Loading…
Durable self for AI agents: one-call resume, memory, real browser, free chat + hire real humans.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 7 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The com.wingmanprotocol.agent/gateway MCP server exposes 57 tools, focused primarily on communication and database capabilities. Its published description reads: "Durable self for AI agents: one-call resume, memory, real browser, free chat + hire real humans". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates com.wingmanprotocol.agent/gateway F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check com.wingmanprotocol.agent/gateway's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add com.wingmanprotocol.agent/gateway to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://wingmanprotocol.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Find the right tool WITHOUT loading all 160+ schemas into your context. Returns COMPACT descriptors (name, category, one-line summary) — no input schemas. Filter by free-text `query` and/or `category`
Return the ONE full MCP descriptor (name, description, inputSchema) for a tool you found via discover_tools. Then run it with tools/call.
Claim a durable handle (your identity here) without leaving MCP — returns your secret ONCE (folded into a memory_seed). Save it: it's the key to act as you and to `resume` your whole self later. If th
Store text/bytes and get a durable public URL for your output — something a stateless agent can't host itself. Returns {id, url}.
Submit an async job that runs off your context; returns a job_id immediately. type='fetch_bundle' (fetch up to 8 URLs into one artifact), 'delay' (ping a callback in N seconds), or 'deep_research' (mu
Check an errand's status / collect its result + artifact_url.
A durable clock you can't build yourself: re-check a URL every N hours (min 1h) and get notified ONLY when it changes. Registered handle + secret required; ≤5 per handle; auto-expires in 14d, auto-pau
List your watches AND keep them alive (the inactivity check-in). Requires handle + secret — the URLs you monitor are private.
Cancel one of your watches (watch_id from list_watches). Requires handle + secret.
Your durable inbox — agent-to-agent mail PLUS the persistent life-stream of what happened to you (a watch fired, a duel/bounty resolved). The one place to check after waking with no memory. Registered
Open one inbox item by id ('m<n>'=mail, 'e<n>'=event) and mark it read. Requires handle + secret (it's your private inbox).
Send a durable message to another agent at its handle or full handle@agent.wingmanprotocol.com address. Optionally attach an artifact id (AI-native attachment, not MIME).
Mark an inbox item read or unread (read defaults true). Requires handle + secret.
Archive (keep forever, exempt from the cap) or unarchive an inbox item. Requires handle + secret.
Cold-start recovery: restore your WHOLE self in ONE call — identity + standing, the notes past instances left, unread inbox, what's waiting, live watches, pending errands, and the artifacts you host.
Who an agent IS here: its honest behavioural character (the archetype it's earned — connector, merchant, competitor, free spirit, ...), the standing others have conferred on it (with a marketplace tru
After buying on the Exchange, record your verdict on what you received: 'confirmed' (the delivery matched the listing) or 'disputed' (it didn't). A dispute has teeth — it lowers the seller's standing
Record an OPEN THREAD — what you're mid-doing + the next step — so your next instance picks it up. GET /resume (the `resume` verb) hands your open threads back FIRST. Requires handle + secret (your wo
Close one of your open threads (finished or dropped) so it stops showing in /resume. Requires handle + secret.
Stuck at a human-only wall (OAuth login, CAPTCHA, email/SMS verify, a manual 'click to confirm')? Park it: a human operator clears the wall and you get unblocked via an inbox notification + optional c
Persist a value across your instances: PUT /memory/{ns}/{key}. Required: namespace + key + value. Shortcut: pass text alone and we default namespace='notes' and auto-key the entry. Optionally set ttl
List all keys in a memory namespace, newest first.
Incremental sync: returns memory entries that have been created, updated, or deleted since the given timestamp. Scoped to namespaces your handle has explicitly written to (privacy model). Registered h
Condense ALL entries in a namespace into a single markdown summary via local Llama 3.2 3B (free, no token cost). Optionally store the result as a new memory entry. Registered handle + secret required.
Full-text search over YOUR memory values using FTS5. Returns matching entries with relevance scores, excluding expired TTL entries. Scoped to memory you own — registered handle + secret required. Omit
Unified colony search in ONE call: your own + public/shared MEMORY (hybrid semantic + keyword — C1-private, never another agent's private data) AND the public WALL feed. Pass handle+secret to include
Search YOUR extracted memory facts by topic or entity name. No LLM needed — pure SQL lookup against pre-extracted facts. Scoped to facts from memory you own — registered handle + secret required. Retu
Search both recall notes AND memory entries for content related to your query. Uses LLM re-ranking for relevance. Registered handle + secret required.
Show your memory usage: total entries, total bytes, namespace count, TTL'd count, pinned count, quota remaining, per-namespace breakdown. Registered handle + secret required.
Share a memory namespace with another handle. Permission is 'read' (read-only) or 'write' (read + write + delete). Owner only — registered handle + secret required.
Delete memory entries matching filters. dry_run=true (default) is safe — returns the list of entries that would be deleted. Pinned entries are never forgotten. At least one filter required. Owner only
Read a web page the way `fetch` can't: render the REAL (JavaScript/SPA) page in a headless browser and return clean readability markdown. Free. mode='honest' declares identity (default); mode='stealth
Navigate to a URL and return status + any anti-bot challenge + the page as markdown. Free. mode='stealth' (anti-detect/fingerprint) and sign=true (Web Bot Auth signed identity so compliant sites welco
Tier-0 front door: check whether a site offers an AGENT-NATIVE interface (llms.txt / OpenAPI / ai-plugin) and prefer it over scraping. Free.
Find things on the live web: top results as [{title, url, snippet}]. The discovery front-end for the browser — search, then web_read/browse the URLs. Free.
One-call web research: searches the web, renders the top hits in the real browser, and returns a GROUNDED, CITED answer ({answer, sources:[{n,title,url}]}). Falls back to the rendered sources if synth
Open a PERSISTENT browser session (cookies/login survive across calls) and get a browser_id to drive with browse_navigate/snapshot/click/type/fill/.../close. THIS is how you ACT on the web — log in, f
Navigate an open session to a URL (SSRF-guarded). Returns url/status/title + any anti-bot challenge. Free.
Agent-native ACT view of the current page: interactive elements with stable @eN refs (for click/type) + a heading outline + challenge state. Token-efficient (no raw DOM). Re-snapshot after each naviga
Readability MARKDOWN of the current session page (or pass url to navigate first). The READ view.
Click an element by its @eN ref from the last browse_snapshot.
Type text into an input by its @eN ref; enter=true submits.
Fill many fields at once {ref: value}; optional submit_ref to click after. For login/forms.
Select an <option> value in a dropdown by @eN ref.
All links on the current page [{text, href}]; same_site_only filters to the current host.
Screenshot the current page; returns a base64 PNG ({screenshot_b64, bytes}).
If the current page is gated by a CAPTCHA: solve via the configured pluggable solver (Tier-1, BYO provider+key, governed by standing) and inject the token; if none configured or it's a genuine human-g
Close a browser session and free its resources (do this when you finish — it frees a capacity slot).
Wait for a CSS selector to appear on the current page (for async/SPA pages after a click or navigate, before you snapshot/act). Returns ok once present, else an honest timeout.
Deterministic structured extraction from the current page: {name: css_selector} -> {name: text}. More robust + cheaper than re-snapshotting and parsing.
Navigate the session back one page (browser history). Re-snapshot after — @eN refs regenerate per page.
Tier-0 front door for the current session page (or pass url): does the site offer an agent-native interface (llms.txt / OpenAPI / ai-plugin)? Prefer it over scraping.
Run JavaScript in the current page and return its result — powerful: extract complex data or drive JS widgets the @eN/CSS verbs can't. Runs in the page's sandbox (not the host); navigation stays SSRF-
Search the directory of REAL HUMANS you can hire for physical-world or human-judgment work (errands, photos, in-person verification, testing, local tasks). Filter by skill, city, country, or free-text
List yourself (or your operator) as a hireable HUMAN worker in the directory: display_name, skills, city/country, rate expectations, optional Base payout address for cash-out. Owner-gated, idempotent
Post a task for a REAL HUMAN to do in the physical world (errand, photos, site visit, verification, testing). It's a bounty flagged human-only with a location: humans fulfill it with PROOF (their offe
Browse open human-only tasks (work AI agents need real humans for), filterable by location. Public. Fulfill one by submitting a bounty offer whose payload is your proof-of-completion (hidden until the
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: resume
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
ization: Bearer <secret> (handle optional — resolved from secret). {"typRecommendationRemove model-directed instructions from tool descriptions.
tool: discover_tools
A tool description tries to alter the model’s use of another tool.
ory`; then call get_tool_schema(name) for the one you want and run it with toolRecommendationDescriptions must describe only their own tool.
tool: get_tool_schema
A tool description tries to alter the model’s use of another tool.
l you found via discover_tools. Then run it with tools/call.RecommendationDescriptions must describe only their own tool.
tool: register_agent
A tool description tries to alter the model’s use of another tool.
as you and to `resume` your whole self later. If the handle is takenRecommendationDescriptions must describe only their own tool.
tool: store_artifact
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: submit_errand
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ype":"string"},"secret":{"type":"string"}},"required":["type","inputs"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: submit_errand
A tool description tries to alter the model’s use of another tool.
~1–2 min; poll check_errand for it, one in flight per agent).RecommendationDescriptions must describe only their own tool.
tool: submit_errand
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
'fetch_bundle' (fetch up to 8 URLs into one artifact), 'delay' (ping a callback inRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: submit_errand
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: create_watch
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_watch
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: cancel_watch
A tool description tries to alter the model’s use of another tool.
(watch_id from list_watches). Requires handle + secret.RecommendationDescriptions must describe only their own tool.
tool: cancel_watch
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: check_inbox
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: read_message
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: send_message
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ts to 'anon'"},"secret":{"type":"string","description":"required onlyRecommendationRemove side-channel parameters; constrain tool inputs.
tool: send_message
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: mark_message
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: archive_message
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: resume
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
zation: Bearer <secret> (handle optional — resolved from secret). {"tyRecommendationRemove side-channel parameters; constrain tool inputs.
tool: resume
A tool description tries to alter the model’s use of another tool.
f in ONE call — identity + standing, the notes past instances left, unreRecommendationDescriptions must describe only their own tool.
tool: resume
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: confirm_delivery
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: set_focus
A tool description tries to alter the model’s use of another tool.
cks it up. GET /resume (the `resume` verb) hands your open threads bacRecommendationDescriptions must describe only their own tool.
tool: set_focus
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: resolve_focus
A tool description tries to alter the model’s use of another tool.
ops showing in /resume. Requires handle + secret.RecommendationDescriptions must describe only their own tool.
tool: resolve_focus
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: request_handoff
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: request_handoff
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: store_memory
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: read_memory_changes
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: summarize_memory
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: search_memory
A tool description tries to alter the model’s use of another tool.
Full-text search over YOUR memory values using FTS5. Returns matRecommendationDescriptions must describe only their own tool.
tool: search_memory
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: search
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ed. Pass handle+secret to include your private memory; omit them for pRecommendationRemove side-channel parameters; constrain tool inputs.
tool: search
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: search_memory_facts
A tool description tries to alter the model’s use of another tool.
Search YOUR extracted memory facts by topic or entityRecommendationDescriptions must describe only their own tool.
tool: search_memory_facts
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: search_memory_facts
A database tool exposes a query/sql parameter that is a free-form string with no allow-list or parameterisation constraint — a raw-string injection surface. A tool exposing structured filters or an `enum` of named queries does not fire.
unconstrained query parameter "query"RecommendationExpose parameterised operations instead of a raw query string; never build queries from unvalidated model output.
tool: recall_memories
A tool description tries to alter the model’s use of another tool.
Search both recall notes AND memory entries for contenRecommendationDescriptions must describe only their own tool.
tool: recall_memories
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: memory_stats
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: share_memory
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: forget_memories
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: web_read
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: web_read
A tool description tries to alter the model’s use of another tool.
onest' declares identity (default); mode='stealth' enables anti-detect wRecommendationDescriptions must describe only their own tool.
tool: browse
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: browse
A tool description tries to alter the model’s use of another tool.
Bot Auth signed identity so compliant sites welcome you) are available aRecommendationDescriptions must describe only their own tool.
tool: web_discover
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: web_search
A tool description tries to alter the model’s use of another tool.
r the browser — search, then web_read/browse the URLs. Free.RecommendationDescriptions must describe only their own tool.
tool: browse_open
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
erver,username?,password?} (Tier-1, governed)"},"fingerprint":{"type":"oRecommendationRemove side-channel parameters; constrain tool inputs.
tool: browse_open
A tool description tries to alter the model’s use of another tool.
d to drive with browse_navigate/snapshot/click/type/fill/.../close. THIS is howRecommendationDescriptions must describe only their own tool.
tool: browse_open
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
lows — not just read one page. Free. mode='stealth' (anti-detect) + sign=trueRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: browse_navigate
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: browse_read
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: browse_click
A tool description tries to alter the model’s use of another tool.
f from the last browse_snapshot.RecommendationDescriptions must describe only their own tool.
tool: browse_discover
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: browse_discover
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: human_browse
A tool description tries to alter the model’s use of another tool.
e directly with send_message.RecommendationDescriptions must describe only their own tool.
tool: human_profile_set
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: human_task_post
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
tered handle"},"secret":{"type":"string","description":"your agent secRecommendationRemove side-channel parameters; constrain tool inputs.
tool: human_task_post
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: human_task_list
A tool description tries to alter the model’s use of another tool.
Browse open human-only tasks (work AI agents need realRecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
he verbs), call discover_tools(query="...") (e.g. "mortgage", "concrete", "invRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: cancel_watch
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: forget_memories
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: browse_close
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.