# dev.mcphost/mcphost

> Hosted MCP runtime where your agent publishes its own tools by tool call and keeps working.

- name: dev.mcphost/mcphost
- version: 0.112.10
- connection class: R0 (autonomous)
- trust: 91/100 flags: multi-version-spam
- quality: 69/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/dev.mcphost%2Fmcphost
- tools: https://api.protogrid.dev/v1/servers/dev.mcphost%2Fmcphost/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "mcphost": {
      "type": "http",
      "url": "https://mcphost.dev/mcp"
    }
  }
}
```


## Trust

- hygiene: 75
- liveness: 100
- freshness: 100
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-100% +updated-0d-ago -multi-version-spam(187)
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 69/100 (needs work)

### protocol: 100 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- pass `protocol.list_ttl`: tool list is cacheable (ttlMs 30000)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 64 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: host.help.search (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); host.help.get (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); billing.plans (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- warn `tools.token_cost`: about 8,323 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 612 tool changes in 30 days
- fail `stability.rug_pull`: 6 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 18, about 8,323 tokens to load them all
- tool set hash: bb57ef1b0301202f49cc40f6c7b6ea72
- tools last changed: 2026-10-20T07:21:45.559Z
- badge: [![protogrid quality](https://protogrid.dev/badge/dev.mcphost/mcphost.svg)](https://protogrid.dev/servers/dev.mcphost/mcphost)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-20 `host.resume` added
  - Resume where you left off in one call (at most 4096 bytes): your tools with each one's last call status, unfinished runs, your newest notes, what changed on the host since your last call, and one suggested next_call. truncated names any section that was cut -- call that section's own tool (host.tool.list, host.runs.list, host.note.list, host.changelog) for the rest. Read-only. An unauthenticated caller gets the onboarding block and creates no tenant.
- 2026-10-20 `host.feedback.list` changed (inputSchema)
- 2026-10-20 `host.feedback.send` changed (inputSchema)
- 2026-10-20 `host.state.list` changed (inputSchema)
- 2026-10-20 `host.state.get` changed (inputSchema)
- 2026-10-20 `host.state.set` changed (inputSchema)
- 2026-10-20 `host.tool_test` changed (inputSchema)
- 2026-10-20 `host.tool_call` changed (inputSchema)
- 2026-10-20 `host.tool_publish` changed (inputSchema)
- 2026-10-20 `host.whoami` changed (inputSchema)

Full history: https://api.protogrid.dev/v1/servers/dev.mcphost%2Fmcphost/changes

## Remotes

- https://mcphost.dev/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (18)

- `billing.plans`: The plan catalog (price and quotas per plan) and whether Stripe billing is configured on this host. Anonymous callers get the same answer as tenants.
- `host.errors`: List every error code this host can return, each with its class (agent_fault | host_refusal | upstream_fault | plan_limit | host_fault), family, remedy, docs anchor, retryable flag and help_url -- the same object GET /errors.json serves. Pass code to get one row; a misspelt code answers tool_not_found with did_you_mean. Read-only, anonymous, no tenant data.
- `host.feedback.list`: List your own feedback (newest first, status received). Anonymous callers get [].
- `host.feedback.send`: Tell the host's humans what you needed: kind, up to 2048 bytes of text, optional context. Works before signup. Returns feedback_id.
- `host.help.get`: Return the documentation section an anchor points at: its text (at most 4 KB) and its first fenced example. Pass an anchor exactly as an error, hint or help entry printed it, e.g. a rate_limited error's `anchor`. Read-only, anonymous, no tenant data. An unknown anchor is anchor_not_found with the nearest anchors in did_you_mean.
- `host.help.search`: Search this host's own documentation and tool descriptions. Returns up to k hits (default 3, response under 2 KB), each with a snippet, the nearest runnable example and an anchor. Read-only, anonymous, no tenant data -- call it with the error text or import line you are stuck on before reading any docs file.
- `host.quickstart`: Return the shortest ordered sequence of calls to a working tool of `kind`, with your namespace and a filled-in example already substituted in, plus the current limits and a try_before_call table naming the one dry-run tool for each case. Read-only -- this call alone never creates a tenant. Call this before host.tool_publish if you're not sure what a spec should look like. Unauthenticated callers get a worked example with no tenant data; any other host.*/billing.* call creates a tenant on first use, no signup required.
- `host.redeem`: Exchange a signup(handoff: true) handoff_token for the tenant key it was issued for. Single-use: a second redemption fails with handoff_token_redeemed; past its expiry it fails with handoff_token_expired. Unauthenticated -- the token itself is the proof.
- `host.resume`: Resume where you left off in one call (at most 4096 bytes): your tools with each one's last call status, unfinished runs, your newest notes, what changed on the host since your last call, and one suggested next_call. truncated names any section that was cut -- call that section's own tool (host.tool.list, host.runs.list, host.note.list, host.changelog) for the rest. Read-only. An unauthenticated caller gets the onboarding block and creates no tenant.
- `host.state.get`: Read one key from this tenant's key-value state namespace. Returns found: false (not an error) if the key was never set.
- `host.state.list`: List keys (with their current values) in this tenant's key-value state namespace, optionally filtered by prefix.
- `host.state.set`: Write one key in this tenant's key-value state namespace; value may be any JSON value. Overrun of the plan's state_bytes_max quota fails with state_quota_exceeded and writes nothing.
- `host.tool_call`: Invoke a tool this tenant has already published, by its local name -- the same real, metered call as calling it directly by its namespaced name (<namespace>.<name>), for a session that has no way to see its own namespaced tool name yet. Unlike host.tool_test, this counts toward host.usage and appears in host.tool_logs. Pass async: true for a tool that needs more than the call deadline: returns {run_id, status: "queued"} immediately instead of running inline -- see host.runs.get/wait. Pass version to pin the call to one of host.tool_history's versions instead of whichever is current.
- `host.tool_publish`: Publish a tool of a registered kind (e.g. python, http or echo; the kind argument's enum lists them all) under this tenant's namespace. Call host.quickstart(kind) first for a filled-in example spec and the full publish-to-call sequence. Python's sandbox API: import mcphost (mcphost.table, mcphost.state, mcphost.docs). Name must match ^[a-z][a-z0-9_]{1,40}$; a rejection names the failing field and a corrected example. Try host.tool_test before a real call.
- `host.tool_share`: Share one of this tenant's published tools with everyone (visibility: "public") or with a named group this tenant owns (visibility: "group", group: <name>). The tool keeps running in this tenant's own sandbox with this tenant's own secrets; a caller reaches it as <this tenant's namespace>.<name>.
- `host.tool_test`: Dry-run a published tool by name: verdict (pass/will_fail/unverifiable), writes rolled back (dry_run); see host.quickstart.
- `host.whoami`: Return the calling tenant's identity, including key_age_s and key_rotated_at for auditing credential hygiene.
- `signup`: Explicit signup, for a client that cannot keep a session across calls: create a tenant and receive a bearer key and namespace. Unauthenticated. Most clients never need this -- any other host.*/billing.* call from a fresh connection creates a tenant implicitly and returns its own /u/<secret>/mcp URL in the response's onboarding field. Recommended here: pass handoff: true to receive a short-lived, single-use handoff_token instead of the raw key -- redeem it once with host.redeem to get the key, so a transcript of this call and the redeem call, if it leaks, carries a dead credential. The raw-key path (handoff omitted) stays fully supported.