dev.mcphost/mcphost

Est-ce que dev.mcphost/mcphost est sûr ?

Au dernier audit MCP Hub, le serveur MCP « dev.mcphost/mcphost » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 18 outils

• billing.plans≈ 457 tokens

  The plan catalog (price and quotas per plan) and whether Stripe billing is configured on this host. Anonymous callers get the same answer as tenants.

  Paramètres, retour & exemple (1)

  Paramètres

  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.

  Exemple d'appel

  {"name": "billing.plans", "arguments": {"tenant_key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"plans": [], "billing_mode": "texte"}}

• host.errors≈ 587 tokens

  List every error code this host can return, each with its class (agent_fault | host_refusal | upstream_fault | plan_limit | host_fault), family, remedy, docs anchor, retryable flag and help_url -- the same object GET /errors.json serves. Pass code to get one row; a misspelt code answers tool_not_found with did_you_mean. Read-only, anonymous, no tenant data.

  Paramètres, retour & exemple (2)

  Paramètres

  • code · string · optionnel
    An error code, e.g. tool_exception. Omit to list every code.
  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.

  Exemple d'appel

  {"name": "host.errors", "arguments": {"code": "texte", "tenant_key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"code": "texte", "class": "texte", "codes": [], "family": "texte", "remedy": "texte", "classes": [], "version": "texte", "help_url": "texte", "retryable": true, "docs_anchor": "texte"}}

• host.feedback.list≈ 444 tokens

  List your own feedback (newest first, status received). Anonymous callers get [].

  Paramètres, retour & exemple (2)

  Paramètres

  • limit · integer · optionnel
    Max rows, up to 100; default 20.
  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.

  Exemple d'appel

  {"name": "host.feedback.list", "arguments": {"limit": 1, "tenant_key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"note": "texte", "count": 1, "feedback": []}}

• host.feedback.send≈ 422 tokens

  Tell the host's humans what you needed: kind, up to 2048 bytes of text, optional context. Works before signup. Returns feedback_id.

  Paramètres, retour & exemple (4)

  Paramètres

  • kind · string · requis · missing_tool | wrong_error | docs_gap | bug | praise
    What you are telling the host.
  • text · string · requis
    What you needed or saw; 1 to 2048 bytes after trim.
  • context · object · optionnel
    Optional, at most 1 KB: tool, error_code, free.
  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.

  Exemple d'appel

  {"name": "host.feedback.send", "arguments": {"kind": "missing_tool", "text": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"kind": "texte", "feedback_id": "texte"}}

• host.help.get≈ 512 tokens

  Return the documentation section an anchor points at: its text (at most 4 KB) and its first fenced example. Pass an anchor exactly as an error, hint or help entry printed it, e.g. a rate_limited error's `anchor`. Read-only, anonymous, no tenant data. An unknown anchor is anchor_not_found with the nearest anchors in did_you_mean.

  Paramètres, retour & exemple (2)

  Paramètres

  • anchor · string · requis
    A `<path>#<slug>` anchor, e.g. README.md#call-limits, as printed by an error's `anchor` field or a `host.help.search` hit. `<path>#top` and a bare `<path>` (e.g. docs/kinds/chain.md) both return that document's first section.
  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.

  Exemple d'appel

  {"name": "host.help.get", "arguments": {"anchor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"line": 1, "path": "texte", "text": "texte", "title": "texte", "anchor": "texte", "example": {}}}

• host.help.search≈ 625 tokens

  Search this host's own documentation and tool descriptions. Returns up to k hits (default 3, response under 2 KB), each with a snippet, the nearest runnable example and an anchor. Read-only, anonymous, no tenant data -- call it with the error text or import line you are stuck on before reading any docs file.

  Paramètres, retour & exemple (4)

  Paramètres

  • k · integer · optionnel
    How many hits to return (default 3).
  • q · string · requis
    What you are stuck on: a tool name, an error code or message, an import line.
  • kind · string · optionnel · chain | echo | http | jq | js | python | wasm
    Only search the page of this registered kind (docs/kinds/<kind>.md).
  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.

  Exemple d'appel

  {"name": "host.help.search", "arguments": {"q": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"hint": "texte", "hits": [], "total": 1, "index_version": "texte"}}

• host.quickstart≈ 3281 tokens

  Return the shortest ordered sequence of calls to a working tool of `kind`, with your namespace and a filled-in example already substituted in, plus the current limits and a try_before_call table naming the one dry-run tool for each case. Read-only -- this call alone never creates a tenant. Call this before host.tool_publish if you're not sure what a spec should look like. Unauthenticated callers get a worked example with no tenant data; any other host.*/billing.* call creates a tenant on first use, no signup required.

  Paramètres, retour & exemple (3)

  Paramètres

  • kind · string · optionnel
    Which registered kind to return a worked example for, e.g. echo, http, python -- or a job-word alias (webhook, event, cron, ...) for its recipe. Omit to see every kind, alias and recipe name.
  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.
  • retry_after_s · integer · optionnel
    Seconds a rate-limited signup said to wait; an error's next_call carries it back here. Informational, never required.

  Exemple d'appel

  {"name": "host.quickstart", "arguments": {"kind": "texte", "tenant_key": "texte", "retry_after_s": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"hint": "texte", "kind": "texte", "next": [], "kinds": [], "steps": [], "verbs": [], "limits": {}, "recipe": {}, "aliases": [], "example": {}, "outcome": "texte", "recipes": []}}

• host.redeem≈ 411 tokens

  Exchange a signup(handoff: true) handoff_token for the tenant key it was issued for. Single-use: a second redemption fails with handoff_token_redeemed; past its expiry it fails with handoff_token_expired. Unauthenticated -- the token itself is the proof.

  Paramètres, retour & exemple (2)

  Paramètres

  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.
  • handoff_token · string · requis
    The handoff_token signup(handoff: true) returned.

  Exemple d'appel

  {"name": "host.redeem", "arguments": {"handoff_token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"key": "texte", "next": "texte", "usage": "texte", "session_bound": true}}

• host.resume≈ 630 tokens

  Resume where you left off in one call (at most 4096 bytes): your tools with each one's last call status, unfinished runs, your newest notes, what changed on the host since your last call, and one suggested next_call. truncated names any section that was cut -- call that section's own tool (host.tool.list, host.runs.list, host.note.list, host.changelog) for the rest. Read-only. An unauthenticated caller gets the onboarding block and creates no tenant.

  Paramètres, retour & exemple (1)

  Paramètres

  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.

  Exemple d'appel

  {"name": "host.resume", "arguments": {"tenant_key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"host": {}, "notes": [], "tools": [], "tenant": "texte", "last_seen": "texte", "next_call": {}, "runs_open": [], "truncated": {}, "onboarding": {}}}

• host.state.get≈ 442 tokens

  Read one key from this tenant's key-value state namespace. Returns found: false (not an error) if the key was never set.

  Paramètres, retour & exemple (3)

  Paramètres

  • key · string · requis
    Key to read from this tenant's key-value state namespace.
  • end_user · string|null · optionnel
    "self" for the caller's own verified end-user identity, an explicit subject (only when this call carries no end-user identity of its own), or omit/null for the tenant-wide value.
  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.

  Exemple d'appel

  {"name": "host.state.get", "arguments": {"key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"key": "texte", "found": true, "value": "texte", "impersonated": true, "updated_unix": 1}}

• host.state.list≈ 648 tokens

  List keys (with their current values) in this tenant's key-value state namespace, optionally filtered by prefix.

  Paramètres, retour & exemple (4)

  Paramètres

  • limit · integer · optionnel
    Max keys to return; default 100.
  • prefix · string · optionnel
    Only list keys starting with this prefix; default: all keys.
  • end_user · string|null · optionnel
    "self" for the caller's own verified end-user identity, an explicit subject (only when this call carries no end-user identity of its own), or omit/null for the tenant-wide value.
  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.

  Exemple d'appel

  {"name": "host.state.list", "arguments": {"limit": 1, "prefix": "texte", "end_user": "texte", "tenant_key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"data": {}, "keys": []}}

• host.state.set≈ 496 tokens

  Write one key in this tenant's key-value state namespace; value may be any JSON value. Overrun of the plan's state_bytes_max quota fails with state_quota_exceeded and writes nothing.

  Paramètres, retour & exemple (5)

  Paramètres

  • key · string · requis
    Key to write in this tenant's key-value state namespace.
  • value · ? · requis
    Any JSON value to store under key.
  • dry_run · boolean · optionnel
    return the diff this call would make and commit nothing
  • end_user · string|null · optionnel
    "self" for the caller's own verified end-user identity, an explicit subject (only when this call carries no end-user identity of its own), or omit/null for the tenant-wide value.
  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.

  Exemple d'appel

  {"name": "host.state.set", "arguments": {"key": "texte", "value": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"key": "texte", "set": true, "bytes_delta": 1, "impersonated": true}}

• host.tool_call≈ 1758 tokens

  Invoke a tool this tenant has already published, by its local name -- the same real, metered call as calling it directly by its namespaced name (<namespace>.<name>), for a session that has no way to see its own namespaced tool name yet. Unlike host.tool_test, this counts toward host.usage and appears in host.tool_logs. Pass async: true for a tool that needs more than the call deadline: returns {run_id, status: "queued"} immediately instead of running inline -- see host.runs.get/wait. Pass version to pin the call to one of host.tool_history's versions instead of whichever is current.

  Paramètres, retour & exemple (7)

  Paramètres

  • args · object · optionnel
    Arguments to pass, validated against the tool's own args_schema.
  • name · string · requis
    Local name of the tool to invoke.
  • async · boolean · optionnel
    Run as a job instead of inline: returns {run_id, status} within ~50ms under the plan's job_max_s deadline; default false.
  • budget · object · optionnel
    Lowers this call's budget below the plan default: any subset of max_child_calls, max_est_tokens, max_tool_latency_ms, max_wall_ms. A value above the plan's own ceiling is a validation error naming it; see host.runs.get's progress.budget.
  • dry_run · boolean · optionnel
    Ask instead of call: runs every admission check the real call runs, dispatches nothing, writes no call row, and returns {fits, units, remaining, refusal}; same as host.estimate. Default false.
  • version · integer · optionnel
    Pin the call to this version instead of whichever is current; see host.tool_history. An unknown version is an argument error.
  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.

  Exemple d'appel

  {"name": "host.tool_call", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "ok": true, "tz": "texte", "v1": "texte", "msg": "texte", "url": "texte", "args": {}, "body": {}, "kind": "texte", "name": "texte", "next": {}, "rows": []}}

• host.tool_publish≈ 4145 tokens

  Publish a tool of a registered kind (e.g. python, http or echo; the kind argument's enum lists them all) under this tenant's namespace. Call host.quickstart(kind) first for a filled-in example spec and the full publish-to-call sequence. Python's sandbox API: import mcphost (mcphost.table, mcphost.state, mcphost.docs). Name must match ^[a-z][a-z0-9_]{1,40}$; a rejection names the failing field and a corrected example. Try host.tool_test before a real call.

  Paramètres, retour & exemple (9)

  Paramètres

  • kind · string · requis · chain | echo | http | jq | js | python | wasm | event
    Which registered kind to publish under: one of this field's `enum` (host.quickstart with no kind lists every kind, alias and recipe). A job-word alias in the enum also resolves here -- webhook-style words for an inbound webhook, cron-style words for a timed run -- both resolve to kind http and the descriptor comes back with resolved_from naming the alias you asked for. Error contract per kind: chain (families: compose, tool_state; source_line: no); echo (families: none; source_line: no); http (families: upstream; source_line: no); jq (families: tool_code, tool_limit; source_line: no); js (families: tool_code, tool_limit, upstream, compose, tool_state; source_line: yes); python (families: tool_code, tool_limit, upstream, compose, tool_state; source_line: yes); wasm (families: tool_code, tool_limit; source_line: no).
  • name · string · requis
    Local name for the new tool; must match ^[a-z][a-z0-9_]{1,40}$.
  • spec · object · requis
    The kind-specific spec object; see host.quickstart(kind) for a filled-in example. For python's network field: "none" (every plan), "public" (requires the pro plan), "egress" (requires the pro plan) -- a tool's own code reaches this tenant's data with `import mcphost` (mcphost.table, mcphost.state, mcphost.docs, mcphost.lineage) even when network is "none".
  • tags · array · optionnel
    Catalog tags: at most 16, each 1-32 chars of a-z, 0-9 and '-', stored lower-case and deduped.
  • force · boolean · optionnel
    Publish a chain whose mapping can never resolve (verdict will_fail) anyway; the response's gates entry then carries forced: true. Default false.
  • scopes · array · optionnel
    OAuth scopes a token must carry (directly, or via mcp) to reach this tool: catalogued names from host.oauth.scopes, or the built-ins read/write. At most 8. Omit (or [] ) to require only mcp -- unaffected by any catalog.
  • dry_run · boolean · optionnel
    return the diff this call would make and commit nothing
  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.
  • visibility · string · optionnel · private | unlisted | public
    Who may find the tool (default private). unlisted: callable by full name and readable by host.catalog.get, never listed. public: listed in the catalog, and refused (untested_tool_cannot_be_public) unless the current version passes its dry run first. Use host.tool_share for group or url.

  Exemple d'appel

  {"name": "host.tool_publish", "arguments": {"kind": "chain", "name": "texte", "spec": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "hint": "texte", "kind": "texte", "lock": {}, "name": "texte", "next": {}, "gates": [], "steps": [], "reason": "texte", "verdict": "texte", "version": 1, "evidence": []}}

• host.tool_share≈ 886 tokens

  Share one of this tenant's published tools with everyone (visibility: "public") or with a named group this tenant owns (visibility: "group", group: <name>). The tool keeps running in this tenant's own sandbox with this tenant's own secrets; a caller reaches it as <this tenant's namespace>.<name>.

  Paramètres, retour & exemple (9)

  Paramètres

  • name · string · requis
    Local name of the tool to share.
  • tags · array · optionnel
    Catalog tags merged into the tool's existing ones (same rules as host.tool_publish).
  • group · string · optionnel
    Required when visibility is "group"; must already exist (host.group.create).
  • scopes · array · optionnel
    What the grantee may do: call, read_source, fork. Default ["call"] (["call","read_source"] with expose_spec: true). url shares allow only call.
  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.
  • visibility · string · requis · unlisted | group | public | url
    "public" (needs a passing dry run of the current version), "unlisted", "group" or "url".
  • description · string · optionnel
    Catalog-facing blurb; shown by host.catalog.search/get.
  • expose_spec · boolean · optionnel
    Default false. When true, any tenant this tool is shared with may call host.tool_spec_shared to read its (redacted) spec.
  • rate_per_hour_per_caller · integer · optionnel
    Optional cap (1..10000) on calls per hour from any one grantee.

  Exemple d'appel

  {"name": "host.tool_share", "arguments": {"name": "texte", "visibility": "unlisted"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"url": "texte", "name": "texte", "next": {}, "group": "texte", "visibility": "texte", "description": "texte", "expose_spec": true, "welcome_back": {}}}

• host.tool_test≈ 2034 tokens

  Dry-run a published tool by name: verdict (pass/will_fail/unverifiable), writes rolled back (dry_run); see host.quickstart.

  Paramètres, retour & exemple (4)

  Paramètres

  • args · object · optionnel
    Arguments to pass, same shape as a real call. Omit to run one example generated from the tool's args_schema; the response then carries example_args (what ran) and untyped (keys the schema gave no type for).
  • name · string · requis
    Local name of the already-published tool to dry-run.
  • fixtures · object · optionnel
    Chain tools only: {"<step number or tool name>": <recorded result>}. A fixtured step executes nothing (no upstream call); later mappings resolve against it. host.runs.get(run_id, as_fixtures=true) exports a real run in this shape.
  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.

  Exemple d'appel

  {"name": "host.tool_test", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "ok": true, "tz": "texte", "msg": "texte", "args": {}, "kind": "texte", "line": 1, "name": "texte", "next": {}, "tool": "texte", "error": "texte", "outer": {}}}

• host.whoami≈ 1230 tokens

  Return the calling tenant's identity, including key_age_s and key_rotated_at for auditing credential hygiene.

  Paramètres, retour & exemple (1)

  Paramètres

  • tenant_key · string · optionnel
    The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connection with no Authorization: Bearer header and no prior signup, omitting it implicitly signs that connection up as a brand-new tenant and runs this call as it -- see host.whoami's source field. When both a header and this argument are present, the header wins.

  Exemple d'appel

  {"name": "host.whoami", "arguments": {"tenant_key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"key": {}, "hint": "texte", "next": {}, "plan": "texte", "admin": true, "links": {}, "owner": {}, "source": "texte", "tenant": "texte", "clients": [], "subject": "texte", "disabled": true}}

• signup≈ 256 tokens

  Explicit signup, for a client that cannot keep a session across calls: create a tenant and receive a bearer key and namespace. Unauthenticated. Most clients never need this -- any other host.*/billing.* call from a fresh connection creates a tenant implicitly and returns its own /u/<secret>/mcp URL in the response's onboarding field. Recommended here: pass handoff: true to receive a short-lived, single-use handoff_token instead of the raw key -- redeem it once with host.redeem to get the key, so a transcript of this call and the redeem call, if it leaks, carries a dead credential. The raw-key path (handoff omitted) stays fully supported.

  Paramètres, retour & exemple (2)

  Paramètres

  • name · string · requis
    display name
  • handoff · boolean · optionnel
    Recommended: true to receive a handoff_token (redeem via host.redeem) instead of the raw key. Default false (raw key, unchanged).

  Exemple d'appel

  {"name": "signup", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mcphost.dev/mcp