com.402cron/402cron

Est-ce que com.402cron/402cron est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.402cron/402cron » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 16 outils

• create_task≈ 525 tokens

  Register a schedule against a destination you have already verified. Idempotent on "name": the same name updates the existing task instead of creating a second one. Creating costs nothing; each delivery ATTEMPT costs one credit.

  Paramètres, retour & exemple (7)

  Paramètres

  • url · string · requis
    The https:// destination. It must already be registered and verified — see register_destination.
  • body · ? · optionnel
    The body we send. Stored in the clear, so it must not carry credentials. A non-string is serialized as JSON.
  • cron · string · requis
    5 fields, UTC only, one minute at the finest. Operators: * a-b a,b */n a-b/n. Names: SUN-SAT (day), JAN-DEC (month). Macros: @yearly @annually @monthly @weekly @daily @midnight @hourly. Day-of-week is 0-6 with 0 = Sunday; 7 also means Sunday. Write days as names (MON-FRI). Numbers differ between schedulers: Quartz, AWS EventBridge and Cloudflare number Sunday as 1, we and croniter as 0. Translated for you: "?". "?" as a whole day-of-month or day-of-week field becomes "*". A NUMERIC day-of-week next to "?" is refused, because "?" means the expression was written where Sunday is 1. Refused: Quartz L, Quartz W, Quartz #, six fields (seconds), seven fields (year), @reboot, @every, CRON_TZ= prefixes, time zones of any kind — each with a code saying what to send instead.
  • name · string · requis
    Your name for the task. Unique among your live tasks; creating with an existing name updates it.
  • method · string · optionnel
    HTTP method of the delivery. Default POST. GET and HEAD carry no body.
  • headers · object · optionnel
    Headers we send with the delivery. Stored ENCRYPTED at rest — put credentials here, never in the body.
  • timeoutMs · integer · optionnel
    How long we wait for your server, 250-2000 ms. Answer 202 and do the work behind it.

  Exemple d'appel

  {"name": "create_task", "arguments": {"url": "texte", "cron": "texte", "name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• delete_destination≈ 92 tokens

  Remove a claimed URL. Refused while a task still points at it — delete the task first.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · integer · requis
    Destination id, as returned by register_destination.

  Exemple d'appel

  {"name": "delete_destination", "arguments": {"id": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• delete_task≈ 114 tokens

  Move the task to the recycle bin. It stops firing immediately and can be restored for 30 days with restore_task; after that it is unrecoverable. Credits already spent are not refunded.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    Task id (UUID), as returned by create_task or list_tasks.

  Exemple d'appel

  {"name": "delete_task", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_docs≈ 126 tokens

  One section of the machine documentation: quickstart, headers, signature, notice, errors, billing or limits. Omit `section` to get the whole document.

  Paramètres, retour & exemple (1)

  Paramètres

  • section · string · optionnel · quickstart | verification | headers | signature | notice | errors | billing | limits
    Which section to return. Omit for all of it.

  Exemple d'appel

  {"name": "get_docs", "arguments": {"section": "quickstart"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_pricing≈ 89 tokens

  What a delivery costs, which packs exist, and the exact x402 payment requirements for each. Balance is counted in DELIVERIES, not money, and packs never expire. Call this before buying.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_pricing", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_service_status≈ 84 tokens

  Whether the service is currently selling, on which network, and if not — why not. This is configuration, not liveness: the full health endpoint is at /health.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_service_status", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_task≈ 95 tokens

  A single task: schedule, destination, state, next run, and how many failures in a row it carries.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    Task id (UUID), as returned by create_task or list_tasks.

  Exemple d'appel

  {"name": "get_task", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_destinations≈ 66 tokens

  The URLs you have claimed and whether each is verified. The signing secrets are never shown again.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_destinations", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_tasks≈ 137 tokens

  Your tasks and their state. Needs your management token as an Authorization header on this connection.

  Paramètres, retour & exemple (3)

  Paramètres

  • after · string · optionnel
    Cursor from a previous page.
  • limit · integer · optionnel
    How many to return.
  • state · string · optionnel
    Filter by state: live (default), all, or one exact state such as active or paused_by_client.

  Exemple d'appel

  {"name": "list_tasks", "arguments": {"after": "texte", "limit": 1, "state": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• pause_task≈ 86 tokens

  Stop firing until you resume. Nothing is charged while a task is paused.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    Task id (UUID), as returned by create_task or list_tasks.

  Exemple d'appel

  {"name": "pause_task", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• register_destination≈ 353 tokens

  Claim an https:// URL you control. We answer with a challenge and a SIGNING SECRET that is shown ONCE and never again — store it before you do anything else; it is what lets you verify that a delivery really came from us. The permission covers that path and everything beneath it, nothing above. Verification is one request from us to the exact URL you registered: POST, headers X-402cron-Challenge: <value> and X-402cron-Event: verify, JSON body {"challenge":"<value>"}. Reply within 5 seconds, without a redirect, with a body that is the bare value or {"challenge":"<value>"}; we read the first 512 bytes and do not check the HTTP status (2xx is fine). Then call POST /api/destinations/{id}/verify within 15 minutes of registering. A fixed-response webhook cannot pass: you need an endpoint you can program. Registering a URL that is still pending issues a new challenge and a new signing secret every time — the old secret immediately stops verifying deliveries; a verified URL is left untouched unless you add ?rotate=1. The daily verification allowance (10 per destination, 40 per client, UTC day) does not reset on re-registration.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    The https:// URL you control.

  Exemple d'appel

  {"name": "register_destination", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• restore_task≈ 95 tokens

  Bring a task back from the recycle bin within 30 days. It comes back PAUSED — resume it explicitly.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    Task id (UUID), as returned by create_task or list_tasks.

  Exemple d'appel

  {"name": "restore_task", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• resume_task≈ 93 tokens

  Start firing again on the schedule. Refused if your balance is empty — buy deliveries first.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    Task id (UUID), as returned by create_task or list_tasks.

  Exemple d'appel

  {"name": "resume_task", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• run_task_now≈ 134 tokens

  Deliver immediately, outside the schedule. THIS COSTS ONE CREDIT per attempt, exactly like a scheduled firing, and a timeout or unreachable host is retried up to three times — so one call can cost up to three credits. Use it to test a destination.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    Task id (UUID), as returned by create_task or list_tasks.

  Exemple d'appel

  {"name": "run_task_now", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_task≈ 551 tokens

  Change the schedule, destination, method, timeout, headers or body of an existing task. Omit a field to leave it unchanged — sending null is refused, because "unchanged" and "cleared" must not look the same. State is NOT editable here: use pause_task and resume_task.

  Paramètres, retour & exemple (8)

  Paramètres

  • id · string · requis
    Task id (UUID), as returned by create_task or list_tasks.
  • url · string · optionnel
    The https:// destination. It must already be registered and verified — see register_destination.
  • body · ? · optionnel
    The body we send. Stored in the clear, so it must not carry credentials. A non-string is serialized as JSON.
  • cron · string · optionnel
    5 fields, UTC only, one minute at the finest. Operators: * a-b a,b */n a-b/n. Names: SUN-SAT (day), JAN-DEC (month). Macros: @yearly @annually @monthly @weekly @daily @midnight @hourly. Day-of-week is 0-6 with 0 = Sunday; 7 also means Sunday. Write days as names (MON-FRI). Numbers differ between schedulers: Quartz, AWS EventBridge and Cloudflare number Sunday as 1, we and croniter as 0. Translated for you: "?". "?" as a whole day-of-month or day-of-week field becomes "*". A NUMERIC day-of-week next to "?" is refused, because "?" means the expression was written where Sunday is 1. Refused: Quartz L, Quartz W, Quartz #, six fields (seconds), seven fields (year), @reboot, @every, CRON_TZ= prefixes, time zones of any kind — each with a code saying what to send instead.
  • name · string · optionnel
    Your name for the task. Unique among your live tasks; creating with an existing name updates it.
  • method · string · optionnel
    HTTP method of the delivery. Default POST. GET and HEAD carry no body.
  • headers · object · optionnel
    Headers we send with the delivery. Stored ENCRYPTED at rest — put credentials here, never in the body.
  • timeoutMs · integer · optionnel
    How long we wait for your server, 250-2000 ms. Answer 202 and do the work behind it.

  Exemple d'appel

  {"name": "update_task", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_destination≈ 300 tokens

  Verification is one request from us to the exact URL you registered: POST, headers X-402cron-Challenge: <value> and X-402cron-Event: verify, JSON body {"challenge":"<value>"}. Reply within 5 seconds, without a redirect, with a body that is the bare value or {"challenge":"<value>"}; we read the first 512 bytes and do not check the HTTP status (2xx is fine). Then call POST /api/destinations/{id}/verify within 15 minutes of registering. A fixed-response webhook cannot pass: you need an endpoint you can program. Registering a URL that is still pending issues a new challenge and a new signing secret every time — the old secret immediately stops verifying deliveries; a verified URL is left untouched unless you add ?rotate=1. The daily verification allowance (10 per destination, 40 per client, UTC day) does not reset on re-registration. Until this passes, no task may point at the destination.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · integer · requis
    Destination id, as returned by register_destination.

  Exemple d'appel

  {"name": "verify_destination", "arguments": {"id": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://402cron.com/mcp