io.github.mnemom/mnemom

Est-ce que io.github.mnemom/mnemom est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.mnemom/mnemom » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 15 outils

• claim_agent≈ 439 tokens

  Claim a verifiable identity — bind an agent to your organization so its trust and accountability record is provably yours. Requires the agent's possession proof (`hash_proof`). Re-claiming an agent you already own keeps its original claim date but files it under the organization you pass (`org_id`; if omitted, your personal organization), which can change the organization that owns and bills it.

  Paramètres, retour & exemple (3)

  Paramètres

  • org_id · string · optionnel
    Optional. The organization to claim the agent into (e.g. `org-...` or `pers-...`). The caller must be a member of this org (role floor: member). If omitted, the agent is claimed into the caller's personal org.
  • agent_id · string · requis
    Agent identifier (e.g. smolt-abc123)
  • hash_proof · string · requis
    Agent possession proof — either the live birth token (`mnbt_…`) whose row pins this agent's hash, or the full 64-hex SHA-256 digest of `${apiKey}|${agentName}` (or `${apiKey}` for an unnamed singleton agent).

  Exemple d'appel

  {"name": "claim_agent", "arguments": {"agent_id": "texte", "hash_proof": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"org_id": "texte", "claimed": true, "agent_id": "texte", "claimed_at": "texte"}}

• get_agent≈ 886 tokens

  Look up an agent's public identity and trust state by ID — the accountable record other agents and humans can rely on.

  Paramètres, retour & exemple (1)

  Paramètres

  • agent_id · string · requis
    Agent identifier (e.g. smolt-abc123)

  Exemple d'appel

  {"name": "get_agent", "arguments": {"agent_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "name": "texte", "caller": "anonymous", "groups": [], "org_id": "texte", "public": true, "status": "active", "claimed": true, "last_seen": "texte", "agent_hash": "texte", "avatar_url": "texte", "claimed_at": "texte"}}

• get_reputation≈ 2658 tokens

  Look up an AI agent's published Trust Rating — Mnemom's portable reliability signal for autonomous software, computed from the agent's own verified activity record. Returns the rating plus the technical factors behind it. Free, public, read-only: ratings are public by default, unless the agent's owner has opted out.

  Paramètres, retour & exemple (1)

  Paramètres

  • agent_id · string · requis
    Agent identifier (e.g. smolt-abc123)

  Exemple d'appel

  {"name": "get_reputation", "arguments": {"agent_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"tier": "texte", "grade": "texte", "score": 1, "claimed": true, "agent_id": "texte", "trend_30d": 1, "agent_name": "texte", "components": [], "confidence": "insufficient", "visibility": "public", "computed_at": "texte", "is_eligible": true}}

• get_reputation_badge≈ 353 tokens

  Get an embeddable Trust Rating badge for an agent — returns the badge image URL plus ready-to-paste Markdown and HTML snippets for a README or agent card.

  Paramètres, retour & exemple (1)

  Paramètres

  • agent_id · string · requis
    Agent identifier (e.g. smolt-abc123)

  Exemple d'appel

  {"name": "get_reputation_badge", "arguments": {"agent_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"agent_id": "texte", "badge_url": "texte", "html_embed": "texte", "profile_url": "texte", "verified_url": "texte", "markdown_embed": "texte"}}

• get_started≈ 1413 tokens

  Zero-auth, no-args orientation: who Mnemom is, the surface map, how to authenticate and what it unlocks, and the tools to try right now (scan_trust and the reputation lookups).

  Paramètres, retour & exemple (1)

  Paramètres

  • token · string · optionnel
    Optional Dojo try-me invite token. When supplied and valid, returns the token-gated dojo briefing manifest (the same content as GET /v1/dojo/try-me/resolve); omit for public orientation.

  Exemple d'appel

  {"name": "get_started", "arguments": {"token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"who": "texte", "verify": "texte", "try_now": [], "doctrine": "texte", "skill_path": {}, "value_prop": "texte", "surface_map": {}, "authenticate": {}, "developer_path": {}, "showcase_agent": {}, "sovereignty_path": {}, "visibility_model": {}}}

• list_agents≈ 1014 tokens

  List the agents your account owns, with pagination (`limit`, `offset`). Read-only.

  Paramètres, retour & exemple (2)

  Paramètres

  • limit · integer · optionnel
    How many agents to return, 1-100.
  • offset · integer · optionnel
    How many agents to skip, for pagination.

  Exemple d'appel

  {"name": "list_agents", "arguments": {"limit": 1, "offset": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"scope": "active", "agents": []}}

• preview_compose_alignment_by_agent≈ 1976 tokens

  Dry-run an alignment card: shows the card that would result after merging with the platform, organization and team policies above it, plus any conflicts. Nothing is saved.

  Paramètres, retour & exemple (8)

  Paramètres

  • audit · object · requis
    How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)
  • values · object · requis
    The values this agent declares it is bound by. Required.
  • agent_id · string · requis
    The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
  • autonomy · object · requis
    What the agent may do on its own authority. Required.
  • principal · object · requis
    Whose authority this agent acts under. Required.
  • card_version · string · requis
    Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`.
  • autonomy_mode · string · requis · off | observe | nudge | enforce
    Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks.
  • integrity_mode · string · requis · off | observe | nudge | enforce
    Master switch for the values pipeline. Required. Same four states as `autonomy_mode`.

  Exemple d'appel

  {"name": "preview_compose_alignment_by_agent", "arguments": {"audit": {}, "values": {}, "agent_id": "texte", "autonomy": {}, "principal": {}, "card_version": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "summary": "texte", "full_report": "texte", "conflicts_count": 1, "composition_valid": true}}

• preview_compose_protection_by_agent≈ 2036 tokens

  Dry-run a protection card: shows the card that would result after merging with the platform, organization and team policies above it, plus any conflicts. Nothing is saved, and no publish grant is needed.

  Paramètres, retour & exemple (7)

  Paramètres

  • mode · string · requis · off | observe | nudge | enforce
    Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.
  • agent_id · string · requis
    The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
  • thresholds · object · requis
    Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it.
  • card_version · string · requis
    Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.
  • screen_surfaces · object · requis
    Which traffic surfaces are screened. Required, with all four flags set.
  • trusted_sources · object · requis
    Sources exempt from screening. Required, with all three lists present; send empty lists to trust nothing extra. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.
  • protected_surface · object · optionnel
    The assets and operations this agent must protect. Omit to accept the composed default (empty surface).

  Exemple d'appel

  {"name": "preview_compose_protection_by_agent", "arguments": {"mode": "off", "agent_id": "texte", "thresholds": {}, "card_version": "texte", "screen_surfaces": {}, "trusted_sources": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "summary": "texte", "full_report": "texte", "conflicts_count": 1, "composition_valid": true}}

• put_alignment_by_agent≈ 1928 tokens

  Publish or replace an agent's alignment card: its governance modes, the principal it acts for, its declared values, the actions it may take on its own, and its audit policy. The server merges the card with the platform, organization and team policies above it and stores the result. Use preview_compose_alignment_by_agent to dry-run first.

  Paramètres, retour & exemple (8)

  Paramètres

  • audit · object · requis
    How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)
  • values · object · requis
    The values this agent declares it is bound by. Required.
  • agent_id · string · requis
    The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
  • autonomy · object · requis
    What the agent may do on its own authority. Required.
  • principal · object · requis
    Whose authority this agent acts under. Required.
  • card_version · string · requis
    Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`.
  • autonomy_mode · string · requis · off | observe | nudge | enforce
    Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks.
  • integrity_mode · string · requis · off | observe | nudge | enforce
    Master switch for the values pipeline. Required. Same four states as `autonomy_mode`.

  Exemple d'appel

  {"name": "put_alignment_by_agent", "arguments": {"audit": {}, "values": {}, "agent_id": "texte", "autonomy": {}, "principal": {}, "card_version": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "card_id": "texte", "issued_at": "texte"}}

• put_protection_by_agent≈ 2052 tokens

  Publish or replace an agent's protection card (screening mode, thresholds, trusted sources, protected assets). When connected by OAuth sign-in (e.g. ChatGPT), each publish first needs a one-time grant from the same signed-in account: open https://www.mnemom.ai/authorize-protection?agent_id=<agent_id>, approve, then publish within 15 minutes (each grant covers one publish). Required: agent_id, card_version, mode, thresholds, screen_surfaces and trusted_sources (protected_surface is optional); mode `enforce` also needs Safe House on the organization. Use preview_compose_protection_by_agent to dry-run without a grant.

  Paramètres, retour & exemple (7)

  Paramètres

  • mode · string · requis · off | observe | nudge | enforce
    Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.
  • agent_id · string · requis
    The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
  • thresholds · object · requis
    Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it.
  • card_version · string · requis
    Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.
  • screen_surfaces · object · requis
    Which traffic surfaces are screened. Required, with all four flags set.
  • trusted_sources · object · requis
    Sources exempt from screening. Required, with all three lists present; send empty lists to trust nothing extra. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.
  • protected_surface · object · optionnel
    The assets and operations this agent must protect. Omit to accept the composed default (empty surface).

  Exemple d'appel

  {"name": "put_protection_by_agent", "arguments": {"mode": "off", "agent_id": "texte", "thresholds": {}, "card_version": "texte", "screen_surfaces": {}, "trusted_sources": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "card_id": "texte", "issued_at": "texte"}}

• report_recipe_fn_fp≈ 575 tokens

  Submit a false-positive / false-negative correction for one of Mnemom's automated detection rules (a 'recipe') — technical feedback that improves detection accuracy, like filing a bug report against a spam filter.

  Paramètres, retour & exemple (5)

  Paramètres

  • type · string · requis · fn | fp
    `fn` = false negative (the recipe should have fired). `fp` = false positive (it fired on legitimate behaviour).
  • summary · string · requis
    A short description of what the recipe got wrong — what it flagged, or what it missed, and why that was incorrect. DESCRIBE the misfire; do NOT paste the conversation, the prompt, the raw payload or the log that triggered it. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.
  • agent_id · string · optionnel
    Optional. The agent the report concerns. Identifier only.
  • recipeId · string · requis
    The detection recipe the report is filed against (the one that misfired or failed to fire). Identifier only.
  • checkpoint_id · string · optionnel
    Optional. The related integrity checkpoint, so the reviewer can correlate. Identifier only.

  Exemple d'appel

  {"name": "report_recipe_fn_fp", "arguments": {"type": "fn", "summary": "texte", "recipeId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "type": "fn", "candidate_id": "texte", "related_recipe_id": "texte"}}

• scan_trust≈ 1044 tokens

  Scan a website's agent-trust-readiness and return a signed scorecard (Trust, plus an Access axis on newer rubrics). Zero-auth. Results are CACHED for up to 24h — check `cached` and `scannedAt` on the result; pass `fresh: true` to force a re-scan (rate-limited). Proxies to the SSRF-locked isittrustready scanner; the Ed25519 signature + permalink are preserved verbatim. Rubric + docs: https://www.isittrustready.ai/rubric and https://docs.mnemom.ai/.

  Paramètres, retour & exemple (2)

  Paramètres

  • url · string · requis
    Domain or URL to scan, e.g. "example.com" or "https://example.com".
  • fresh · boolean · optionnel
    Force a fresh re-scan instead of the cached result (results are cached up to 24h; the engine rate-limits re-scans). Equivalent to the scanner's rescan flag.

  Exemple d'appel

  {"name": "scan_trust", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"grade": "texte", "score": 1, "access": {}, "cached": true, "schema": "texte", "target": "texte", "permalink": "texte", "scannedAt": "texte", "signature": {}, "categories": [], "verification": {}, "rubricVersion": "texte"}}

• search_reputation_directory≈ 1657 tokens

  Resolve an agent name or id-prefix to a real agent_id over the PUBLIC reputation directory (only agents whose reputation visibility is public). Zero-auth. The arriving-agent entry point: discover a concrete agent_id, then call get_reputation / verify_reputation on it.

  Paramètres, retour & exemple (6)

  Paramètres

  • q · string · optionnel
    Name search (ilike) or agent-id prefix match.
  • page · integer · optionnel
    1-based page number for pagination. Default 1.
  • sort · string · optionnel
    Result ordering. Default "score" (highest-rated first); other supported keys order by recency or name.
  • grade · string · optionnel
    Filter to one grade (e.g. `AAA`, `B`, `NR`).
  • per_page · integer · optionnel
    Number of results per page. 1–100, default 20.
  • confidence · string · optionnel · high | medium | low | insufficient
    Filter to agents at a given reputation-confidence level (driven by how much evidence backs the score).

  Exemple d'appel

  {"name": "search_reputation_directory", "arguments": {"q": "texte", "page": 1, "sort": "texte", "grade": "texte", "per_page": 1, "confidence": "high"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"page": 1, "total": 1, "agents": [], "per_page": 1}}

• verify_reputation≈ 369 tokens

  Attest an agent's Trust Rating — returns a Merkle-root + hash-chain attestation (hash_chain_valid) proving the rating derives from an unbroken, append-only checkpoint chain, plus a pointer to the signed integrity certificate. This is a chain-integrity attestation, NOT an in-band Ed25519 signature check (that parity is verify_scan, for website scorecards).

  Paramètres, retour & exemple (1)

  Paramètres

  • agent_id · string · requis
    Agent identifier (e.g. smolt-abc123)

  Exemple d'appel

  {"name": "verify_reputation", "arguments": {"agent_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"grade": "texte", "score": 1, "agent_id": "texte", "computed_at": "texte", "verification": {}}}

• verify_scan≈ 1184 tokens

  Verify a website scan scorecard's Ed25519 signature IN-BAND (verify, don't trust). Pass a `scan` (a scorecard from scan_trust) or a `url` to re-scan; returns {verified, key_id, canonicalization} checked against the public key at mnemom://iitr/jwks. Zero-auth. Spec + rubric: https://www.isittrustready.ai/rubric and https://docs.mnemom.ai/.

  Paramètres, retour & exemple (2)

  Paramètres

  • url · string · optionnel
    Alternatively, a domain/URL to re-scan and then verify.
  • scan · object · optionnel
    A scan scorecard previously returned by scan_trust (or iitr's /r/ JSON), passed back verbatim to verify. Same shape as scan_trust's result; the signature is checked against mnemom://iitr/jwks.

  Exemple d'appel

  {"name": "verify_scan", "arguments": {"url": "texte", "scan": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"key_id": "texte", "reason": "texte", "verified": true, "algorithm": "texte", "scorecard": {}, "canonicalization": "texte"}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://api.mnemom.ai/mcp?profile=directory