com.naxytra/xytara-mcp-executor

Est-ce que com.naxytra/xytara-mcp-executor est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.naxytra/xytara-mcp-executor » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 17 outils

• abi.decode≈ 242 tokens

  Decodes ABI-encoded hex for the given types (same type support as abi.encode). Strict: every length and offset is bounded by the data present, dirty padding bits and trailing bytes are rejected, and calldata with a 4-byte selector is flagged. Integers are returned as decimal strings, addresses checksummed. Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (2)

  Paramètres

  • data · string · requis
    0x-prefixed ABI-encoded data (no function selector).
  • types · array · requis
    Solidity ABI types to decode into.

  Exemple d'appel

  {"name": "abi.decode", "arguments": {"data": "texte", "types": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• abi.encode≈ 274 tokens

  Solidity ABI encoding (like abi.encode): address, bool, uint8-256, int8-256, bytes1-32, bytes, string, dynamic T[] and fixed T[k] arrays, and tuples written (uint256,address), nested to any depth. Strict: exact 20-byte (checksum-valid) addresses, range-checked integers, exact bytesN length, JSON true/false for bool, JSON arrays for arrays and tuples. Integers as decimal strings (or safe JSON numbers). Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (2)

  Paramètres

  • types · array · requis
    Solidity ABI types, e.g. ["address","uint256","(uint256,bool)[]"].
  • values · array · requis
    Values matching types.

  Exemple d'appel

  {"name": "abi.encode", "arguments": {"types": [], "values": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• address.validate≈ 177 tokens

  Checks an EVM address: format (0x + 40 hex), EIP-55 checksum (for mixed-case input), zero address, and returns the checksummed form. Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (1)

  Paramètres

  • address · string · requis
    EVM address to validate (0x-prefixed).

  Exemple d'appel

  {"name": "address.validate", "arguments": {"address": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• catalog≈ 106 tokens

  Lists the enabled tools with titles, descriptions and the price. Same information as tools/list. Free: never requires payment.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "catalog", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• eip712.hash≈ 280 tokens

  Computes the EIP-712 digest, domain separator, struct hash and encodeType from domain, types, primaryType and message (what wallets sign, including the x402 USDC TransferWithAuthorization). Every field is type-checked; a missing field fails with missing_field:<path> (not charged). Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (4)

  Paramètres

  • types · object · requis
    Typed-data types (EIP712Domain optional).
  • domain · object · requis
    EIP-712 domain: name, version, chainId, verifyingContract, salt.
  • message · object · requis
    The message values.
  • primaryType · string · requis
    The primary struct type to hash.

  Exemple d'appel

  {"name": "eip712.hash", "arguments": {"types": {}, "domain": {}, "message": {}, "primaryType": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• html.to-text≈ 209 tokens

  Converts HTML to readable plain text: drops scripts/styles/comments and all attribute text, keeps paragraph and list structure, separates table cells with " | ", decodes numeric and common named entities, and returns the <title> separately. Input up to 250000 characters; single linear pass. Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (1)

  Paramètres

  • html · string · requis
    HTML markup to convert.

  Exemple d'appel

  {"name": "html.to-text", "arguments": {"html": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• json.validate≈ 364 tokens

  Validates a JSON payload (any JSON value, or JSON text as a string) against a JSON Schema and returns valid plus every error with its JSON Pointer path. Supported keywords: type, required, properties, additionalProperties, items/prefixItems, enum, const, minimum/maximum, exclusiveMinimum/exclusiveMaximum, multipleOf, minLength/maxLength, pattern, minItems/maxItems, uniqueItems, min/maxProperties, allOf. A schema using other keywords ($ref, anyOf, oneOf, not, if/then) is rejected (not charged) rather than half-checked. Without a schema only well-formedness is checked. Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (4)

  Paramètres

  • schema · object|boolean|string · optionnel
    JSON Schema (object, or JSON text).
  • payload · ? · requis
    The JSON value to validate; a string is parsed as JSON text unless parse_string is false.
  • schema_name · string · optionnel
    Optional label echoed back.
  • parse_string · boolean · optionnel
    Parse a string payload as JSON text (default true).

  Exemple d'appel

  {"name": "json.validate", "arguments": {"payload": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• keccak256≈ 224 tokens

  Ethereum keccak256 of the input: returns the 32-byte digest and the 4-byte selector. encoding auto (default) hashes 0x-hex input as bytes and anything else as UTF-8 text; force utf8 or hex explicitly. The empty string is allowed. Up to 250000 bytes. Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (2)

  Paramètres

  • data · string · requis
    Data to hash, e.g. transfer(address,uint256) or 0xdeadbeef.
  • encoding · string · optionnel · auto | utf8 | hex
    auto (default), utf8, or hex.

  Exemple d'appel

  {"name": "keccak256", "arguments": {"data": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• merkle.verify≈ 379 tokens

  Verifies a keccak256 Merkle proof. leaf, root and every proof entry must be 0x 32-byte hashes (hash_leaf:true keccak-hashes a raw leaf first). sorted:true (default) is OpenZeppelin MerkleProof (sorted pairs); sorted:false needs leaf_index or positions to order each pair. Up to 256 proof entries. Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (7)

  Paramètres

  • leaf · string · requis
    0x 32-byte leaf hash (or raw data with hash_leaf:true).
  • root · string · requis
    Expected 0x 32-byte root.
  • proof · array · requis
    Sibling hashes from leaf to root.
  • sorted · boolean · optionnel
    Sorted-pair hashing (OpenZeppelin, default true).
  • hash_leaf · boolean · optionnel
    keccak256 the leaf before verifying (default false).
  • positions · array · optionnel
    For sorted:false: the side of each sibling.
  • leaf_index · integer · optionnel
    Leaf position for sorted:false trees.

  Exemple d'appel

  {"name": "merkle.verify", "arguments": {"leaf": "texte", "root": "texte", "proof": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• reply.draft≈ 340 tokens

  Builds a structured reply to a message: greeting to the sender (name detected from the sign-off, or sender_name), acknowledgement, every question and request found in the message listed with an answer placeholder, deadlines noted, and a tone-matched sign-off. Deterministic template: it organizes the reply but does not invent the answers (placeholders in [brackets]). Input up to 20000 characters. Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (4)

  Paramètres

  • text · string · requis
    The message you are replying to.
  • tone · string · optionnel · clear | concise | warm | friendly | formal
    clear (default), concise, warm, friendly, or formal.
  • your_name · string · optionnel
    Name to sign with (otherwise a [Your name] placeholder).
  • sender_name · string · optionnel
    Name to greet (otherwise detected from the sign-off).

  Exemple d'appel

  {"name": "reply.draft", "arguments": {"text": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• summarize≈ 268 tokens

  Extractive summary: returns the first sentences of the text (default 3, up to 10) capped at max_chars (default 600, 50-2000), taken from the first 4000 characters. Deterministic; it does not paraphrase. `truncated` is true when the source was longer than the considered window. Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (3)

  Paramètres

  • text · string · requis
    Plain text to summarize (non-empty).
  • max_chars · integer · optionnel
    Upper bound on summary length (default 600).
  • max_sentences · integer · optionnel
    Sentences to keep (default 3).

  Exemple d'appel

  {"name": "summarize", "arguments": {"text": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• text.chunk≈ 280 tokens

  Splits text into chunks of at most max_chars (100-20000, default 2000) preferring paragraph, line, sentence and word boundaries, with optional overlap (up to half of max_chars). Sizes are UTF-16 code units; surrogate pairs (emoji) are never split. Input up to 250000 characters. Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (3)

  Paramètres

  • text · string · requis
    Text to split into chunks.
  • overlap · integer · optionnel
    Characters repeated between consecutive chunks (default 0, capped at max_chars/2).
  • max_chars · integer · optionnel
    Maximum characters per chunk (default 2000).

  Exemple d'appel

  {"name": "text.chunk", "arguments": {"text": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• text.extract≈ 210 tokens

  Extracts emails, URLs (trailing punctuation stripped), IPv4 addresses, EVM addresses, transaction hashes, @mentions, #hashtags, prices, ISO/slash dates and phone numbers (dates, IPs and plain numbers are not reported as phones). Input up to 200000 characters; linear-time. Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (1)

  Paramètres

  • text · string · requis
    Text to extract entities from.

  Exemple d'appel

  {"name": "text.extract", "arguments": {"text": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tx.status≈ 314 tokens

  Looks up a transaction by hash on Base mainnet (default) or Base Sepolia: success/failed/pending, block, confirmations, from, to, value and gas. network accepts eip155:8453, base, 8453, eip155:84532, base-sepolia, 84532. A hash unknown to the chain is reported clearly as found:false. ~5 s budget; RPC unavailable fails (not charged). Price: $0.02 USDC per call on Base mainnet ($0.002 on Base Sepolia), paid with x402 or 6 credits with a spend key; failed calls are not charged. The result carries a signed attestation (naxytra-attestation/1, in result._meta["naxytra.com/attestation"]) of what was observed on-chain — verified true or false — that you can hand to a third party; keys at /.well-known/delivery-receipt-keys.

  Paramètres, retour & exemple (2)

  Paramètres

  • network · string|integer · optionnel
    Network (default eip155:8453 Base mainnet).
  • tx_hash · string · requis
    0x-prefixed 32-byte transaction hash.

  Exemple d'appel

  {"name": "tx.status", "arguments": {"tx_hash": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• x402.decode≈ 204 tokens

  Decodes an x402 payment challenge (base64 PAYMENT-REQUIRED header, or the JSON; v2 `amount` and v1 `maxAmountRequired`) into networks, assets, human amounts and payTo. A challenge with no payment options fails (not charged). Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (1)

  Paramètres

  • challenge · string|object · requis
    Base64 PAYMENT-REQUIRED value, challenge JSON text, or the challenge object.

  Exemple d'appel

  {"name": "x402.decode", "arguments": {"challenge": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• x402.verify-receipt≈ 430 tokens

  Decodes an x402 PAYMENT-RESPONSE receipt and checks Base / Base Sepolia: settlement_confirmed is true only if the tx succeeded and its logs contain a USDC Transfer to the expected payTo (pay_to, else this server's) for the expected amount (amount, else this server's price) from the stated payer. RPC unavailable, unknown network or a receipt without a tx fails (not charged). Price: $0.02 USDC per call on Base mainnet ($0.002 on Base Sepolia), paid with x402 or 6 credits with a spend key; failed calls are not charged. The result carries a signed attestation (naxytra-attestation/1, in result._meta["naxytra.com/attestation"]) of what was observed on-chain — verified true or false — that you can hand to a third party; keys at /.well-known/delivery-receipt-keys.

  Paramètres, retour & exemple (5)

  Paramètres

  • payer · string · optionnel
    Expected payer (default: the receipt's payer).
  • amount · string|integer · optionnel
    Expected amount in USDC base units (default: this server's price when pay_to is this server).
  • pay_to · string · optionnel
    Expected merchant address (default: this server's payTo).
  • confirm · boolean · optionnel
    false = decode only, no on-chain check (default true).
  • receipt · string|object · requis
    Base64 PAYMENT-RESPONSE value, settlement JSON text, or the object.

  Exemple d'appel

  {"name": "x402.verify-receipt", "arguments": {"receipt": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• zones.lookup≈ 216 tokens

  Live DNS lookup of A, AAAA, CNAME, MX, NS and TXT records for a domain (a URL is accepted; its hostname is used; IDNs are punycoded). 2 s per query, ~5 s total. Per-record errors are reported in record_errors; if no record resolves at all the call fails and is not charged. Price: $0.01 USDC per call on Base mainnet ($0.001 on Base Sepolia), paid with x402; failed calls are not charged.

  Paramètres, retour & exemple (1)

  Paramètres

  • hostname · string · requis
    Domain name or URL, for example example.com or https://example.com/page.

  Exemple d'appel

  {"name": "zones.lookup", "arguments": {"hostname": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://xytara-mcp-executor.onrender.com/mcp