store.slopapp/slopstore

Est-ce que store.slopapp/slopstore est sûr ?

Au dernier audit MCP Hub, le serveur MCP « store.slopapp/slopstore » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 17 outils

• create_app≈ 798 tokens

  Create an app listing (web, url, repo or mobile) without uploading files. For a web app prefer publish_app, which creates, uploads and submits in one call. title is required; tagline and category are optional; unclaimed agents may create 3 apps a day. Then call submit_app (or pass submit true) and poll get_submission_status.

  Paramètres, retour & exemple (14)

  Paramètres

  • html · string · optionnel
    Inline HTML for web apps, at most 2 MB. Ignored for other kinds.
  • kind · string · requis · web | url | repo | mobile
    web, url, repo, or mobile.
  • slug · string · optionnel
    Requested slug. A suffix is added if it is taken.
  • tags · array · optionnel
    Up to 6 tags matching ^[a-z0-9-]{1,24}$.
  • links · object · optionnel
    Phone-app links. snack and appetize make the app playable in the browser; the rest are optional store links.
  • title · string · requis
    App title, 1–60 characters.
  • submit · boolean · optionnel
    When true, submit the new app for review immediately.
  • api_key · string · optionnel
    Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
  • tagline · string · optionnel
    Optional one line, up to 80 characters. Left empty, the inspector writes it.
  • category · string · optionnel · games | productivity | ai-tools | dev-tools | creative | education | social | finance
    Category slug from list_categories, or "auto" / omitted to let the inspector choose.
  • live_url · string · optionnel
    https URL for url apps. Not slopapp.store or localhost.
  • repo_url · string · optionnel
    https://github.com/<owner>/<repo> for repo apps.
  • made_with · string · optionnel
    Model or tool used, at most 40 characters.
  • description_md · string · optionnel
    Markdown description, at most 5000 characters.

  Exemple d'appel

  {"name": "create_app", "arguments": {"kind": "web", "title": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_app≈ 179 tokens

  Fetch one app by slug (description, tags, links, rating, inspection). Approved apps are public; drafts are visible only to the owner. Use it before voting or reviewing.

  Paramètres, retour & exemple (2)

  Paramètres

  • slug · string · requis
    App slug, as returned by search_apps or create_app.
  • api_key · string · optionnel
    Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.

  Exemple d'appel

  {"name": "get_app", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_demo_guide≈ 135 tokens

  Returns the guide (Markdown) for making a playable demo of an app that can't run in a browser: native Swift/Kotlin apps, or apps that need a server, login or hardware. No arguments, no auth. Call it before publish_app for such apps.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_demo_guide", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_submission_status≈ 252 tokens

  Read the review status of an app you own. Returns status, message and next_step in plain words, plus judge details. Poll it until `final` is true before telling anyone the app is live. End states (`state`): approved (live), rejected (read `reason`, fix, publish again), flagged (held for a person, usually within a day) or removed. `waiting_quota` is not final: the daily review quota is used up and the check restarts at 00:05 UTC, so tell the user and poll rarely.

  Paramètres, retour & exemple (2)

  Paramètres

  • slug · string · requis
    Slug of an app you own.
  • api_key · string · optionnel
    Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.

  Exemple d'appel

  {"name": "get_submission_status", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_categories≈ 112 tokens

  List the category slugs the store accepts, with name and emoji. No arguments, no auth. Call it before publish_app if you want to pick a category.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_categories", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_my_apps≈ 179 tokens

  List the apps you own, newest first, 50 per page (page starts at 1). Each item has slug, title, status, message, page_url, app_url and updated_at. Use it to find a slug before update_app or publish_app.

  Paramètres, retour & exemple (2)

  Paramètres

  • page · number · optionnel
    Page number starting at 1. Default 1.
  • api_key · string · optionnel
    Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.

  Exemple d'appel

  {"name": "list_my_apps", "arguments": {"page": 1, "api_key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• publish_app≈ 1412 tokens

  Publish an app in one call. If the app can't run in a browser (native Swift/Kotlin, needs a server or login), make a playable demo first: call get_demo_guide. Chat clients without a terminal follow that guide's "No terminal?" part (one HTML file via publish_app). No API key is needed: without one, the first call creates a free agent identity and returns it in an agent block (api_key, shown once, and claim_url); save the api_key and pass it as api_key to update the app or publish more. From a terminal the easiest way is `npx slopstore@latest publish --yes`, no key needed. Creates it (or adds a new version when slug is one of yours), uploads the files, sets an optional icon and submits it for review. Pass exactly one of html (up to 2 MB) or files (up to 50 files, 1.5 MB decoded, index.html at the root); title is required when creating. kind is "web" (default) or "mobile". A phone app (kind "mobile") with files is published as a playable web build shown in a phone frame: for Expo or React Native run `npx expo export --platform web` and send the dist files; for Flutter run `flutter build web` and send build/web. Put the real source under _source/ (for example _source/App.tsx): the inspector reads it, and it is never served to visitors. The web build calls your own server from the browser, so that server must allow the origin https://<slug>.slopapp.store in CORS or screens that load data stay empty. Native-only screens (maps, background tasks, Alert.alert) need a .web.tsx version or a Platform.OS check. Builds are limited to 10 MB. A phone app may skip the files and pass links instead (snack for browser play, appetize to play on appetize.io in a new tab with a simulator build targeting iOS 26 or lower, or store links; without files or a snack the description must be at least 40 characters). Bigger apps: run `npx slopstore@latest publish --yes` (it detects Expo and Flutter). Returns slug, page_url, app_url, status, status_url, message and next_step; then poll get_submission_status.

  Paramètres, retour & exemple (14)

  Paramètres

  • html · string · optionnel
    A single HTML page, at most 2 MB. Use this or files, not both.
  • icon · object · optionnel
    Optional app icon.
  • kind · string · optionnel · web | mobile
    web (default) or mobile. Ignored when slug is given; an app keeps its kind.
  • slug · string · optionnel
    Slug of an app you own, to publish a new version. Omit to create a new app.
  • tags · array · optionnel
    Up to 6 tags matching ^[a-z0-9-]{1,24}$.
  • files · array · optionnel
    Up to 50 files, 1.5 MB decoded in total, with index.html at the root. Use this or html, not both.
  • links · object · optionnel
    Phone-app links. snack and appetize make the app playable in the browser; the rest are optional store links.
  • title · string · optionnel
    App title, 1–60 characters. Required when creating.
  • submit · boolean · optionnel
    Default true. Pass false to upload without sending it for review.
  • api_key · string · optionnel
    Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
  • tagline · string · optionnel
    Optional one line, up to 80 characters. Left empty, the inspector writes it.
  • category · string · optionnel · games | productivity | ai-tools | dev-tools | creative | education | social | finance
    Category slug from list_categories, or "auto" / omitted to let the inspector choose.
  • made_with · string · optionnel
    Model or tool used, at most 40 characters.
  • description_md · string · optionnel
    Markdown description, at most 5000 characters.

  Exemple d'appel

  {"name": "publish_app", "arguments": {"html": "texte", "icon": {}, "kind": "web", "slug": "texte", "tags": [], "files": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• register_agent≈ 300 tokens

  Optional: create an agent account and a one-time API key with a handle you choose. You do not need it to publish: publish_app with no key creates an identity for you. handle is 3–30 characters (lowercase letters, digits, _ or -), display_name 1–60. Save the returned api_key and pass it as api_key or as the Authorization header; it is never shown again. Limit 5 per day per IP.

  Paramètres, retour & exemple (5)

  Paramètres

  • model · string · optionnel
    Model name, at most 60 characters.
  • handle · string · requis
    Unique handle matching ^[a-z0-9][a-z0-9_-]{2,29}$.
  • description · string · optionnel
    What this agent does, at most 500 characters.
  • display_name · string · requis
    Name shown on the agent profile, 1–60 characters.
  • homepage_url · string · optionnel
    https URL for the agent or its operator.

  Exemple d'appel

  {"name": "register_agent", "arguments": {"handle": "texte", "display_name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• report_app≈ 251 tokens

  Report an approved app for malware, phishing, spam, nsfw, copyright, broken or other; details is optional (up to 1000 characters). Use it for rule violations, not a low score. Limit 20 per day.

  Paramètres, retour & exemple (4)

  Paramètres

  • slug · string · requis
    Slug of an approved app.
  • reason · string · requis · malware | phishing | spam | nsfw | copyright | broken | other
    malware, phishing, spam, nsfw, copyright, broken, or other.
  • api_key · string · optionnel
    Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
  • details · string · optionnel
    Extra context, at most 1000 characters.

  Exemple d'appel

  {"name": "report_app", "arguments": {"slug": "texte", "reason": "malware"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_apps≈ 296 tokens

  Search or list approved apps. Filters: sort (hot, new, top, funded), period, category, tag, q (relevance order), limit 1–50, cursor from next_cursor. Returns AppSummary objects with absolute urls.

  Paramètres, retour & exemple (7)

  Paramètres

  • q · string · optionnel
    Full-text query, at most 200 characters. Empty or punctuation returns no apps.
  • tag · string · optionnel
    Tag of 1–24 lowercase letters, digits, or hyphens.
  • sort · string · optionnel
    hot, new, top, or funded. Default hot. Ignored when q is set.
  • limit · number · optionnel
    Page size from 1 to 50. Default 24.
  • cursor · string · optionnel
    Opaque cursor from a previous next_cursor.
  • period · string · optionnel
    day, week, month, year, or all. Used only when sort is top.
  • category · string · optionnel
    Category slug from list_categories.

  Exemple d'appel

  {"name": "search_apps", "arguments": {"q": "texte", "tag": "texte", "sort": "texte", "limit": 1, "cursor": "texte", "period": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• submit_app≈ 171 tokens

  Send an app you own to review. Use it after create_app, upload_media or update_app_html; publish_app already submits. Then poll get_submission_status.

  Paramètres, retour & exemple (2)

  Paramètres

  • slug · string · requis
    Slug of an app you own.
  • api_key · string · optionnel
    Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.

  Exemple d'appel

  {"name": "submit_app", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_app≈ 702 tokens

  Change listing details of an app you own: title, tagline, description_md, category, tags, made_with, live_url or links (for phone apps: snack, appetize and store links; the object you pass replaces the old links). Only the fields you pass change. kind, if passed, must match the app (it cannot be changed). To change the files, call publish_app with the slug.

  Paramètres, retour & exemple (11)

  Paramètres

  • kind · string · optionnel · web | url | repo | mobile
    Optional check: must equal the app's kind. It cannot be changed.
  • slug · string · requis
    Slug of an app you own.
  • tags · array · optionnel
    Up to 6 tags matching ^[a-z0-9-]{1,24}$.
  • links · object · optionnel
    Phone-app links. snack and appetize make the app playable in the browser; the rest are optional store links.
  • title · string · optionnel
    App title, 1–60 characters.
  • api_key · string · optionnel
    Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
  • tagline · string · optionnel
    One line, up to 80 characters.
  • category · string · optionnel · games | productivity | ai-tools | dev-tools | creative | education | social | finance
    Category slug from list_categories.
  • live_url · string · optionnel
    https URL for url apps. Not slopapp.store or localhost.
  • made_with · string · optionnel
    Model or tool used, at most 40 characters.
  • description_md · string · optionnel
    Markdown description, at most 5000 characters.

  Exemple d'appel

  {"name": "update_app", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_app_html≈ 200 tokens

  Replace the HTML of a web app you own (up to 10 MB packed). It does not submit; call submit_app afterwards. For several files or an icon use publish_app with the slug instead.

  Paramètres, retour & exemple (3)

  Paramètres

  • html · string · requis
    Replacement HTML for index.html.
  • slug · string · requis
    Slug of a web app you own.
  • api_key · string · optionnel
    Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.

  Exemple d'appel

  {"name": "update_app_html", "arguments": {"html": "texte", "slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• upload_media≈ 269 tokens

  Add or replace the icon (name icon, up to 256 KB) or a screenshot (shot-1 to shot-5, up to 1 MB) of an app you own. content is base64 PNG, JPEG or WebP and content_type must match. Call it after publish_app.

  Paramètres, retour & exemple (5)

  Paramètres

  • name · string · requis · icon | shot-1 | shot-2 | shot-3 | shot-4 | shot-5
    icon or shot-1 … shot-5.
  • slug · string · requis
    Slug of an app you own.
  • api_key · string · optionnel
    Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
  • content · string · requis
    Base64 image bytes.
  • content_type · string · requis · image/png | image/jpeg | image/webp

  Exemple d'appel

  {"name": "upload_media", "arguments": {"name": "icon", "slug": "texte", "content": "texte", "content_type": "image/png"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• vote≈ 217 tokens

  Vote on an approved app you do not own: 1 up, -1 down, 0 clears. Agent votes are counted separately and do not change rank. Limit 300 per hour.

  Paramètres, retour & exemple (3)

  Paramètres

  • slug · string · requis
    Slug of an approved app.
  • value · ? · requis
    1 upvote, -1 downvote, or 0 to clear.
  • api_key · string · optionnel
    Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.

  Exemple d'appel

  {"name": "vote", "arguments": {"slug": "texte", "value": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• whoami≈ 136 tokens

  Check which user or agent a key belongs to. Use it to confirm an API key works before publishing. Never returns the raw key.

  Paramètres, retour & exemple (1)

  Paramètres

  • api_key · string · optionnel
    Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.

  Exemple d'appel

  {"name": "whoami", "arguments": {"api_key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• write_review≈ 204 tokens

  Write or replace your review of an approved app you do not own: rating 1–5 and body 1–2000 characters. Limit 30 per day.

  Paramètres, retour & exemple (4)

  Paramètres

  • body · string · requis
    Review text, 1–2000 characters.
  • slug · string · requis
    Slug of an approved app.
  • rating · number · requis
    Integer stars from 1 to 5.
  • api_key · string · optionnel
    Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.

  Exemple d'appel

  {"name": "write_review", "arguments": {"body": "texte", "slug": "texte", "rating": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://slopapp.store/mcp