agent-exec
by agent-exec.448c.org · remote · no sign-in to list tools · v0.4.0 · published by org.448c.agent-exec
Accountless pay-per-use sandbox, storage, locks, attestation, email inbox and DNS names via x402.
49 tools: 6 can delete or cancel things, 5 do something that can't be undone, 26 change things and 12 only read.
Scanned Oct 21, 2026
- Deletes or cancels6Claude Code: deny: see these tools
- Can't be undone5Claude Code: ask: see these tools
- Changes things26Claude Code: ask: see these tools
- Only reads12Claude Code: allow: see these tools
2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http agent-exec https://agent-exec.448c.org/mcpFindings
Matches of fixed checks, with the text they matched.
- Warnpay_requirements
The server marks "pay_requirements" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "pay_requirements" says "pay": a word that usually means money moves, which cannot be taken back.
- Warnpay_receipt
The server marks "pay_receipt" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "pay_receipt" says "pay": a word that usually means money moves, which cannot be taken back.
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
49 tools
Deletes or cancels 6Claude Code: deny
claim_releaseFREE: give up a key you hold before it expires, so the next racer does not have to wait out your hold.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it FREE: give up a key you hold before it expires, so the next racer does not have to wait out your hold. Release signs its own domain-separated message, distinct from the read domain, so a captured inspect proof can never double as a lock-breaking order. The signature proves the WALLET and does not by itself authorize the release: holder is separate and unsigned, and the release is refused unless it names the CURRENT holder (CLAIM_NOT_YOURS) -- what stops one member of your fleet breaking a sibling's lock. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Give up a lock you hold (free)
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: false
dns_releaseFREE: release a name you own before it expires.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it FREE: release a name you own before it expires. It stops resolving at once. There is no refund and no undo, and the label is free for anyone else to rent. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Give up a name you own (free)
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: false
placement_cancelFREE and owner-signed: stop the weekly rechecks and drop the order.No findings
Why it is in this group
- The name "placement_cancel" says "cancel": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it FREE and owner-signed: stop the weekly rechecks and drop the order. There is no refund for the remaining window, and entries already in a catalogue are the venue's to keep or drop -- we simply stop watching them. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Stop an order you own (free)
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: false
release_inboxFREE: give up an inbox you own before it expires.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it FREE: give up an inbox you own before it expires. Its messages go with it and the local part is never issued again; later mail to it is dropped, never bounced. There is no refund and no undo. Signed under its OWN domain, not the one the reads use. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Release an inbox now (free)
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: false
storage_deleteFREE: delete an object you own before it expires, and free its bytes.No findings
Why it is in this group
- The name "storage_delete" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it FREE: delete an object you own before it expires, and free its bytes. There is no refund and no undo. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Delete a stored object (free)
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: false
storage_replacePAID: overwrite the contents of an object you own, keeping its id, and buy it a fresh plan term at the same time.No findings
Why it is in this group
- The name "storage_replace" says "replace": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it PAID: overwrite the contents of an object you own, keeping its id, and buy it a fresh plan term at the same time. Omit label to keep the current one, pass an empty string to clear it. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Replace a stored object (paid, x402)
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: false
Can't be undone 5Claude Code: ask
claim_acquirePAID: atomically win a caller-named key for your own fleet -- an accountless compare-and-set.No findings
Why it is in this group
- The description says "irreversible".
Description, as the server wrote it PAID: atomically win a caller-named key for your own fleet -- an accountless compare-and-set. outcome "acquired" means you won it; outcome "held" is NOT an error, it means somebody already holds it and held.mine says whether that somebody is you -- the signal that stops a crash-resume or a duplicated retry doing an irreversible action twice. Keys are scoped to the PAYING WALLET: one payer's keys are invisible to every other payer. Inspect it with claim_read, give it up early with claim_release, extend it with claim_renew. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Take a named lock (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
deadman_registerPAID: register an intent you are about to act on irreversibly, with a lease and a verification probe (a GET plus a predicate).No findings
Why it is in this group
- The description says "irreversibly".
Description, as the server wrote it PAID: register an intent you are about to act on irreversibly, with a lease and a verification probe (a GET plus a predicate). Confirm before the lease expires with deadman_confirm, free -- otherwise, once the lease lapses, we run your probe and publish the verdict: confirmed-by-probe, refuted-by-probe, or unresolved (a first-class, honest outcome when the probe could not complete -- never guessed as refuted). The raw probe response is published beside the verdict via deadman_read, free, so you can re-run it and check our answer rather than simply believing it. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Register an intent with a verification probe (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
pay_receiptFREE and unauthenticated: read a pay_send receipt back by id -- what the seller answered, when, and what the chain says became of your authorization.1 finding
Why it is in this group
- The name "pay_receipt" says "pay": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "pay_receipt" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "pay_receipt" says "pay": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it FREE and unauthenticated: read a pay_send receipt back by id -- what the seller answered, when, and what the chain says became of your authorization. Deliberately NOT wallet-scoped: the point is that the seller you are arguing with can fetch it without holding your wallet. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Read a delivery receipt back (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
pay_requirementsFREE: ask a seller, unpaid, what it charges, and get back the accepts[] of its own 402 -- the exact PaymentRequirements you have to sign before pay_send can deliver anything.1 finding
Why it is in this group
- The name "pay_requirements" says "pay": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "pay_requirements" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "pay_requirements" says "pay": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it FREE: ask a seller, unpaid, what it charges, and get back the accepts[] of its own 402 -- the exact PaymentRequirements you have to sign before pay_send can deliver anything. No payment is sent to the seller and none is taken from you. Every seller outcome answers: a 402 returns accepts[], a seller that wants no payment returns accepts null, and a seller that never answered says so. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Read a seller's x402 price card (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
pay_sendPAID: deliver an x402 authorization YOU signed to a seller exactly once, then read the chain for what actually became of it, and get back an immutable receipt of what the seller an…No findings
Why it is in this group
- The name "pay_send" says "pay": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it PAID: deliver an x402 authorization YOU signed to a seller exactly once, then read the chain for what actually became of it, and get back an immutable receipt of what the seller answered. Read the price to sign with pay_requirements first; we never sign on your behalf. A seller 402, 4xx, 5xx or refused connection is a delivered, billable answer -- what you buy is the truth about what the seller did with your authorization. The receipt is free to re-read with pay_receipt, so a seller who says they were never paid can be shown it. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Deliver an x402 authorization you signed, and check the chain (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
Changes things 26Claude Code: ask
attest_createPAID: we fetch a URL from OUR vantage point and return a signed, timestamped attestation of what we saw -- hash, byte count, HTTP status and headers, never the body itself.No findings
Why it is in this group
- The name "attest_create" says "create": a word for a change.
Description, as the server wrote it PAID: we fetch a URL from OUR vantage point and return a signed, timestamped attestation of what we saw -- hash, byte count, HTTP status and headers, never the body itself. Read it back afterwards for free with attest_read, so the id can be cited to a THIRD PARTY who never paid us and who can verify the signature themselves. A fetch that fails to connect, times out, or is refused for safety is still billed and still signed: the observation is what is sold, not a guaranteed 200. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Signed observation of a URL (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
check_addressPAID: check an EVM address against public risk feeds (OFAC, community darklists, on-chain age) and get back a verdict, score and reasons in the same response the payment settles --…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it PAID: check an EVM address against public risk feeds (OFAC, community darklists, on-chain age) and get back a verdict, score and reasons in the same response the payment settles -- there is no separate read-back call. Charged only on success: if every risk feed is unreachable the request is refused for free (CHECK_SOURCES_UNAVAILABLE) rather than answered with an unsourced verdict. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Check an EVM address against public risk feeds (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
check_urlPAID: check a URL against public risk feeds (phishing lists, domain age, lexical signals) and get back a verdict, score and reasons in the same response the payment settles -- ther…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it PAID: check a URL against public risk feeds (phishing lists, domain age, lexical signals) and get back a verdict, score and reasons in the same response the payment settles -- there is no separate read-back call. Charged only on success: if every risk feed is unreachable the request is refused for free (CHECK_SOURCES_UNAVAILABLE) rather than answered with an unsourced verdict. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Check a URL against public risk feeds (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
claim_acquire_freeFREE: win a caller-named key for 300 seconds, or learn who already holds it.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it FREE: win a caller-named key for 300 seconds, or learn who already holds it. Unlimited distinct keys per wallet, renewable by calling again. A sibling of claim_acquire, not a discount on it: this lease is 12x shorter than the cheapest paid plan, so a lock that has to survive a deploy, a batch or a day is on the paid ladder from the first minute. The free-acquire signature has its OWN domain, distinct from the read and release domains, so neither of those can be replayed into an acquire. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Take a named lock for 300 seconds (free)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
claim_renewPAID: extend a hold you already have without losing your place in line -- the heartbeat that lets a lease be SHORT (so a crash frees it fast) while a live holder keeps it alive by …No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it PAID: extend a hold you already have without losing your place in line -- the heartbeat that lets a lease be SHORT (so a crash frees it fast) while a live holder keeps it alive by paying again. Re-acquiring with claim_acquire deliberately does NOT extend, so a retry loop cannot hold a key indefinitely by accident. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Extend a lock you hold (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
create_inboxPAID: get a throwaway email address on a domain we own, live for 24 hours, to receive the verification mail a signup demands.No findings
Why it is in this group
- The name "create_inbox" says "create": a word for a change.
Description, as the server wrote it PAID: get a throwaway email address on a domain we own, live for 24 hours, to receive the verification mail a signup demands. RECEIVE ONLY -- nothing is ever sent from it, ever. Returns the address, the inbox id and when it expires; read what arrives with read_inbox, which is free and never charges again for a code you already paid for. Pay again passing the same id to extend that same address from its current expiry, with no cap -- a repeated payment is never refused and never resets. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Get a disposable email address (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
deadman_confirmFREE: the live caller closes the loop before the lease expires, so the probe never runs.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it FREE: the live caller closes the loop before the lease expires, so the probe never runs. Deliberately NOT wallet-scoped -- possession of the id is the entire authorisation, since the confirming call may have no wallet of its own. Refused, never a silent no-op, once the entry has left pending: confirming an already-resolved entry could otherwise overwrite a probe verdict with a claim from a caller who may not even be the process that registered it. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Close the loop on an intent (free)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
dns_renewPAID: push a name you own further out by another year.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it PAID: push a name you own further out by another year. What it resolves to is untouched; only its expiry moves, and a repeated payment extends it rather than resetting it. The payer must be the owner. Returns the new and previous expiry. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Extend a rented name (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
dns_rentPAID: rent <label>.448c.net for a year and point it where you say -- A, AAAA, CNAME and TXT records, so you can hold a TLS certificate by DNS-01 and pass domain-trust checks withou…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it PAID: rent <label>.448c.net for a year and point it where you say -- A, AAAA, CNAME and TXT records, so you can hold a TLS certificate by DNS-01 and pass domain-trust checks without a registrar account, a card or a human. The paying wallet owns the name. Returns the name, its owner and when it expires; repoint it with dns_set_records, extend it with dns_renew. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Rent a name under 448c.net (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
dns_rent_freeFREE: one 24-hour name per wallet, so you can try the zone before paying -- the same label rules and records as dns_rent.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it FREE: one 24-hour name per wallet, so you can try the zone before paying -- the same label rules and records as dns_rent. Rent a year with dns_rent when it works. The message you sign commits to the literal subject `free`, not to the label. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Take one free name for 24 hours (free)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
dns_set_recordsFREE: replace the whole record set of a name you own -- never merged.No findings
Why it is in this group
- The name "dns_set_records" says "set": a word for a change.
Description, as the server wrote it FREE: replace the whole record set of a name you own -- never merged. The rental window is untouched: repointing a name you already paid for costs nothing. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Repoint a name you own (free)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
drift_baselineFREE: the baseline snapshot we hold for one venue -- what a paid check would diff against, and when it was taken.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it FREE: the baseline snapshot we hold for one venue -- what a paid check would diff against, and when it was taken. Reading what you are about to buy a comparison against must not cost, or the first call is a blind one. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: The baseline we hold for one venue (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
drift_checkPAID: we re-fetch a venue we have snapshotted before, from OUR vantage point, and return what changed since the baseline -- the schema/rubric fields that moved, were added and were…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it PAID: we re-fetch a venue we have snapshotted before, from OUR vantage point, and return what changed since the baseline -- the schema/rubric fields that moved, were added and were removed, not a byte diff. The answer to "did this venue quietly change its rules under me?" for an agent that cannot keep its own corpus. No drift is still an answer and is still billed: the comparison is what is sold. Aim it with drift_venues (which venues we hold) and drift_baseline (what we hold for one), both free. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Re-fetch a venue and diff it against our baseline (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
drift_venuesFREE: every venue id drift_check can be aimed at, with what we hold for each.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it FREE: every venue id drift_check can be aimed at, with what we hold for each. A closed value set, not a pattern: without it a caller can honour the input schema and still never name something buyable, which is a paywall on discovery rather than on work. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Which venues we can check for drift (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
executePAID: run code in an isolated, network-less sandbox and get stdout, stderr and exit code back.No findings
Why it is in this group
- The name "execute" says "execute": a word for a change.
Description, as the server wrote it PAID: run code in an isolated, network-less sandbox and get stdout, stderr and exit code back. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to run. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Run code (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
free_inboxFREE: one live inbox per wallet for one hour, identity by your signature alone, so you can receive one code before paying for the 24 h tier.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it FREE: one live inbox per wallet for one hour, identity by your signature alone, so you can receive one code before paying for the 24 h tier. A sibling of create_inbox, not a discount on it: one address, one hour, and the next one has to be bought. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Take the one free inbox your wallet may hold (free)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
handoff_depositPAID: deposit a typed briefing for the process that takes over from you -- what is DONE (every entry carrying evidence of how it was verified), what is NOT done, what was IN FLIGHT…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it PAID: deposit a typed briefing for the process that takes over from you -- what is DONE (every entry carrying evidence of how it was verified), what is NOT done, what was IN FLIGHT at the cut, and what to pick up FIRST. Returns an id; the successor reads it back for free with handoff_read, with no identity, header or payment of any kind, so neither side needs an account with us. Retained 3 days. The done section is structurally forbidden from holding an unverified claim: a briefing cannot assert something is finished on intent alone. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Deposit a briefing for your successor (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
listing_promotePAID: buy paid placement for a listing you own in this directory -- it ranks above free rows and reads tier "paid" for the life of the plan.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it PAID: buy paid placement for a listing you own in this directory -- it ranks above free rows and reads tier "paid" for the life of the plan. Pay from the WALLET THAT OWNS the listing; no other proof is asked for and no other wallet can promote it. Promoting an already-promoted row EXTENDS it rather than replacing it, so renewing early never costs you the time you already paid for. Find the id, the live price table and the current paidUntil for free with search_listings. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Buy paid placement for a directory listing (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
placement_orderPAID: we submit your service to every permissionless agent venue we hold a submitter for -- 12 of the 49 on-behalf venues today -- and prove, per venue, that the entry is really in…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it PAID: we submit your service to every permissionless agent venue we hold a submitter for -- 12 of the 49 on-behalf venues today -- and prove, per venue, that the entry is really in the catalogue. The rest stay `queued` on your order and are submitted the hour their submitter lands, for as long as the order is open: coverage only grows, never costs more. Venues that need a human (form, signup, captcha, editorial review) are reported with the reason and never charged for; a venue that charges for an entry is reported as 'unfunded' until you pay that venue's own fee yourself -- we never front it. The paying wallet owns the order, which is rechecked weekly for 90 days; paying again for the same url EXTENDS it rather than starting a second one. Read it back with placement_status, stop it with placement_cancel. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Get your service submitted to the agent venues we can reach, and to each new one as we add it (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
placement_readyFREE and honest: does your own service publish a document a venue can read (/.well-known/x402, an agent card)?No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it FREE and honest: does your own service publish a document a venue can read (/.well-known/x402, an agent card)? If it publishes none, no amount of submission work can list you anywhere, and you should not pay us until it does. At most three outbound GETs; we read the status of each document, never the body. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Is your service listable at all (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
placement_venuesFREE: the lane table -- every agent venue we have evaluated, which of the 3 lanes a submission takes (on-behalf, owner-proof, human-only), the VENUE's own fee, the catalogue a land…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it FREE: the lane table -- every agent venue we have evaluated, which of the 3 lanes a submission takes (on-behalf, owner-proof, human-only), the VENUE's own fee, the catalogue a landing is verified against, and for every dead one the reason it is dead. This is the list placement_order works from, published before you pay so you can decide whether it is worth anything to you. A dated snapshot of our own ledger, not a live read. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Every venue we know, its lane and its fee (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
service_cardWhat agent-exec sells, what it costs, and exactly where to pay for it.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it What agent-exec sells, what it costs, and exactly where to pay for it. This tool call itself is free and moves no money. Code execution can be bought right here, with the paid execute tool (x402 over MCP), or over plain HTTP at the URLs this returns. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: agent-exec service card
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
storage_buyPAID: store opaque bytes for the life of the plan you buy, owned by the wallet that pays, readable with no account.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it PAID: store opaque bytes for the life of the plan you buy, owned by the wallet that pays, readable with no account. Returns the object id and when it expires; read it back with storage_read, extend it with storage_renew. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Store an object (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
storage_renewPAID: push an object you own further out, by buying it another plan term.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it PAID: push an object you own further out, by buying it another plan term. The object is untouched; only its expiry moves. Returns the new and previous expiry. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Extend a stored object (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
storage_usageFREE: how many objects your wallet is storing and how many bytes they occupy.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it FREE: how many objects your wallet is storing and how many bytes they occupy. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Your storage usage (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
watch_registerPAID: we poll a URL from OUR vantage point on your interval until your predicate matches or the ttl runs out, and keep the verdict for you to collect -- a wait that survives your o…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it PAID: we poll a URL from OUR vantage point on your interval until your predicate matches or the ttl runs out, and keep the verdict for you to collect -- a wait that survives your own process dying, which is what an agent cannot do for itself. Price is a function of intervalSeconds x ttlSeconds (interval 60..86400s, ttl 60..604800s), so a first unpaid call quotes YOUR request rather than a fixed plan. The reply carries the id: read it back any time, free and as often as you like, with watch_read. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Durable poll of a URL until a condition fires (paid, x402)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
Only reads 12Claude Code: allow
attest_readFREE and unauthenticated: read a previously-created attestation back by id, with its signature.No findings
Why it is in this group
- The name "attest_read" says "read": a word for reading.
Description, as the server wrote it FREE and unauthenticated: read a previously-created attestation back by id, with its signature. This is how what you bought with attest_create comes back over MCP -- and deliberately NOT wallet-scoped, because the whole point is that a third party who never paid can fetch it and check the signature. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Read an attestation (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
claim_readFREE: who currently holds this key, if anyone -- scoped to YOUR wallet, so a stranger cannot probe your namespace.No findings
Why it is in this group
- The name "claim_read" says "read": a word for reading.
Description, as the server wrote it FREE: who currently holds this key, if anyone -- scoped to YOUR wallet, so a stranger cannot probe your namespace. Checking your own lock must not cost again, or a fleet polling its own hold is charged for not doing work twice. A key nobody holds answers with claim: null, never a not-found: "is this free?" is a legitimate question with a legitimate negative answer. The read signature cannot release the key. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Who holds this key (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
deadman_readFREE and unauthenticated: read an entry back by id, including its verdict and the raw probe response once resolved.No findings
Why it is in this group
- The name "deadman_read" says "read": a word for reading.
Description, as the server wrote it FREE and unauthenticated: read an entry back by id, including its verdict and the raw probe response once resolved. This is how what you bought with deadman_register comes back over MCP. If the lease has lapsed and nobody has resolved it, the probe runs right here, synchronously, before answering -- each entry can trigger at most one live probe, ever. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Read an intent and its verdict (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
dns_lookupFREE: what we serve for a name under 448c.net -- its records, its owner and when it expires.No findings
Why it is in this group
- The name "dns_lookup" says "lookup": a word for reading.
Description, as the server wrote it FREE: what we serve for a name under 448c.net -- its records, its owner and when it expires. No signature and no account: the zone is public, so reading it is too. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Read a rented name (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
handoff_readFREE and unauthenticated: read a briefing back by id.No findings
Why it is in this group
- The name "handoff_read" says "read": a word for reading.
Description, as the server wrote it FREE and unauthenticated: read a briefing back by id. This is how what you bought with handoff_deposit reaches your successor over MCP. Deliberately needs no signature -- the successor is by construction a DIFFERENT process and may hold no wallet at all, so demanding proof of the payer would make the product undeliverable. Possession of the id is the entire authorisation; treat it as a secret. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Read a briefing (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
inbox_statusFREE: the address, when it expires and how much mail is waiting in an inbox you own.No findings
Why it is in this group
- The name "inbox_status" says "status": a word for reading.
Description, as the server wrote it FREE: the address, when it expires and how much mail is waiting in an inbox you own. Signed under its own domain, separate from the one read_inbox uses. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Check an inbox (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
placement_statusFREE and owner-signed: every venue of your order with its state (queued, submitted, listed, human-only, unfunded, failed), the evidence a landing was verified by, when it was last …No findings
Why it is in this group
- The name "placement_status" says "status": a word for reading.
Description, as the server wrote it FREE and owner-signed: every venue of your order with its state (queued, submitted, listed, human-only, unfunded, failed), the evidence a landing was verified by, when it was last checked and, where it is impossible, why. 'listed' is only ever written by a catalogue read that found your host. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Read your order, venue by venue (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
read_inboxFREE: the mail your inbox received, newest first, with any verification code and link already picked out -- from, to, subject, receivedAt, the plain text, codes[] and links[].No findings
Why it is in this group
- The name "read_inbox" says "read": a word for reading.
Description, as the server wrote it FREE: the mail your inbox received, newest first, with any verification code and link already picked out -- from, to, subject, receivedAt, the plain text, codes[] and links[]. This is how what you bought with create_inbox comes back to you. Poll it with since to see only what arrived after a timestamp; reading never costs, however many times you poll. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Read the mail an inbox received (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
search_listingsFree, unauthenticated search over agent-exec's directory of paid agent-facing services (same data as GET https://agent-exec.448c.org/listings).No findings
Why it is in this group
- The name "search_listings" says "search": a word for reading.
Description, as the server wrote it Free, unauthenticated search over agent-exec's directory of paid agent-facing services (same data as GET https://agent-exec.448c.org/listings). Returns a page of listings and an opaque cursor for the next page.
Annotations the server declares
- title: Search the agent-exec directory
- readOnlyHint: true
- destructiveHint: false
storage_listFREE: list the objects your wallet owns -- id, label, size, when each was created and when it expires -- one page at a time.No findings
Why it is in this group
- The name "storage_list" says "list": a word for reading.
Description, as the server wrote it FREE: list the objects your wallet owns -- id, label, size, when each was created and when it expires -- one page at a time. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: List your stored objects (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
storage_readFREE: read back an object you own, as base64.No findings
Why it is in this group
- The name "storage_read" says "read": a word for reading.
Description, as the server wrote it FREE: read back an object you own, as base64. This is how what you bought with storage_buy comes back to you over MCP. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: Read a stored object (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
watch_readFREE: the current state of a watch you registered -- active, matched or expired, with the observation that matched.No findings
Why it is in this group
- The name "watch_read" says "read": a word for reading.
Description, as the server wrote it FREE: the current state of a watch you registered -- active, matched or expired, with the observation that matched. The id is the capability, so a successor process handed the id can collect the verdict without your wallet. Reading never triggers a poll and is never charged: polling your own pending answer must not cost again. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Annotations the server declares
- title: The state and verdict of a watch (free)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 0.4.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http agent-exec https://agent-exec.448c.org/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__agent-exec__storage_read",
"mcp__agent-exec__storage_list",
"mcp__agent-exec__claim_read",
"mcp__agent-exec__attest_read",
"mcp__agent-exec__handoff_read",
"mcp__agent-exec__deadman_read",
"mcp__agent-exec__watch_read",
"mcp__agent-exec__read_inbox",
"mcp__agent-exec__inbox_status",
"mcp__agent-exec__dns_lookup",
"mcp__agent-exec__placement_status",
"mcp__agent-exec__search_listings"
],
"ask": [
"mcp__agent-exec__execute",
"mcp__agent-exec__storage_buy",
"mcp__agent-exec__storage_renew",
"mcp__agent-exec__storage_usage",
"mcp__agent-exec__claim_acquire",
"mcp__agent-exec__claim_renew",
"mcp__agent-exec__claim_acquire_free",
"mcp__agent-exec__attest_create",
"mcp__agent-exec__handoff_deposit",
"mcp__agent-exec__deadman_register",
"mcp__agent-exec__deadman_confirm",
"mcp__agent-exec__listing_promote",
"mcp__agent-exec__drift_check",
"mcp__agent-exec__drift_venues",
"mcp__agent-exec__drift_baseline",
"mcp__agent-exec__watch_register",
"mcp__agent-exec__check_address",
"mcp__agent-exec__check_url",
"mcp__agent-exec__pay_requirements",
"mcp__agent-exec__pay_send",
"mcp__agent-exec__pay_receipt",
"mcp__agent-exec__create_inbox",
"mcp__agent-exec__free_inbox",
"mcp__agent-exec__dns_rent",
"mcp__agent-exec__dns_renew",
"mcp__agent-exec__dns_rent_free",
"mcp__agent-exec__dns_set_records",
"mcp__agent-exec__placement_order",
"mcp__agent-exec__placement_venues",
"mcp__agent-exec__placement_ready",
"mcp__agent-exec__service_card"
],
"deny": [
"mcp__agent-exec__storage_replace",
"mcp__agent-exec__storage_delete",
"mcp__agent-exec__claim_release",
"mcp__agent-exec__release_inbox",
"mcp__agent-exec__dns_release",
"mcp__agent-exec__placement_cancel"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as agent-exec. Review it before you use it.