Skip to content

DeAI Artifact Gateway

by jake-zaiba · remote · no sign-in to list tools · v0.2.3 · published by GitHub user jake-zaiba

Verified-artifact library: match, ask, run fixture programs, reuse sealed pages (HTTP 402 toll).

Changes · 11

13 tools: 11 change things and 2 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http deai-research https://research.zaiba.cloud/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • The server marks "run_program" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "run_program" says "run": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

13 tools

Changes things 11Claude Code: ask
  • answerExtractive by default: the best verified claims for the question assembled with fixed connectives, each quote verbatim with a [n] marker, a Signed citation receipt per claim, and t…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Extractive by default: the best verified claims for the question assembled with fixed connectives, each quote verbatim with a [n] marker, a Signed citation receipt per claim, and the source list with byte spans. When this node runs a local 1.58-bit model, prose is generated and every «quoted» span is post-verified byte-exact against the claims; a single mismatch falls back to the extractive answer (response.mode says which). Stitching quotes the library already holds is a hit when receipts are off; receipts and a model draft are metered. Free when no verified claim matches. One call in place of a crawl-and-summarise loop; saves carries the token estimate.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • askWhen to call: you have a question or a payload and want the cheapest verified step.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    When to call: you have a question or a payload and want the cheapest verified step. MATCH lists program classes and pages (free without input). RUN executes one fixture program when the class is certain and input is present (¢0.1). Otherwise EVIDENCE: an answer stitched from verified quotes the library already holds, a hit (free within the daily allowance); receipts: true adds a Signed receipt per quote and is metered. Set allow_escalate only to send YOUR ask to YOUR engine. A miss names research/deposit with prices. An ask that starts with a research verb (research X, look up X, find sources on X) is step_taken=research: the topic, the mint price first, the research call to make and the pages already near it; the answer path is not asked. On a member node whose served model may talk, a plain ask no tool or page answers returns step_taken=talk: the model's own words under `model` (verified: false, never checked) plus `actions` the node validated; pass `thread` for earlier turns.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • attestmode=attest: a C2PA sidecar manifest per sealed claim (by claim_id, claim_ids, slug for a whole page, or cid+span) whose hard binding is the SHA-256 of the exact quoted bytes, with…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    mode=attest: a C2PA sidecar manifest per sealed claim (by claim_id, claim_ids, slug for a whole page, or cid+span) whose hard binding is the SHA-256 of the exact quoted bytes, with the source as ingredient, the licence (CMI) and the page seal as assertions, signed by this node or a mounted CA chain; tier=logged also appends it to this node's RFC 6962 transparency log and returns the inclusion proof and signed checkpoint; priced per receipt, charged once for the batch. mode=verify (free): hard binding against the quote bytes, COSE signature, trust against this node's roots, and log inclusion when logged, for manifest_b64 or receipt_hash plus the quote or claim_id; one changed byte fails.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • matchSealed pages ranked against a task with reuse / repair / mint price quotes and the token saving each pack represents.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Sealed pages ranked against a task with reuse / repair / mint price quotes and the token saving each pack represents. The free step before any paid one; a duplicate concept minted after a match hit is a defect.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • package_checkRegistry metadata for an npm, PyPI or crates.io package name before an install: exists, first published, latest version, version count, maintainers, weekly downloads, licence, repo…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Registry metadata for an npm, PyPI or crates.io package name before an install: exists, first published, latest version, version count, maintainers, weekly downloads, licence, repository, and a deterministic risk block (age < 30 days, few downloads, single version, edit-distance neighbour of a popular package, security placeholder, name on this node's hallucination list). Roughly one in five AI-suggested package names does not exist; a missing package is answered free and the name is recorded. Metadata only, never a tarball.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • programsBefore you write a transform, list the public fixture programs (sort/dedup/json/csv/case/date/extract…), authored oracles, and composites.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Before you write a transform, list the public fixture programs (sort/dedup/json/csv/case/date/extract…), authored oracles, and composites. Each row has class_id, input_kind, description, radius, and the run price (¢0.1). Pass class_id for the full artifact. Free; no user text in any program.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • researchA sealed research job: named shards (arXiv, OpenAlex, Crossref, Europe PMC, Wikipedia, standards and docs) collected, grafted, reviewed and woven into a signed page every later age…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    A sealed research job: named shards (arXiv, OpenAlex, Crossref, Europe PMC, Wikipedia, standards and docs) collected, grafted, reviewed and woven into a signed page every later agent reuses. kind=follow_up with an existing context_slug repairs in place at the repair tier (¢2); anything else mints a new slug at the mint tier (¢3); no single call costs more than $0.05. An unpaid call returns status=payment_required. The result carries job_id, poll and wiki URLs; the seal takes minutes.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • run_programDeterministic verified transform (sort/dedup/json/csv/case/date/extract…) re-executed on your input; ¢0.1; returns output + receipt.1 finding

    Why it is in this group

    • The name "run_program" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "run_program" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "run_program" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Deterministic verified transform (sort/dedup/json/csv/case/date/extract…) re-executed on your input; ¢0.1; returns output + receipt. Call match or programs first to find the class.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • surveyA strength rating 1–5 (optionally useful, accurate, note) for a sealed page, so the next agent shops by measured utility.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    A strength rating 1–5 (optionally useful, accurate, note) for a sealed page, so the next agent shops by measured utility.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • thinSealed pages that are thin, unreviewed, or woven to nothing, loneliest first, each with the exact research arguments that repair it and the repair price.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Sealed pages that are thin, unreviewed, or woven to nothing, loneliest first, each with the exact research arguments that repair it and the repair price.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • workOne tool, five modes.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    One tool, five modes. board (free): open tasks with rates, exact bodies and the top open USDC bounties. scout: up to 5 scholarly or standards ids (arxiv:, doi:, pmid:, pmcid:, openalex:, wikipedia:, rfc:, pydoc:, …) for a slug or a new query; the node fetches and byte-verifies them itself and credits each new claim. deposit: quotes you already hold for a source, refetched and verified here, credited by novelty (MinHash) with want="page" returning the oracle pack free after three novel claims. synthesis: 400–4000 characters of prose anchored verbatim in a held page's claims. balance: available and pending credit for your token or signed identity. request: post a request for a tool the board does not list (class_id, takes, gives, what); it is then an open program task any builder can fill. Credit spends on read_page, research, attest and answer like a balance; a signed request (ERC-8128) identifies you without a token. bounty_id links a delivery to an on-chain bounty.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 2Claude Code: allow
  • densityA snapshot of the mesh: held / thin / isolated counts, links, catalog size, what the toll has collected, treasury, bounties, federation, funnel and gardener status.No findings

    Why it is in this group

    • The description's first verb is "snapshot": a word for reading.
    Description, as the server wrote it
    A snapshot of the mesh: held / thin / isolated counts, links, catalog size, what the toll has collected, treasury, bounties, federation, funnel and gardener status. The baseline to measure work against.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • read_pageThe sealed oracle pack for a slug as deterministic JSON: markdown, verified claims with byte-exact quotes and spans, source CIDs, licence (CMI), receipt hashes, review, labels, str…No findings

    Why it is in this group

    • The name "read_page" says "read": a word for reading.
    Description, as the server wrote it
    The sealed oracle pack for a slug as deterministic JSON: markdown, verified claims with byte-exact quotes and spans, source CIDs, licence (CMI), receipt hashes, review, labels, strength. Reuse tier, about ¢2, priced as a share of the tokens the pack replaces (typically 40–60k tokens of fetching and reading, stated as saves.tokens next to the price). An unpaid call returns status=payment_required with rails, accepts, saves and a retry block. Stubs are free.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.2.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http deai-research https://research.zaiba.cloud/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__deai-research__density",
      "mcp__deai-research__read_page"
    ],
    "ask": [
      "mcp__deai-research__thin",
      "mcp__deai-research__match",
      "mcp__deai-research__ask",
      "mcp__deai-research__programs",
      "mcp__deai-research__run_program",
      "mcp__deai-research__research",
      "mcp__deai-research__survey",
      "mcp__deai-research__work",
      "mcp__deai-research__package_check",
      "mcp__deai-research__attest",
      "mcp__deai-research__answer"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as deai-research. Review it before you use it.