# Wodan Posture

> Access-posture reports for agent data sourcing: robots, bot wall, licensing. Paid per call via x402.

- name: com.goedvps.app.wodan-posture/wodan-posture
- version: 1.7.0
- connection class: unknown (unknown)
- trust: 53/100 flags: no-repository, unreachable
- quality: 67/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.goedvps.app.wodan-posture%2Fwodan-posture
- tools: https://api.protogrid.dev/v1/servers/com.goedvps.app.wodan-posture%2Fwodan-posture/tools

**Not classified yet.** The remote endpoints have not been probed successfully, or the listing has nothing to connect to.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "wodan-posture": {
      "type": "http",
      "url": "https://wodan-posture.app.goedvps.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 0
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website -unreachable(8 failures) +updated-19d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 67/100 (needs work)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: page_report (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); posture_preview (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); robots_check (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 2,935 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 14 tool changes in 30 days
- fail `stability.rug_pull`: 1 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 11, about 2,935 tokens to load them all
- tool set hash: d0cdc1772c5934748de0f5b8fa489e3b
- tools last changed: 2026-10-01T21:41:19.157Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.goedvps.app.wodan-posture/wodan-posture.svg)](https://protogrid.dev/servers/com.goedvps.app.wodan-posture/wodan-posture)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-01 `origin_policy` added
  - Paid: $0.03 USDC on Base per call, paid automatically by an x402-capable MCP client. No signup, no API key. Returns the whole crawl policy of one public http(s) URL's origin, from ONE robots.txt fetch: every group, every rule with its line number in the file, which group governs each well-known agent and why, sitemaps resolved to absolute URLs, and two digests (robots_txt_sha256, policy_hash) to watch a policy for changes with one cheap call. An unanalysable URL is never charged for (error target_not_analysable). The free tool robots_check answers one agent's allow/disallow decision for one URL, for nothing. Argument: url.
- 2026-09-30 `robots_check` changed (description)
  - before: Free, no signup: shares posture_preview's 60-calls-per-hour budget across all callers. Answers the RFC 9309 question for one public http(s) URL and one crawler token (argument agent, e.g. 'GPTBot'; optional, defaults to the wildcard '*' group): may this agent fetch this URL? Also reports the same decision for '*', gptbot, claudebot, googlebot, perplexitybot and ccbot in one call. An unreachable or unparsable robots.txt is reported as status unknown with allowed null - never guessed as allowed. The HTTP equivalent is GET /v1/robots/check. For the wider questions this tool does not answer: page_posture ($0.01) is the full access-posture report, page_sources ($0.02) is where the data is, page_data ($0.03) is the data itself.
  - after: Free, no signup: shares posture_preview's 60-calls-per-hour budget across all callers. Answers the RFC 9309 question for one public http(s) URL and one crawler token (argument agent, e.g. 'GPTBot'; optional, defaults to the wildcard '*' group): may this agent fetch this URL? Also reports the same decision for '*', gptbot, claudebot, googlebot, perplexitybot and ccbot in one call. An unreachable or unparsable robots.txt is reported as status unknown with allowed null - never guessed as allowed. The HTTP equivalent is GET /v1/robots/check. For the wider questions this tool does not answer: page_posture ($0.01) is the full access-posture report, page_sources ($0.02) is where the data is, page_data ($0.03) is the data itself. For many URLs at once, can_fetch ($0.02) answers the same question for up to 100 URLs in one payment, one robots.txt fetch per distinct origin.
- 2026-09-30 `can_fetch` added
  - Paid: $0.02 USDC on Base per call, paid automatically by an x402-capable MCP client. No signup, no API key. Answers the RFC 9309 crawl-permission question for up to 100 public http(s) URLs in one payment: may the given crawler agent fetch each URL? One robots.txt fetch per distinct origin (at most 25 origins), not one per URL. Argument agent is the crawler token (e.g. 'GPTBot'); optional, defaults to the wildcard '*' group. An unreadable or unparsable robots.txt is reported as status unknown, allowed null - never guessed as allowed. Errors are never charged for. The free tool robots_check answers the same question for one URL at a time, for nothing. Arguments: urls (1 to 100 strings), agent (optional).
- 2026-09-30 `crawl_policy` added
  - Free, no signup: shares posture_preview's 60-calls-per-hour budget across all callers. Returns live RFC 9309 allow/disallow decisions for a fixed, versioned sample of up to 24 public origins, computed from each origin's own robots.txt. A robots.txt that cannot be read is reported as unknown, never as allowed. Argument: limit (optional, 1-24, default all origins in the seed). The HTTP equivalent is GET /v1/agents/policy (add ?format=csv for CSV). For a single page's full access-posture report, use the paid tool page_posture ($0.01).
- 2026-09-29 `domain_report` added
  - Paid: $0.06 USDC on Base per call. No signup, no API key. The domain-level agent-access report for the ORIGIN of one public http(s) URL: robots.txt decisions for every well-known agent token at the given path, which agent-facing documents the origin publishes (llms.txt, /.well-known/x402, /.well-known/mcp.json, security.txt), whether its declared sitemap actually contains pages the origin allows an agent to fetch, and a sample of those pages analysed for agreement with the robots policy. Verdicts: open, restricted, blocked, mixed, unreachable. Answers a different question than page_posture: not 'can I fetch this one page' but 'what is this whole site's policy toward agents'. Free companion for a single agent at a single path: robots_check. An unanalysable target is never charged for (target_not_analysable); an origin that publishes nothing at all (no robots.txt, no discovery document, no sitemap, unreachable root page) answers nothing_to_report, also uncharged.
- 2026-09-28 `page_report` added
  - Paid: $0.04 USDC on Base per call. No signup, no API key. The whole-page report for one public http(s) URL in ONE payment: the access-posture report (page_posture), where the data is (page_sources) and the data itself (page_data), composed from the same builders as the three single routes, so $0.04 instead of $0.06 for three separate calls. If the posture component cannot be produced the whole call fails closed (target_not_analysable) and nothing settles; if sources or data fails or times out the answer is still 200 with that component absent from `products` and named in `partial`.
- 2026-09-27 `pages_posture` added
  - Paid: $0.05 USDC on Base per call, as GET /v1/pages/posture?url=...&url=... (repeat url up to ten times) or POST /v1/pages/posture with a JSON body. No signup, no API key. Analyses up to 10 public http(s) URLs in ONE payment and ONE settlement, instead of paying page_posture ten times: the same access-posture report as page_posture, per URL, as a verdict array. An individual unanalysable or empty URL is never a batch failure - it is reported as its own error entry in results, target_not_analysable or nothing_to_report - and the batch is only charged (settles) when at least one URL could be analysed; if every URL fails the whole call answers 404 and nothing settles. Free companions cover a single URL: posture_preview and robots_check.
- 2026-09-27 `robots_check` added
  - Free, no signup: shares posture_preview's 60-calls-per-hour budget across all callers. Answers the RFC 9309 question for one public http(s) URL and one crawler token (argument agent, e.g. 'GPTBot'; optional, defaults to the wildcard '*' group): may this agent fetch this URL? Also reports the same decision for '*', gptbot, claudebot, googlebot, perplexitybot and ccbot in one call. An unreachable or unparsable robots.txt is reported as status unknown with allowed null - never guessed as allowed. The HTTP equivalent is GET /v1/robots/check. For the wider questions this tool does not answer: page_posture ($0.01) is the full access-posture report, page_sources ($0.02) is where the data is, page_data ($0.03) is the data itself.
- 2026-09-27 `page_data` added
  - Paid: $0.03 USDC on Base per call. No signup, no API key. Returns the machine-readable data one public http(s) URL already publishes: every JSON-LD block, OpenGraph/Twitter-card/standard meta, embedded JSON state blobs (e.g. __NEXT_DATA__), parsed entries if the document is RSS/Atom/JSON Feed, HTML tables, and alternate/canonical links - each capped and returned exactly as observed, nothing invented or inferred by a model. Does not render JavaScript, does not follow links off the page, does not summarize. An unanalysable URL is never charged for (error target_not_analysable); a page with nothing extractable answers nothing_to_report, also uncharged.
- 2026-09-26 `posture_preview` changed (inputSchema)

Full history: https://api.protogrid.dev/v1/servers/com.goedvps.app.wodan-posture%2Fwodan-posture/changes

## Remotes

- https://wodan-posture.app.goedvps.com/mcp (streamable-http, auth none, reachable false, uptime30d 0.84313726)

## Packages

_none_

## Tools (11)

- `can_fetch`: Paid: $0.02 USDC on Base per call, paid automatically by an x402-capable MCP client. No signup, no API key. Answers the RFC 9309 crawl-permission question for up to 100 public http(s) URLs in one payment: may the given crawler agent fetch each URL? One robots.txt fetch per distinct origin (at most 25 origins), not one per URL. Argument agent is the crawler token (e.g. 'GPTBot'); optional, defaults to the wildcard '*' group. An unreadable or unparsable robots.txt is reported as status unknown, allowed null - never guessed as allowed. Errors are never charged for. The free tool robots_check answers the same question for one URL at a time, for nothing. Arguments: urls (1 to 100 strings), agent (optional).
- `crawl_policy`: Free, no signup: shares posture_preview's 60-calls-per-hour budget across all callers. Returns live RFC 9309 allow/disallow decisions for a fixed, versioned sample of up to 24 public origins, computed from each origin's own robots.txt. A robots.txt that cannot be read is reported as unknown, never as allowed. Argument: limit (optional, 1-24, default all origins in the seed). The HTTP equivalent is GET /v1/agents/policy (add ?format=csv for CSV). For a single page's full access-posture report, use the paid tool page_posture ($0.01).
- `domain_report`: Paid: $0.06 USDC on Base per call. No signup, no API key. The domain-level agent-access report for the ORIGIN of one public http(s) URL: robots.txt decisions for every well-known agent token at the given path, which agent-facing documents the origin publishes (llms.txt, /.well-known/x402, /.well-known/mcp.json, security.txt), whether its declared sitemap actually contains pages the origin allows an agent to fetch, and a sample of those pages analysed for agreement with the robots policy. Verdicts: open, restricted, blocked, mixed, unreachable. Answers a different question than page_posture: not 'can I fetch this one page' but 'what is this whole site's policy toward agents'. Free companion for a single agent at a single path: robots_check. An unanalysable target is never charged for (target_not_analysable); an origin that publishes nothing at all (no robots.txt, no discovery document, no sitemap, unreachable root page) answers nothing_to_report, also uncharged.
- `origin_policy`: Paid: $0.03 USDC on Base per call, paid automatically by an x402-capable MCP client. No signup, no API key. Returns the whole crawl policy of one public http(s) URL's origin, from ONE robots.txt fetch: every group, every rule with its line number in the file, which group governs each well-known agent and why, sitemaps resolved to absolute URLs, and two digests (robots_txt_sha256, policy_hash) to watch a policy for changes with one cheap call. An unanalysable URL is never charged for (error target_not_analysable). The free tool robots_check answers one agent's allow/disallow decision for one URL, for nothing. Argument: url.
- `page_data`: Paid: $0.03 USDC on Base per call. No signup, no API key. Returns the machine-readable data one public http(s) URL already publishes: every JSON-LD block, OpenGraph/Twitter-card/standard meta, embedded JSON state blobs (e.g. __NEXT_DATA__), parsed entries if the document is RSS/Atom/JSON Feed, HTML tables, and alternate/canonical links - each capped and returned exactly as observed, nothing invented or inferred by a model. Does not render JavaScript, does not follow links off the page, does not summarize. An unanalysable URL is never charged for (error target_not_analysable); a page with nothing extractable answers nothing_to_report, also uncharged.
- `page_posture`: Paid: $0.01 USDC on Base per call, paid automatically by an x402-capable MCP client. No signup, no API key. Analyses one public http(s) URL and reports whether an agent may treat it as a machine-readable data source: exact-path robots.txt verdict, bot-wall vendor, JavaScript requirement, extractable content, JSON-LD types, licence hint, evidence lines. Verdicts: open, machine_readable, robots_disallowed, bot_walled, auth_required, js_rendered, thin_content, unreachable. An unanalysable URL is never charged for (error target_not_analysable). Argument: url. Free alternative for the verdict alone: posture_preview.
- `page_report`: Paid: $0.04 USDC on Base per call. No signup, no API key. The whole-page report for one public http(s) URL in ONE payment: the access-posture report (page_posture), where the data is (page_sources) and the data itself (page_data), composed from the same builders as the three single routes, so $0.04 instead of $0.06 for three separate calls. If the posture component cannot be produced the whole call fails closed (target_not_analysable) and nothing settles; if sources or data fails or times out the answer is still 200 with that component absent from `products` and named in `partial`.
- `page_sources`: Paid: $0.02 USDC on Base per call, paid automatically by an x402-capable MCP client. No signup, no API key. For one public http(s) URL returns the posture verdict plus where the data is: sitemaps (robots.txt Sitemap lines and /sitemap.xml, with the status observed), RSS/Atom feeds, whether /llms.txt answers 200, the status of /.well-known/x402, ai-plugin.json and mcp.json, JSON/CSV/XML endpoints, JSON-LD types, licence hint. Every field is observed or explicitly empty with a reason. An unanalysable URL (target_not_analysable) or a site that advertises nothing (nothing_to_report) is never charged for. Argument: url.
- `pages_posture`: Paid: $0.05 USDC on Base per call, as GET /v1/pages/posture?url=...&url=... (repeat url up to ten times) or POST /v1/pages/posture with a JSON body. No signup, no API key. Analyses up to 10 public http(s) URLs in ONE payment and ONE settlement, instead of paying page_posture ten times: the same access-posture report as page_posture, per URL, as a verdict array. An individual unanalysable or empty URL is never a batch failure - it is reported as its own error entry in results, target_not_analysable or nothing_to_report - and the batch is only charged (settles) when at least one URL could be analysed; if every URL fails the whole call answers 404 and nothing settles. Free companions cover a single URL: posture_preview and robots_check.
- `posture_preview`: Free, no payment and no signup: 60 calls per hour, shared across all callers. Returns the headline of the same analysis - verdict, confidence, the full report's field schema, one evidence line and the price - so a caller can decide before paying. Use it when you only need the verdict; call page_posture ($0.01) for the complete report with evidence and provenance.
- `robots_check`: Free, no signup: shares posture_preview's 60-calls-per-hour budget across all callers. Answers the RFC 9309 question for one public http(s) URL and one crawler token (argument agent, e.g. 'GPTBot'; optional, defaults to the wildcard '*' group): may this agent fetch this URL? Also reports the same decision for '*', gptbot, claudebot, googlebot, perplexitybot and ccbot in one call. An unreachable or unparsable robots.txt is reported as status unknown with allowed null - never guessed as allowed. The HTTP equivalent is GET /v1/robots/check. For the wider questions this tool does not answer: page_posture ($0.01) is the full access-posture report, page_sources ($0.02) is where the data is, page_data ($0.03) is the data itself. For many URLs at once, can_fetch ($0.02) answers the same question for up to 100 URLs in one payment, one robots.txt fetch per distinct origin.