Endpoints: 28,729MCP servers: 18,413Payout addresses: 2,071Paid calls: 1,559Letters: 14Defects: 1,336counted 2 min ago
teppi

Server definition

Hash
sha256:afdb3b56b43aa41934024c28d357093cf0920eebeea81552e8b9cd98f3486fd1
What it is
What a remote MCP server returned when asked what it offers: 28 tools

The blob, as servednamed by its sha256

{ "instructions": "AgentAegis runs real security scanners (nmap, Nuclei, sslyze, Semgrep, trufflehog, trivy) and queries real threat-intel feeds (NVD, AbuseIPDB, AlienVault OTX, abuse.ch, HIBP) on behalf of AI agents. Results are real findings about real infrastructure, not simulations.\n\n# Paid tools spend the user's money\n\nEvery tool except the free ones below charges USD per call, billed against a prepaid API-key balance or settled per call in USDC on Base (x402). Payment is taken when the call is made, so a failed or unhelpful scan still costs money.\n\nBecause of that:\n- Before the FIRST paid call in a conversation, tell the user which tool you intend to call and what it costs, and get their agreement. Named prices are below.\n- Do not run scans the user did not ask for, and do not \"explore\" the catalog with paid calls.\n- Do not retry a paid tool in a loop. If a call fails, report the error and stop.\n- Prefer one composite tool over several narrow ones (see Tool selection).\n\nFree, always, no balance required: help, account_balance, agent_whoami, agent_history, agent_scan_get. Listing tools and prompts is also free.\n\n# Price catalog\n\n- Free: account_balance, agent_history, agent_scan_get, agent_whoami, help\n- $1: access_review, cve_lookup, dns_security_check, evidence_collect, mfa_audit, ssl_tls_audit, vuln_prioritize\n- $2: compliance_framework_check, control_gap_analysis, credential_check, dependency_audit, email_security_audit, policy_generate, secret_scan, threat_intel_lookup\n- $3: incident_triage, vet_endpoint, vuln_scan_network\n- $5: audit_report_generate, sast_scan, scan_mcp_plugin, scan_skill, vuln_scan_web_app\n\n# Do this before paying\n\n- **You may have already run this scan.** Call agent_history, and if the target appears, agent_scan_get returns the full stored output. Both are free. Never re-pay for a result you already own.\n- **Check funding.** account_balance reports the prepaid balance and how many of each tool remain affordable. A paid call against an empty balance fails and wastes a turn.\n- **Read the FAQ instead of guessing.** help covers authentication, billing, error codes, async jobs, x402 and rate limits.\n\n# Tool selection\n\nRoute by the question the user is actually asking.\n\n- *\"Is this endpoint / URL / domain safe to call, trust, or pay?\"* → **vet_endpoint**. Returns one PROCEED / CAUTION / BLOCK verdict from TLS health, DNS hygiene, threat-intel reputation and domain age. Prefer it over calling ssl_tls_audit + dns_security_check + threat_intel_lookup separately: it costs less than the sum and returns a decision instead of three reports to reconcile.\n- *\"Should I install this MCP server or plugin?\"* → **scan_mcp_plugin**, before installing, not after.\n- *\"Should I trust this agent skill / SKILL.md?\"* → **scan_skill**, before loading it.\n- *\"What is CVE-2021-44228?\"* → **cve_lookup**.\n- *\"Is this IP or domain malicious?\"* → **threat_intel_lookup**.\n- *\"Is our email spoofable?\"* → **email_security_audit** (full DMARC/SPF/DKIM posture) or **dns_security_check** (DNS records only, cheaper).\n- *\"Are there vulnerabilities in this code?\"* → **sast_scan**. Hardcoded secrets → **secret_scan**. Vulnerable packages → **dependency_audit**.\n- *\"What ports and services are exposed?\"* → **vuln_scan_network**. Web app against OWASP Top 10 → **vuln_scan_web_app**.\n- *\"Are we SOC 2 / ISO 27001 / HIPAA / PCI-DSS / NIST CSF ready?\"* → **compliance_framework_check** first; then **control_gap_analysis** for a remediation roadmap, **evidence_collect** for audit evidence plans, **policy_generate** for policy documents, **audit_report_generate** for the final report.\n- *\"We have an incident.\"* → **incident_triage**.\n\n# Multi-tool workflows\n\nChain these rather than dumping every tool at a target. Each step's output should decide whether the next one is worth its price.\n\n1. **Vet before paying an unknown service:** vet_endpoint → if BLOCK, stop and tell the user; if CAUTION, ssl_tls_audit or threat_intel_lookup to explain why.\n2. **Assess a domain:** dns_security_check → email_security_audit → vuln_scan_network (only with authorization, see below).\n3. **Assess a repo:** dependency_audit → secret_scan → sast_scan, cheapest and highest-signal first.\n4. **Compliance push:** compliance_framework_check → control_gap_analysis → evidence_collect → audit_report_generate.\n5. **Supply chain before trusting third-party agent code:** scan_mcp_plugin or scan_skill → vet_endpoint on any endpoint that code calls out to.\n\nEvery paid tool accepts an optional **previous_scan_id**. Pass the scan_id of the step you are building on to record lineage, so the whole chain is retrievable later via agent_scan_get. It must be one of your own scans; it does not change the analysis.\n\n# Authorization and scope\n\nvuln_scan_network and vuln_scan_web_app send real traffic to the target and can trip intrusion detection. Only run them against hosts the user owns or is explicitly authorized to test, and confirm that before the call. Everything else here is passive (public DNS, certificates, threat-intel feeds, code the user supplied) and safe against any target.\n\nPrivate, reserved and loopback addresses are rejected by design. Repository scans accept https URLs only.\n\n# Results and errors\n\n- Both scanners can run asynchronously: pass async: true (some deployments default to it) and you get a job_id instead of findings. Poll GET /v1/jobs/{job_id} with the API key rather than re-calling the tool, which would charge again.\n- HTTP 402 means no valid payment was attached. Either supply an API key or complete the x402 challenge; do not retry the same unpaid request.\n- A tool returning {\"error\": ...} has already been billed on the x402 rail. Surface the error, do not silently retry.\n- Verdicts are advisory. PROCEED is not a guarantee, and reputation feeds false-positive on large CDN and cloud infrastructure. Present findings as evidence for the user's decision, not as certainty.", "tools": [ { "description": "Review user and role assignments you supply against least-privilege, flagging excessive, stale or orphaned access. Analyzes data the caller provides; it does not connect to an identity provider. Costs $1 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "admin_roles": { "items": { "type": "string" }, "type": "array" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" }, "sensitive_permissions": { "items": { "type": "string" }, "type": "array" }, "users": { "items": { "additionalProperties": false, "properties": { "created_date": { "type": "string" }, "department": { "type": "string" }, "email": { "type": "string" }, "employment_status": { "enum": [ "active", "terminated", "contractor", "leave" ], "type": "string" }, "last_login": { "type": "string" }, "permissions": { "items": { "type": "string" }, "type": "array" }, "roles": { "items": { "type": "string" }, "type": "array" }, "username": { "type": "string" } }, "required": [ "username", "email", "roles", "permissions" ], "type": "object" }, "type": "array" } }, "required": [ "users" ], "type": "object" }, "name": "access_review", "outputSchema": null }, { "description": "Returns the calling API key's prepaid balance, monthly limit, current month usage, and a breakdown of how many of each tool the customer can still afford. Free to call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": {}, "type": "object" }, "name": "account_balance", "outputSchema": null }, { "description": "Lists your recent scans (scan_id, tool, target, status, time) so you can retrieve or chain from a prior result. Optional limit/tool/target/since filters. Free to call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "limit": { "description": "Max scans to return (default 25).", "maximum": 100, "minimum": 1, "type": "integer" }, "since": { "description": "ISO-8601 timestamp; only scans started at/after this time.", "type": "string" }, "target": { "description": "Filter to scans of a specific target.", "type": "string" }, "tool": { "description": "Filter to a single tool name (e.g. 'cve_lookup').", "type": "string" } }, "type": "object" }, "name": "agent_history", "outputSchema": null }, { "description": "Retrieves one of your prior scans by scan_id, including the stored full output, so you can build on earlier results without re-paying. Free to call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "include_full_output": { "description": "Include the full stored tool output, not just the summary (default true).", "type": "boolean" }, "scan_id": { "description": "The scan id to retrieve (from agent_history).", "format": "uuid", "type": "string" } }, "required": [ "scan_id" ], "type": "object" }, "name": "agent_scan_get", "outputSchema": null }, { "description": "Returns your persistent AgentAegis agent identity (agent_id), how you're identified (API key / wallet / anonymous session), and lifetime call count + spend. Free to call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": {}, "type": "object" }, "name": "agent_whoami", "outputSchema": null }, { "description": "Synthesize findings into an audit-ready compliance report. Use at the END of an engagement, once gaps are closed. If the user only wants to know where they currently stand, run compliance_framework_check instead — it costs less and answers that question directly. Costs $5 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "assessment_results": { "items": { "additionalProperties": false, "properties": { "control_id": { "type": "string" }, "evidence_ref": { "type": "string" }, "notes": { "type": "string" }, "status": { "enum": [ "met", "partial", "not_met", "not_applicable" ], "type": "string" } }, "required": [ "control_id", "status" ], "type": "object" }, "type": "array" }, "framework": { "enum": [ "soc2", "iso27001", "hipaa", "pci_dss", "nist_csf" ], "type": "string" }, "organization_name": { "type": "string" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" }, "report_date": { "type": "string" }, "report_type": { "enum": [ "internal", "board", "auditor", "regulator" ], "type": "string" } }, "required": [ "framework", "assessment_results", "organization_name", "report_date", "report_type" ], "type": "object" }, "name": "audit_report_generate", "outputSchema": null }, { "description": "Assess an organization's security posture against a compliance framework (SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST CSF) and report per-control status. Use this FIRST when asked whether the org is audit-ready; control_gap_analysis builds on its output. Costs $2 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "framework": { "enum": [ "soc2", "iso27001", "hipaa", "pci_dss", "nist_csf" ], "type": "string" }, "organization_profile": { "additionalProperties": false, "properties": { "cloud_providers": { "items": { "type": "string" }, "type": "array" }, "employee_count": { "type": "number" }, "handles_payment_cards": { "type": "boolean" }, "handles_phi": { "type": "boolean" }, "handles_pii": { "type": "boolean" }, "has_pentest": { "type": "boolean" }, "has_security_team": { "type": "boolean" }, "has_soc_report": { "type": "boolean" }, "industry": { "type": "string" }, "tools_in_use": { "items": { "type": "string" }, "type": "array" } }, "required": [ "industry", "employee_count", "handles_pii", "handles_phi", "handles_payment_cards", "cloud_providers", "has_soc_report", "has_pentest", "has_security_team", "tools_in_use" ], "type": "object" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" } }, "required": [ "framework", "organization_profile" ], "type": "object" }, "name": "compliance_framework_check", "outputSchema": null }, { "description": "Turn unmet compliance controls into a prioritized remediation roadmap with effort estimates. Use after compliance_framework_check to answer 'what do we fix first'. Costs $2 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "budget_constraint": { "enum": [ "low", "medium", "high" ], "type": "string" }, "failing_controls": { "items": { "additionalProperties": false, "properties": { "control_id": { "type": "string" }, "current_state": { "type": "string" } }, "required": [ "control_id", "current_state" ], "type": "object" }, "type": "array" }, "framework": { "enum": [ "soc2", "iso27001", "hipaa", "pci_dss", "nist_csf" ], "type": "string" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" }, "timeline_constraint": { "enum": [ "30_days", "90_days", "6_months", "12_months" ], "type": "string" } }, "required": [ "framework", "failing_controls" ], "type": "object" }, "name": "control_gap_analysis", "outputSchema": null }, { "description": "Check whether an email address or domain appears in known credential-breach corpora (Have I Been Pwned), with the breaches and data classes exposed. Use when assessing account-takeover exposure. Costs $2 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "check_type": { "enum": [ "email", "domain" ], "type": "string" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" }, "target": { "minLength": 1, "type": "string" } }, "required": [ "check_type", "target" ], "type": "object" }, "name": "credential_check", "outputSchema": null }, { "description": "Look up one CVE by identifier: CVSS score and vector, affected products, patch availability and references. Use when a specific CVE ID is already known. Costs $1 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "cve_id": { "pattern": "^CVE-\\d{4}-\\d{4,}$", "type": "string" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" } }, "required": [ "cve_id" ], "type": "object" }, "name": "cve_lookup", "outputSchema": null }, { "description": "Audit a dependency manifest or https git repo for known-vulnerable packages (trivy): npm, pip, Go, Ruby, Java, Cargo. The cheapest, highest-signal first step when assessing an unfamiliar repository. Costs $2 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" }, "source": { "additionalProperties": false, "properties": { "manifest": { "type": "string" }, "manifest_type": { "enum": [ "npm", "pip", "go", "ruby", "java", "cargo" ], "type": "string" }, "type": { "enum": [ "git_repo", "manifest" ], "type": "string" }, "url": { "type": "string" } }, "required": [ "type" ], "type": "object" } }, "required": [ "source" ], "type": "object" }, "name": "dependency_audit", "outputSchema": null }, { "description": "Check a domain's DNS security records — SPF, DKIM, DMARC, DNSSEC — and grade the configuration. Passive. Covers the records themselves; for full spoofability posture use email_security_audit. Costs $1 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "domain": { "minLength": 1, "type": "string" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" } }, "required": [ "domain" ], "type": "object" }, "name": "dns_security_check", "outputSchema": null }, { "description": "Full email-security posture for a domain: whether mail from it can be spoofed, with DMARC/SPF/DKIM alignment and policy strength. A superset of dns_security_check for the email question specifically. Costs $2 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "domain": { "minLength": 1, "type": "string" }, "include_mx_analysis": { "type": "boolean" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" } }, "required": [ "domain" ], "type": "object" }, "name": "email_security_audit", "outputSchema": null }, { "description": "Build an evidence-collection plan for specific compliance controls: what artifact each control needs, where it comes from, and what makes it sufficient. Use when preparing for a real audit, after the gaps are known. Plans the collection; does not gather evidence for you. Costs $1 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "control_ids": { "items": { "type": "string" }, "type": "array" }, "framework": { "enum": [ "soc2", "iso27001", "hipaa", "pci_dss", "nist_csf" ], "type": "string" }, "integrations": { "additionalProperties": false, "properties": { "aws_access_key_id": { "type": "string" }, "aws_account_id": { "type": "string" }, "aws_region": { "type": "string" }, "aws_secret_access_key": { "type": "string" }, "aws_session_token": { "type": "string" }, "github_org": { "type": "string" }, "github_token": { "type": "string" }, "okta_domain": { "type": "string" }, "okta_token": { "type": "string" } }, "type": "object" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" } }, "required": [ "framework", "control_ids" ], "type": "object" }, "name": "evidence_collect", "outputSchema": null }, { "description": "Returns AgentAegis FAQ — authentication, balance/billing, tool catalog, async jobs, error codes, x402, rate limits, security. Optional topic filter. Free to call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "topic": { "enum": [ "all", "getting_started", "authentication", "balance_and_billing", "tools", "async_jobs", "integration", "errors", "x402", "rate_limits", "security", "built_on" ], "type": "string" } }, "type": "object" }, "name": "help", "outputSchema": null }, { "description": "Classify a security incident and produce severity, likely category, containment steps and a response plan. Use when something has already happened. If all you have is a suspicious IP or domain, run threat_intel_lookup first — it is cheaper and may settle the question. Costs $3 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "environment_context": { "additionalProperties": false, "properties": { "has_backups": { "type": "boolean" }, "has_edr": { "type": "boolean" }, "has_incident_response_plan": { "type": "boolean" }, "has_siem": { "type": "boolean" } }, "required": [ "has_edr", "has_siem", "has_backups", "has_incident_response_plan" ], "type": "object" }, "incident_description": { "type": "string" }, "indicators": { "additionalProperties": false, "properties": { "affected_accounts": { "items": { "type": "string" }, "type": "array" }, "affected_systems": { "items": { "type": "string" }, "type": "array" }, "log_snippets": { "items": { "type": "string" }, "type": "array" }, "suspicious_domains": { "items": { "type": "string" }, "type": "array" }, "suspicious_hashes": { "items": { "type": "string" }, "type": "array" }, "suspicious_ips": { "items": { "type": "string" }, "type": "array" } }, "type": "object" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" } }, "required": [ "incident_description", "indicators" ], "type": "object" }, "name": "incident_triage", "outputSchema": null }, { "description": "Assess MFA coverage and factor strength across a user or configuration set you supply, flagging unenrolled accounts and weak factors such as SMS. Analyzes data the caller provides; it does not connect to an identity provider. Costs $1 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" }, "users": { "items": { "additionalProperties": false, "properties": { "email": { "type": "string" }, "is_admin": { "type": "boolean" }, "is_service_account": { "type": "boolean" }, "last_mfa_verification": { "type": "string" }, "mfa_enabled": { "type": "boolean" }, "mfa_method": { "enum": [ "totp", "sms", "push", "hardware_key", "email", "none" ], "type": "string" }, "username": { "type": "string" } }, "required": [ "username", "email", "mfa_enabled", "is_admin", "is_service_account" ], "type": "object" }, "type": "array" } }, "required": [ "users" ], "type": "object" }, "name": "mfa_audit", "outputSchema": null }, { "description": "Generate a tailored written security policy (incident response, access control, encryption, vendor management, remote work, and similar). Use when a control gap specifically calls for documented policy. Costs $2 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "customizations": { "additionalProperties": false, "properties": { "byod_allowed": { "type": "boolean" }, "cloud_first": { "type": "boolean" }, "data_types": { "items": { "type": "string" }, "type": "array" }, "remote_workforce": { "type": "boolean" } }, "type": "object" }, "employee_count": { "type": "number" }, "frameworks": { "items": { "type": "string" }, "type": "array" }, "industry": { "type": "string" }, "organization_name": { "type": "string" }, "policy_type": { "enum": [ "incident_response", "acceptable_use", "data_classification", "access_control", "change_management", "vendor_management", "business_continuity", "encryption", "remote_work", "byod" ], "type": "string" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" } }, "required": [ "policy_type", "organization_name", "industry", "employee_count", "frameworks" ], "type": "object" }, "name": "policy_generate", "outputSchema": null }, { "description": "Static analysis of source code or an https git repo for security flaws (Semgrep): injection, unsafe deserialization, path traversal, crypto misuse. Python, JS/TS, Java, Go, Ruby, PHP, C/C++. For code LOGIC flaws — use secret_scan for hardcoded credentials and dependency_audit for vulnerable packages. Costs $5 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" }, "severity_threshold": { "enum": [ "info", "warning", "error" ], "type": "string" }, "source": { "additionalProperties": false, "properties": { "code": { "type": "string" }, "language": { "type": "string" }, "type": { "enum": [ "git_repo", "code_snippet" ], "type": "string" }, "url": { "type": "string" } }, "required": [ "type" ], "type": "object" } }, "required": [ "source" ], "type": "object" }, "name": "sast_scan", "outputSchema": null }, { "description": "Scan an MCP server (git repo or code) for supply-chain risk BEFORE trusting it — exfiltration (secrets/env to the network), prompt-injection sinks, dangerous capabilities, npm install hooks, obfuscation, plus Semgrep + secret scanning → a PROCEED/CAUTION/BLOCK verdict with findings. Costs $5 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" }, "source": { "additionalProperties": false, "properties": { "code": { "type": "string" }, "language": { "type": "string" }, "type": { "enum": [ "git_repo", "code_snippet" ], "type": "string" }, "url": { "type": "string" } }, "required": [ "type" ], "type": "object" } }, "required": [ "source" ], "type": "object" }, "name": "scan_mcp_plugin", "outputSchema": null }, { "description": "Scan an agent SKILL (git repo or SKILL.md) for supply-chain risk BEFORE trusting it — prompt-injection / hidden-unicode in the instructions (hard block), over-broad allowed-tools grants, plus exfiltration, dangerous capabilities, secrets and obfuscation in bundled scripts → a PROCEED/CAUTION/BLOCK verdict. Costs $5 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" }, "source": { "additionalProperties": false, "properties": { "skill_md": { "type": "string" }, "type": { "enum": [ "git_repo", "skill_md" ], "type": "string" }, "url": { "type": "string" } }, "required": [ "type" ], "type": "object" } }, "required": [ "source" ], "type": "object" }, "name": "scan_skill", "outputSchema": null }, { "description": "Detect hardcoded credentials, API keys and tokens in source code or an https git repo (trufflehog), verified against the issuing provider where supported. Use when the question is 'did we commit a secret'. Costs $2 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "include_history": { "type": "boolean" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" }, "source": { "additionalProperties": false, "properties": { "code": { "type": "string" }, "type": { "enum": [ "git_repo", "code_snippet" ], "type": "string" }, "url": { "type": "string" } }, "required": [ "type" ], "type": "object" } }, "required": [ "source" ], "type": "object" }, "name": "secret_scan", "outputSchema": null }, { "description": "Audit a domain's TLS configuration (sslyze): certificate validity and expiry, protocol versions, cipher suites, and known TLS weaknesses. Passive — safe against any host. Costs $1 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "hostname": { "minLength": 1, "type": "string" }, "port": { "maximum": 65535, "minimum": 1, "type": "integer" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" } }, "required": [ "hostname" ], "type": "object" }, "name": "ssl_tls_audit", "outputSchema": null }, { "description": "Reputation and indicator lookup for an IP or domain across AbuseIPDB, AlienVault OTX and abuse.ch. The cheapest way to check whether an indicator is known-bad. Interpret with care: large CDN, cloud and payment infrastructure routinely returns reputation hits, so only a curated active-malware hit is strong evidence on its own. Costs $2 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "indicator": { "type": "string" }, "indicator_type": { "enum": [ "ip", "domain", "url", "hash_md5", "hash_sha1", "hash_sha256" ], "type": "string" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" } }, "required": [ "indicator", "indicator_type" ], "type": "object" }, "name": "threat_intel_lookup", "outputSchema": null }, { "description": "Composite trust verdict (PROCEED/CAUTION/BLOCK) for an endpoint an agent is about to call or pay — combines TLS/cert health, DNS hygiene, threat-intel reputation, and domain age into one decision with reasons. Prefer this over running ssl_tls_audit + dns_security_check + threat_intel_lookup separately: it costs less than the sum and returns a decision rather than three reports to reconcile. Costs $3 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "endpoint": { "description": "The endpoint to vet — a full URL (https://api.example.com/pay) or a bare domain (example.com).", "minLength": 1, "type": "string" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" } }, "required": [ "endpoint" ], "type": "object" }, "name": "vet_endpoint", "outputSchema": null }, { "description": "Rank vulnerabilities you already have by exploitability and business impact, and group them into remediation actions. Analyzes findings you supply; it discovers nothing on its own. Costs $1 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "business_context": { "additionalProperties": false, "properties": { "business_criticality": { "enum": [ "low", "medium", "high", "critical" ], "type": "string" }, "handles_sensitive_data": { "type": "boolean" }, "internet_facing": { "type": "boolean" } }, "required": [ "internet_facing", "handles_sensitive_data", "business_criticality" ], "type": "object" }, "findings": { "items": { "additionalProperties": false, "properties": { "affected_system": { "type": "string" }, "cve_id": { "type": "string" }, "cvss_score": { "type": "number" }, "description": { "type": "string" }, "service_version": { "type": "string" } }, "required": [ "description", "affected_system" ], "type": "object" }, "type": "array" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" } }, "required": [ "findings" ], "type": "object" }, "name": "vuln_prioritize", "outputSchema": null }, { "description": "Discover open ports, running services and known vulnerabilities on an IP or domain (nmap). SENDS REAL TRAFFIC to the target and may trigger intrusion detection — only run against hosts the caller owns or is explicitly authorized to test, and confirm that first. Pass async:true to get a job_id to poll instead of blocking. Costs $3 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "async": { "type": "boolean" }, "port_range": { "type": "string" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" }, "scan_type": { "enum": [ "quick", "standard", "deep" ], "type": "string" }, "target": { "type": "string" } }, "required": [ "target", "scan_type" ], "type": "object" }, "name": "vuln_scan_network", "outputSchema": null }, { "description": "Scan a web application for OWASP Top 10 issues and known CVEs (Nuclei). SENDS REAL TRAFFIC to the target — authorized targets only, confirm before calling. Pass async:true to get a job_id to poll instead of blocking. Costs $5 per call.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "async": { "type": "boolean" }, "authentication": { "additionalProperties": false, "properties": { "credentials": { "type": "string" }, "type": { "enum": [ "cookie", "bearer", "basic" ], "type": "string" } }, "required": [ "type", "credentials" ], "type": "object" }, "exclude_paths": { "items": { "type": "string" }, "type": "array" }, "previous_scan_id": { "description": "Optional. A prior scan_id (from agent_history) to record as this call's parent — builds a traversable chained-workflow lineage retrievable via agent_scan_get. Must be one of your own scans; ignored otherwise. Does not change this tool's analysis.", "format": "uuid", "type": "string" }, "scan_depth": { "enum": [ "surface", "standard", "thorough" ], "type": "string" }, "target_url": { "type": "string" } }, "required": [ "target_url", "scan_depth" ], "type": "object" }, "name": "vuln_scan_web_app", "outputSchema": null } ] }
Verify it yourselfcurl -s https://api.teppi.xyz/v1/evidence/sha256:afdb3b56b43aa41934024c28d357093cf0920eebeea81552e8b9cd98f3486fd1 | sha256sum