files · array · requis
    Manifest entries. sha256 is 64 lowercase hex characters. size is the byte length.
  • merge · boolean · optionnel
    Overlay these paths on the live site.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.
  • ttl_seconds · integer · optionnel
  • expected_version · string · optionnel
    Live version this upload must match, such as "v3".

  Exemple d'appel

  {"name": "plan_upload", "arguments": {"files": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• publish_site≈ 786 tokens

  Publishes files to a live permanent URL at a slug. Inputs: files (required), and optional slug, spa, ttl_seconds, merge, expected_version, via, and token. Paths are stored exactly. Returns url, path_url, slug, version, and token on the first anonymous publish. On deed.page, url and path_url are both https://{slug}.deed.page/. A lost token has no recovery unless an optional recovery email was attached. When expected_version does not match the live version, the result is version_conflict and nothing is written. A racing publish of the same slug returns version_conflict even without expected_version. Malware, executables, and credential-harvesting pages return content_rejected and are not stored. .bin is blocked by file type (it often has no MZ or ELF header). A raw octet-stream body is screened as one file.

  Paramètres, retour & exemple (8)

  Paramètres

  • spa · boolean · optionnel
    Serve index.html for unknown paths (single-page apps).
  • via · string · optionnel
    Optional label stored with the publish. At most 80 characters. An IP address, a URL, or an email address is not stored. A non-empty value replaces the X-Via header.
  • slug · string · optionnel
    Exact slug matching ^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$ (lowercase letters, digits, hyphens, 1-63, no leading or trailing hyphen). Invalid slugs return slug_invalid and are not rewritten. Reserved names (hello, my-page, www, api, docs, admin, mcp, blog, app, status, and other docs examples) return slug_reserved on a new claim. A token that already owns one can still update it. Omit for a random slug.
  • files · object · requis
    Path map, or an array of {path, content} or {path, base64}. Paths are stored exactly as given (a single top-level directory is not removed). Text as a string, binary as {"base64":"..."}. Example: {"index.html":"<!doctype html><h1>Hi</h1>","img/logo.png":{"base64":"iVBOR..."}}. Any other array is rejected.
  • merge · boolean · optionnel
    Add or overwrite only these exact paths on the existing site. Paths omitted from this call are left unchanged. Nothing is moved to the site root.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.
  • ttl_seconds · integer · optionnel
    Opt-in expiry in seconds. Omit for a permanent site.
  • expected_version · string · optionnel
    Live version this write is based on, such as "v3". If the slug is no longer at that version, the result is version_conflict and nothing is written. A racing publish of the same slug returns version_conflict even when this is omitted.

  Exemple d'appel

  {"name": "publish_site", "arguments": {"files": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• remove_domain≈ 207 tokens

  Removes a hostname so requests to that host no longer serve the site. Inputs: domain, optional slug, and token. When slug is set, the hostname must already be attached to that slug.

  Paramètres, retour & exemple (3)

  Paramètres

  • slug · string · optionnel
    Optional slug. When set, the hostname must be attached to that slug.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.
  • domain · string · requis
    Hostname to remove.

  Exemple d'appel

  {"name": "remove_domain", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• restore_version≈ 278 tokens

  Creates a new version whose files equal a retained version, without uploading those files again. Inputs: slug, version, optional expected_version, and token. When expected_version does not match the live version, the result is version_conflict and nothing is written. The previous permalink keeps serving until retention drops it.

  Paramètres, retour & exemple (4)

  Paramètres

  • slug · string · requis
    Slug you own.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.
  • version · string · requis
    Version to copy forward, such as "v2".
  • expected_version · string · optionnel
    Live version this restore is based on, such as "v4". A mismatch returns version_conflict.

  Exemple d'appel

  {"name": "restore_version", "arguments": {"slug": "texte", "version": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• revoke_token≈ 248 tokens

  Revokes owner tokens. Inputs: token, and optional scope. Scope "current" (the default) revokes the token that was sent. Scope "all" revokes every token for that principal, including any overlap window. A later request with a revoked token returns 401 token_revoked, which is distinct from 403 suspended. Sites stay online. Without a recovery email, a revoked token cannot update them.

  Paramètres, retour & exemple (2)

  Paramètres

  • scope · string · optionnel · current | all
    current revokes only this token. all revokes every token for the principal. Default current.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.

  Exemple d'appel

  {"name": "revoke_token", "arguments": {"scope": "current", "token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• rotate_token≈ 254 tokens

  Issues a new token for the same principal. Every site carries over. Inputs: token, and optional overlap_seconds from 0 to 300. The previous token stops working immediately when overlap_seconds is omitted or 0. During a non-zero overlap window both tokens work. After that window the previous token returns 401 token_revoked. The new token is returned once.

  Paramètres, retour & exemple (2)

  Paramètres

  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.
  • overlap_seconds · integer · optionnel
    Seconds the previous token keeps working so an in-flight deploy can finish. Omit or 0 to invalidate it immediately. Maximum 300.

  Exemple d'appel

  {"name": "rotate_token", "arguments": {"token": "texte", "overlap_seconds": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• set_site_access≈ 267 tokens

  Changes the access setting stored for a slug on deed.page. Inputs: slug, password, and token. password is 8 to 200 characters, or null to clear the password. The call writes a scrypt hash into the site record on deed.page, or removes that hash, and contacts no outside system. Setting a password is available on Hobby and Pro; Free returns plan_required. Clearing is allowed on every plan.

  Paramètres, retour & exemple (3)

  Paramètres

  • slug · string · requis
    Slug you own.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.
  • password · string|null · requis
    New password, or null to clear the password and make the site public.

  Exemple d'appel

  {"name": "set_site_access", "arguments": {"slug": "texte", "password": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• site_analytics≈ 256 tokens

  Returns owner-only cookieless counts for a slug: views per UTC day, top paths, top referrer hosts, and AI crawler counts by user-agent family. Inputs: slug, optional from and to as YYYY-MM-DD (default the last 7 days, maximum 90), and token. The accuracy field describes under-counting. No raw IP or full user agent is stored.

  Paramètres, retour & exemple (4)

  Paramètres

  • to · string · optionnel
    Last UTC day, YYYY-MM-DD. Default is today.
  • from · string · optionnel
    First UTC day, YYYY-MM-DD. Default is 6 days before to.
  • slug · string · requis
    Slug you own.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.

  Exemple d'appel

  {"name": "site_analytics", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_site≈ 562 tokens

  Replaces the files of a slug owned by the token, or, when merge is true, adds and overwrites only the paths sent. Inputs: slug, files, and optional spa, merge, expected_version, via, and token. Returns url, path_url, slug, and a new version. When expected_version does not match the live version, the result is version_conflict and nothing is written. Two racing updates return version_conflict even without expected_version.

  Paramètres, retour & exemple (7)

  Paramètres

  • spa · boolean · optionnel
    Serve index.html for unknown paths.
  • via · string · optionnel
    Optional label stored with the publish. At most 80 characters. An IP address, a URL, or an email address is not stored. A non-empty value replaces the X-Via header.
  • slug · string · requis
    Slug you own. Must match ^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$. Not rewritten. Reserved slugs are rejected.
  • files · object · requis
    Path map, or an array of {path, content} or {path, base64}. Paths are stored exactly as given (a single top-level directory is not removed). Text as a string, binary as {"base64":"..."}. Example: {"index.html":"<!doctype html><h1>Hi</h1>","img/logo.png":{"base64":"iVBOR..."}}. Any other array is rejected.
  • merge · boolean · optionnel
    Keep every path you do not send, and add or overwrite only these exact paths.
  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.
  • expected_version · string · optionnel
    Live version this update is based on, such as "v3". If the site has moved on, the call returns version_conflict with no write. Omit it and a concurrent update still returns version_conflict rather than dropping files.

  Exemple d'appel

  {"name": "update_site", "arguments": {"slug": "texte", "files": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• whoami≈ 131 tokens

  Returns the plan, limits, the number of sites the token owns, and the number of custom hostnames attached. Input: token.

  Paramètres, retour & exemple (1)

  Paramètres

  • token · string · optionnel
    Bearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.

  Exemple d'appel

  {"name": "whoami", "arguments": {"token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://deed.page/mcp