dev.humanforai/humanforai

Est-ce que dev.humanforai/humanforai est sûr ?

Au dernier audit MCP Hub, le serveur MCP « dev.humanforai/humanforai » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 6 outils

• check_message_thread≈ 210 tokens

  Read the thread for a message you sent: the original text, every reply oldest-first, and whether the operator has answered. Needs the message_id and the access_token from the submission response. An empty replies list means no answer yet — the operator works at human speed, so poll occasionally rather than in a loop.

  Paramètres, retour & exemple (2)

  Paramètres

  • message_id · string · requis
    The message id from message_human_operator, e.g. MSG-2026-1A2B3C4D
  • access_token · string · requis
    The access_token returned once at submission — the only key to the thread.

  Exemple d'appel

  {"name": "check_message_thread", "arguments": {"message_id": "texte", "access_token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_task_status≈ 286 tokens

  Look up a submitted task by its task_id. Returns current status (submitted → accepted → delivered, or rejected), status history with timestamps, seen_by_operator_at (the moment a human actually saw the task — usually well before the first status change), eta (operator-set delivery estimate, once accepted), and any operator notes. Once delivered, the response also carries receipt (a signed JWS binding the deliverable's sha256 to the lifecycle timestamps) and deliverable_sha256 — verify offline against https://humanforai.dev/.well-known/jwks.json. In hosts that support MCP Apps the result also renders as a task status card (timeline, seen-by-human moment, ETA, operator notes, receipt) with a Refresh button; the JSON result carries the same data.

  Paramètres, retour & exemple (1)

  Paramètres

  • task_id · string · requis
    Task ID returned by submit_human_task, e.g. HFAI-2026-A1B2C3D4E5F60718

  Exemple d'appel

  {"name": "check_task_status", "arguments": {"task_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_human_services≈ 147 tokens

  Fetch the Human For AI manifest: available services, operator profile (location, languages, working hours), response times, accepted and rejected task types, and trust & safety policy. Call this first to decide whether and how to hire the human. The catalog is examples, not limits — unlisted needs are welcome as custom_human_in_the_loop.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_human_services", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• message_human_operator≈ 322 tokens

  Send a free-form message to the human operator — questions, scoping, custom or recurring projects, anything that is not yet a ready-made task. reply_to is REQUIRED: an email a human can read (MX-checked), or an https URL to receive the reply as a signed webhook push. The response also carries thread_url + access_token — every message is a pollable thread, so you can read the reply with check_message_thread even without a mailbox. Keep the token: it is shown only once.

  Paramètres, retour & exemple (4)

  Paramètres

  • from · string · optionnel
    Your agent or system identifier
  • message · string · requis
    The message. Plain language, English.
  • subject · string · optionnel
    Short subject line
  • reply_to · string · requis
    REQUIRED. Email address for the reply (real, reachable, MX-checked) — or an https webhook URL for a signed push.

  Exemple d'appel

  {"name": "message_human_operator", "arguments": {"message": "texte", "reply_to": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• reply_in_message_thread≈ 234 tokens

  Add a follow-up to a thread you opened — answer a question the operator asked, add detail, correct yourself, or withdraw the request. Prefer this over sending a brand-new message about the same subject. Needs the message_id and access_token from the submission response.

  Paramètres, retour & exemple (3)

  Paramètres

  • message · string · requis
    The follow-up text
  • message_id · string · requis
    The message id from message_human_operator
  • access_token · string · requis
    The access_token returned once at submission

  Exemple d'appel

  {"name": "reply_in_message_thread", "arguments": {"message": "texte", "message_id": "texte", "access_token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• submit_human_task≈ 766 tokens

  Submit a task for the human operator to perform in the real world. Returns a task_id immediately; the human reviews every task before accepting it (this is not instant execution). The operator is push-notified on submission; check_task_status shows seen_by_operator_at once a human has seen the task. Free during the pilot. contact_email must be a real mailbox (MX-checked) — it is how the deliverable reaches you. No mailbox? Set delivery to 'status_poll' instead: the deliverable arrives as text in operator_notes via check_task_status (limited to 1 such task per client per day). In hosts that support MCP Apps the result also renders as a task status card with a Refresh button; the JSON result carries the same data.

  Paramètres, retour & exemple (9)

  Paramètres

  • deadline · string · optionnel
    ISO 8601 datetime, e.g. 2026-07-10T12:00:00+03:00
  • delivery · string · optionnel · email | status_poll
    How the deliverable reaches you. 'email' (default) needs contact_email. 'status_poll' is the no-mailbox path for autonomous agents: the result arrives as text in operator_notes via check_task_status — keep the task_id, it is your only key. Budget: 1 status_poll task per client per day.
  • requester · string · optionnel
    Your agent or system identifier, e.g. my-agent/1.0
  • task_type · string · requis · real_world_verification | product_or_app_testing | human_judgment_and_feedback | data_collection | local_physical_task | ai_output_review | prompt_and_workflow_testing | simulation_and_automation_testing
    Service category — see get_human_services for descriptions. The list is not exhaustive: use custom_human_in_the_loop for anything that fits no other category
  • description · string · requis
    What to do, where, and what success looks like. Specific, self-contained tasks are accepted faster.
  • contact_email · string · optionnel
    Where the deliverable and clarifying questions are sent. Required unless delivery is 'status_poll'. Must be a real, reachable mailbox — placeholder domains are rejected and the domain is MX-checked.
  • output_format · string · optionnel
    text_report (default), text_report_with_photos, structured_json, annotated_screenshots, or video
  • location_detail · string · optionnel
    City, address, or area — required in practice when location_required is true
  • location_required · boolean · optionnel
    true if the task needs physical presence (coverage is confirmed at review)

  Exemple d'appel

  {"name": "submit_human_task", "arguments": {"task_type": "real_world_verification", "description": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://humanforai.dev/mcp