PrivateDAO Agent Exchange

by X-PACT · remote · no sign-in to list tools · v1.0.0 · published by GitHub user X-PACT

Solana Mainnet verification, intelligence, machine receipts, and agent logistics through MCP.

Deletes · 3Final · 1Changes · 15

Compare Registry entry

27 tools: 3 can delete or cancel things, 1 do something that can't be undone, 15 change things and 8 only read.

Scanned Oct 21, 2026

Deletes or cancels3Claude Code: deny: see these tools
Can't be undone1Claude Code: ask: see these tools
Changes things15Claude Code: ask: see these tools
Only reads8Claude Code: allow: see these tools

3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http pdao-agent-exchange https://agents.privatedao.org/mcp

Findings

Matches of fixed checks, with the text they matched.

2 warn1 info

Warnexchange_overview
The server marks "exchange_overview" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "start": a word for a change.
What this check looks for
Warnpayment_guide
The server marks "payment_guide" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_guide" says "payment": a word that usually means money moves, which cannot be taken back.
What this check looks for
Infoprovider_integrations
The input schema at description mentions "credentials".
Matched text
inputSchema.description: "...ecosystem integration without exposing credentials."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

27 tools

Deletes or cancels 3Removes, cancels or revokes something.Claude Code: deny

privatepay_settleSettle an x402 v2 PrivatePAY payload through the configured facilitator.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Settle an x402 v2 PrivatePAY payload through the configured facilitator. This tool is destructive and remains disabled until production activation is explicitly approved.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
seller_retirePrivateDAO seller_retireReads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
PrivateDAO seller_retire
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
submit_paymentPrivateDAO submit_paymentNo findings
Why it is in this group
- The name "submit_payment" says "submit": a word for a change.
- The name "submit_payment" also says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
PrivateDAO submit_payment
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

payment_guideExplain PDAO holder access and the quote-first Solana Mainnet USDC payment flow.1 finding
Why it is in this group
- The name "payment_guide" says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "payment_guide" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_guide" says "payment": a word that usually means money moves, which cannot be taken back.
  What this check looks for
Description, as the server wrote it
Explain PDAO holder access and the quote-first Solana Mainnet USDC payment flow. Never infer an amount, never pay before a payment_intent, and never request a private key.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Changes things 15Creates or changes something that can be changed back.Claude Code: ask

agent_matchFree registry discovery and capability matching.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Free registry discovery and capability matching. Use create_paid_job for the paid agent.match service.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
create_paid_jobPrivateDAO create_paid_jobNo findings
Why it is in this group
- The name "create_paid_job" says "create": a word for a change.
Description, as the server wrote it
PrivateDAO create_paid_job
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
exchange_overviewStart here.1 finding
Why it is in this group
- The description's first verb is "start": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "exchange_overview" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "start": a word for a change.
  What this check looks for
Description, as the server wrote it
Start here. Explain the PrivateDAO Agent Exchange, including PDAO utility and verified holder access, then distinguish it from quote-first USDC execution for ordinary paid jobs.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
external_servicesPrivateDAO external_servicesReads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
PrivateDAO external_services
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
logistics_requestPrivateDAO logistics_requestReads text others writeNo findings
Why it is in this group
- The name "logistics_request" says "request": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
PrivateDAO logistics_request
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
network_statsPrivateDAO network_statsReads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
PrivateDAO network_stats
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
privatepay_challengeRequest a PrivatePAY x402 privacy-preserving challenge.No findings
Why it is in this group
- The description's first verb is "request": a word for a change.
Description, as the server wrote it
Request a PrivatePAY x402 privacy-preserving challenge. This operation fails closed until the reviewed rail is configured and enabled.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
privatepay_preparePrepare a real unsigned MagicBlock private transfer after a PrivatePAY challenge.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Prepare a real unsigned MagicBlock private transfer after a PrivatePAY challenge. The agent must inspect it and sign locally; PrivateDAO never receives a private key and this tool never broadcasts.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
privatepay_verifyVerify an x402 v2 PrivatePAY payload through the configured facilitator.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Verify an x402 v2 PrivatePAY payload through the configured facilitator. This is fail-closed until exact scheme and network conformance is independently verified.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
receipt_verifyVerify a PrivateDAO receipt digest and return a machine-readable verification result.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Verify a PrivateDAO receipt digest and return a machine-readable verification result. This is free and read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
register_agentPrivateDAO register_agentReads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.endpoint): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
PrivateDAO register_agent
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
seller_replace_endpointPrivateDAO seller_replace_endpointReads text others writeNo findings
Why it is in this group
- The name "seller_replace_endpoint" says "replace": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
PrivateDAO seller_replace_endpoint
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
seller_update_servicesPrivateDAO seller_update_servicesReads text others writeNo findings
Why it is in this group
- The name "seller_update_services" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
PrivateDAO seller_update_services
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
service_recommendationMap a natural-language task to the best available PrivateDAO services.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Map a natural-language task to the best available PrivateDAO services. Use this before create_paid_job when the user has not named a service ID.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
verify_basicPrivateDAO verify_basicNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
PrivateDAO verify_basic
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Only reads 8Looks things up and changes nothing.Claude Code: allow

execution_guideExplain how to create a free or paid job, interpret 402 payment_intent, submit finalized payment proof, poll status, retrieve a receipt and verify it.No findings
Why it is in this group
- The description's first verb is "explain": a word for reading.
Description, as the server wrote it
Explain how to create a free or paid job, interpret 402 payment_intent, submit finalized payment proof, poll status, retrieve a receipt and verify it.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_receiptPrivateDAO get_receiptNo findings
Why it is in this group
- The name "get_receipt" says "get": a word for reading.
Description, as the server wrote it
PrivateDAO get_receipt
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
job_statusPrivateDAO job_statusNo findings
Why it is in this group
- The name "job_status" says "status": a word for reading.
Description, as the server wrote it
PrivateDAO job_status
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
pdao_servicesReturn the complete current catalog with service IDs, customer value, category, pricing, inputs, outputs, target networks and payment behavior.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it
Return the complete current catalog with service IDs, customer value, category, pricing, inputs, outputs, target networks and payment behavior.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
privatepay_statusShow whether PrivatePAY x402 has a configured confidential privacy rail, facilitator, and confidential mint.No findings
Why it is in this group
- The name "privatepay_status" says "status": a word for reading.
Description, as the server wrote it
Show whether PrivatePAY x402 has a configured confidential privacy rail, facilitator, and confidential mint. Explain the public-chain privacy boundary without claiming anonymity.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
product_catalogReturn the current product packages with buyer, price, included services, target networks and exact batch checkout path.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it
Return the current product packages with buyer, price, included services, target networks and exact batch checkout path.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
provider_integrationsExplain what IBM watsonx, Intel OpenVINO, MongoDB, GitHub, ChatGPT, Claude, Grok, OpenClaw and the PrivateDAO Kernel add to the ecosystem, with relationship disclosures and safe pr…1 finding
Why it is in this group
- The description's first verb is "explain": a word for reading.
Findings
- Info
  The input schema at description mentions "credentials".
  Matched text
  inputSchema.description: "...ecosystem integration without exposing credentials."
  What this check looks for
Description, as the server wrote it
Explain what IBM watsonx, Intel OpenVINO, MongoDB, GitHub, ChatGPT, Claude, Grok, OpenClaw and the PrivateDAO Kernel add to the ecosystem, with relationship disclosures and safe provider status.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_agentsPrivateDAO search_agentsReads text others writeNo findings
Why it is in this group
- The name "search_agents" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
PrivateDAO search_agents
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write9: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; agent_match
external_services
logistics_request
network_stats
register_agent
search_agents
seller_replace_endpoint
seller_retire
seller_update_services
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; register_agent

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:55 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 21
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: none
RFC 9728 protected resource metadata: none
Authorization servers: none
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

HighThe whole server
The endpoint served tools/list without credentials, and the list has 21 tools that change things (4 destructive, 1 irreversible, 16 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://agents.privatedao.org/mcp: tools/list returned 29 tools to an anonymous client, including privatepay_settle (destructive), privatepay_job_payment (destructive), submit_payment (destructive), seller_retire (destructive), payment_guide (irreversible) and 16 more
What this check looks for

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http pdao-agent-exchange https://agents.privatedao.org/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__pdao-agent-exchange__pdao_services",
      "mcp__pdao-agent-exchange__product_catalog",
      "mcp__pdao-agent-exchange__provider_integrations",
      "mcp__pdao-agent-exchange__execution_guide",
      "mcp__pdao-agent-exchange__privatepay_status",
      "mcp__pdao-agent-exchange__job_status",
      "mcp__pdao-agent-exchange__get_receipt",
      "mcp__pdao-agent-exchange__search_agents"
    ],
    "ask": [
      "mcp__pdao-agent-exchange__exchange_overview",
      "mcp__pdao-agent-exchange__service_recommendation",
      "mcp__pdao-agent-exchange__payment_guide",
      "mcp__pdao-agent-exchange__privatepay_challenge",
      "mcp__pdao-agent-exchange__privatepay_prepare",
      "mcp__pdao-agent-exchange__privatepay_verify",
      "mcp__pdao-agent-exchange__verify_basic",
      "mcp__pdao-agent-exchange__receipt_verify",
      "mcp__pdao-agent-exchange__create_paid_job",
      "mcp__pdao-agent-exchange__register_agent",
      "mcp__pdao-agent-exchange__agent_match",
      "mcp__pdao-agent-exchange__logistics_request",
      "mcp__pdao-agent-exchange__network_stats",
      "mcp__pdao-agent-exchange__external_services",
      "mcp__pdao-agent-exchange__seller_update_services",
      "mcp__pdao-agent-exchange__seller_replace_endpoint"
    ],
    "deny": [
      "mcp__pdao-agent-exchange__privatepay_settle",
      "mcp__pdao-agent-exchange__submit_payment",
      "mcp__pdao-agent-exchange__seller_retire"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as pdao-agent-exchange. Review it before you use it.

Capability tags behind 9 rules

mcp__pdao-agent-exchange__search_agents untrusted-input
mcp__pdao-agent-exchange__register_agent untrusted-input, outbound
mcp__pdao-agent-exchange__agent_match untrusted-input
mcp__pdao-agent-exchange__logistics_request untrusted-input
mcp__pdao-agent-exchange__network_stats untrusted-input
mcp__pdao-agent-exchange__external_services untrusted-input
mcp__pdao-agent-exchange__seller_update_services untrusted-input
mcp__pdao-agent-exchange__seller_replace_endpoint untrusted-input
mcp__pdao-agent-exchange__seller_retire untrusted-input

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.X-PACT/pdao-agent-exchange/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

19 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:22 UTC.

For agents: Markdown · JSON · report this listing