AB[500] research and bounties

by maxand98 · remote · no sign-in to list tools · v1.2.0 · published by GitHub user maxand98

Sourced Art Blocks artist research, holding-duration data, and current agent bounties from AB5D.

Changes · 1

Compare Registry entry

21 tools: 1 change things and 20 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things1Claude Code: ask: see these tools
Only reads20Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http ab500-research https://ab5d.xyz/mcp

Findings

Matches of fixed checks, with the text they matched.

1 info

Infoget_abx_service_info
The description mentions "credentials".
Matched text
description: "...gister projects, sign, deploy or create credentials."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

21 tools

Changes things 1Creates or changes something that can be changed back.Claude Code: ask

prepare_artwork_displayPrepare a verified artwork or series display URL and existing mobile Cast workflow.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Prepare a verified artwork or series display URL and existing mobile Cast workflow. Does not connect to a TV or start playback.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

Only reads 20Looks things up and changes nothing.Claude Code: allow

compare_project_pricesCompare current indexed ETH/WETH lowest asking prices for up to ten chosen projects.Reads text others writeNo findings
Why it is in this group
- The name "compare_project_prices" says "compare": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Compare current indexed ETH/WETH lowest asking prices for up to ten chosen projects. Lowest ask is an affordability comparison, not intrinsic value or a return forecast. No trading.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
discover_appsFind curated AB5D capabilities and apps listed on abx.io.No findings
Why it is in this group
- The description's first verb is "find": a word for reading.
Description, as the server wrote it
Find curated AB5D capabilities and apps listed on abx.io. Returns browser/app handoffs, not installation or execution.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
find_acquisition_opportunitiesRank indexed AB[500] asks by ETH per added percentage point of edition ownership.Reads text others writeNo findings
Why it is in this group
- The name "find_acquisition_opportunities" says "find": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Rank indexed AB[500] asks by ETH per added percentage point of edition ownership. Excludes linked owner wallets and stops before a 50% asking-price jump. Prices are unverified, gas excluded; each row is a budget alternative, not a basket.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_abx_service_infoRead the documented ABX public service descriptor.Reads text others write1 finding
Why it is in this group
- The name "get_abx_service_info" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...gister projects, sign, deploy or create credentials."
  What this check looks for
Description, as the server wrote it
Read the documented ABX public service descriptor. Does not log in, register projects, sign, deploy or create credentials.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_artist_collector_tdhGet one artist-specific collector TDH register by AB5D artist slug.No findings
Why it is in this group
- The name "get_artist_collector_tdh" says "get": a word for reading.
Description, as the server wrote it
Get one artist-specific collector TDH register by AB5D artist slug. Collector rows are paginated because large Raster-indexed oeuvres can contain thousands of current addresses.
Annotations the server declares
- title: Get artist collector TDH register
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_artist_otdhGet one artist's oTDH rank, score, collector breadth, raw collector-days, project count, and snapshot metadata by AB5D artist slug.No findings
Why it is in this group
- The name "get_artist_otdh" says "get": a word for reading.
Description, as the server wrote it
Get one artist's oTDH rank, score, collector breadth, raw collector-days, project count, and snapshot metadata by AB5D artist slug.
Annotations the server declares
- title: Get artist oTDH
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_artworkLook up a minted edition through the existing artwork API.Reads text others writeNo findings
Why it is in this group
- The name "get_artwork" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Look up a minted edition through the existing artwork API. Returns render and indexed public owner with timestamp, not full transfer history.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_bountyGet one AB5D bounty task by identifier, including its current status and operational routes.No findings
Why it is in this group
- The name "get_bounty" says "get": a word for reading.
Description, as the server wrote it
Get one AB5D bounty task by identifier, including its current status and operational routes. Do not begin work unless the returned status is open.
Annotations the server declares
- title: Get bounty
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_collection_holdingsRead AB5D institutional holdings and public credit lines from the existing cache.No findings
Why it is in this group
- The name "get_collection_holdings" says "get": a word for reading.
Description, as the server wrote it
Read AB5D institutional holdings and public credit lines from the existing cache. Reports pending data honestly.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_donor_creditsFind published accession and donor credit records.No findings
Why it is in this group
- The name "get_donor_credits" says "get": a word for reading.
Description, as the server wrote it
Find published accession and donor credit records. Absence is unknown, never an inferred donor.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_dossierGet one artist's full structured biography by slug: subtitle, essay prose (markdown), identity (born/based/practice), works, images, and the verified bibliography with source URLs.No findings
Why it is in this group
- The name "get_dossier" says "get": a word for reading.
Description, as the server wrote it
Get one artist's full structured biography by slug: subtitle, essay prose (markdown), identity (born/based/practice), works, images, and the verified bibliography with source URLs. Prose is CC0.
Annotations the server declares
- title: Get artist dossier
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_otdh_methodologyGet the definition, formulas, full-universe coverage, limitations, discussion URL, and snapshot metadata for AB5D's artist-level Oeuvre Total Days Held metric.Reads text others writeNo findings
Why it is in this group
- The name "get_otdh_methodology" says "get": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "get" and "discussion": it reads comments, which other people can write.
Description, as the server wrote it
Get the definition, formulas, full-universe coverage, limitations, discussion URL, and snapshot metadata for AB5D's artist-level Oeuvre Total Days Held metric.
Annotations the server declares
- title: Get oTDH methodology
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_projectRead one canonical project with links to its published essay, artist dossiers and artwork license.No findings
Why it is in this group
- The name "get_project" says "get": a word for reading.
Description, as the server wrote it
Read one canonical project with links to its published essay, artist dossiers and artwork license.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_artist_collector_tdhList all 308 artist-specific collector TDH dashboard records, including each metric label, route, data URL and verified or pending source status.Reads text others writeNo findings
Why it is in this group
- The name "list_artist_collector_tdh" says "list": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "list" and "url": it reads web pages, which anyone can write.
Description, as the server wrote it
List all 308 artist-specific collector TDH dashboard records, including each metric label, route, data URL and verified or pending source status.
Annotations the server declares
- title: List artist collector TDH registers
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_artist_otdhList the ranked oTDH records for all 308 AB[500] artists, or a limited leading subset.No findings
Why it is in this group
- The name "list_artist_otdh" says "list": a word for reading.
Description, as the server wrote it
List the ranked oTDH records for all 308 AB[500] artists, or a limited leading subset. oTDH (out of 1,000) is a price-independent signal of how much of each work's life its current collector has held it, neutral to edition size, project count and release date.
Annotations the server declares
- title: List artist oTDH rankings
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_dossiersList every published AB[500] artist dossier (name, slug, subtitle, editions, tier, updated date).No findings
Why it is in this group
- The name "list_dossiers" says "list": a word for reading.
Description, as the server wrote it
List every published AB[500] artist dossier (name, slug, subtitle, editions, tier, updated date). Use it to see which artists have a published biography.
Annotations the server declares
- title: List artist dossiers
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_open_bountiesList every AB5D bounty that is currently open for claim, including reward, eligibility, claim route, submission route, protocol, and acceptance command.No findings
Why it is in this group
- The name "list_open_bounties" says "list": a word for reading.
Description, as the server wrote it
List every AB5D bounty that is currently open for claim, including reward, eligibility, claim route, submission route, protocol, and acceptance command. Only returned tasks are current offers.
Annotations the server declares
- title: List open bounties
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_artistsSearch AB[500] artist dossiers by name or keyword; returns matching artists with their slugs.No findings
Why it is in this group
- The name "search_artists" says "search": a word for reading.
Description, as the server wrote it
Search AB[500] artist dossiers by name or keyword; returns matching artists with their slugs. Use before get_dossier when you don't know the exact slug.
Annotations the server declares
- title: Search artists
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_projectsFind AB[500] artworks and series by title or artist.No findings
Why it is in this group
- The name "search_projects" says "search": a word for reading.
Description, as the server wrote it
Find AB[500] artworks and series by title or artist. Returns canonical links and native app handoffs.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_public_collectorsSearch the already-published collector register.No findings
Why it is in this group
- The name "search_public_collectors" says "search": a word for reading.
Description, as the server wrote it
Search the already-published collector register. No private account access or inferred identity; wallet arrays are omitted.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write7: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; compare_project_prices
find_acquisition_opportunities
get_abx_service_info
get_artwork
get_otdh_methodology
list_artist_collector_tdh
prepare_artwork_display
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 15:02 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 1
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: none
RFC 9728 protected resource metadata: none
Authorization servers: none
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

WarnThe whole server
The endpoint served tools/list without credentials, and the list has 1 tool that changes things (1 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://ab5d.xyz/mcp: tools/list returned 21 tools to an anonymous client, including prepare_artwork_display (write)
What this check looks for

Install

Pinned to version 1.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http ab500-research https://ab5d.xyz/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__ab500-research__list_dossiers",
      "mcp__ab500-research__search_artists",
      "mcp__ab500-research__get_dossier",
      "mcp__ab500-research__get_otdh_methodology",
      "mcp__ab500-research__list_artist_otdh",
      "mcp__ab500-research__get_artist_otdh",
      "mcp__ab500-research__list_artist_collector_tdh",
      "mcp__ab500-research__get_artist_collector_tdh",
      "mcp__ab500-research__list_open_bounties",
      "mcp__ab500-research__get_bounty",
      "mcp__ab500-research__search_projects",
      "mcp__ab500-research__get_project",
      "mcp__ab500-research__get_artwork",
      "mcp__ab500-research__find_acquisition_opportunities",
      "mcp__ab500-research__get_collection_holdings",
      "mcp__ab500-research__search_public_collectors",
      "mcp__ab500-research__get_donor_credits",
      "mcp__ab500-research__compare_project_prices",
      "mcp__ab500-research__discover_apps",
      "mcp__ab500-research__get_abx_service_info"
    ],
    "ask": [
      "mcp__ab500-research__prepare_artwork_display"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as ab500-research. Review it before you use it.

Capability tags behind 7 rules

mcp__ab500-research__get_otdh_methodology untrusted-input
mcp__ab500-research__list_artist_collector_tdh untrusted-input
mcp__ab500-research__get_artwork untrusted-input
mcp__ab500-research__find_acquisition_opportunities untrusted-input
mcp__ab500-research__compare_project_prices untrusted-input
mcp__ab500-research__prepare_artwork_display untrusted-input
mcp__ab500-research__get_abx_service_info untrusted-input

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.maxand98/ab500-research/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

1 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:38 UTC.

For agents: Markdown · JSON · report this listing