# AgentPixel

> Most visitors never fill out a form. Turn the ones who click Accept into contacts your agent reads.

- name: io.agentpixel/agentpixel
- version: 0.1.4
- connection class: R0 (autonomous)
- trust: 96/100
- quality: 75/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.agentpixel%2Fagentpixel
- tools: https://api.protogrid.dev/v1/servers/io.agentpixel%2Fagentpixel/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "agentpixel": {
      "type": "http",
      "url": "https://agentpixel.io/mcp",
      "headers": {
        "Authorization": "Bearer ${AGENTPIXEL_TOKEN}",
        "X-API-Key": "${X_API_KEY}"
      }
    }
  }
}
```

Placeholders to fill: `${AGENTPIXEL_TOKEN}`, `${X_API_KEY}`.

## Trust

- hygiene: 100
- liveness: 100
- freshness: 100
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-100% +updated-9d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 75/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 14 of 14 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 3,741 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 24 tool changes in 30 days
- fail `stability.rug_pull`: 5 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 14, about 3,741 tokens to load them all
- tool set hash: 899aa6f4175dd54a1772361afc878bb5
- tools last changed: 2026-10-11T01:26:14.347Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.agentpixel/agentpixel.svg)](https://protogrid.dev/servers/io.agentpixel/agentpixel)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-11 `get_contacts` changed (title, description, inputSchema, annotations)
  - before: Resolved contacts for one pixel. Pass on as a UTC day (YYYY-MM-DD), or after as the high_water from the previous pull. Pass one of them. after 0 starts at the first stored contact. Use high_water as the next cursor. New contacts can arrive between reads. This does not resolve new visitors. Evaluation returns labeled synthetic examples only after current resolution consent is saved; withdrawal hides them.
  - after: Contacts for one pixel. Pass on as a UTC day, or after as the high_water from the previous pull. Use high_water as the next cursor. New contacts can arrive between reads. This does not identify new visitors. Evaluation returns labeled synthetic examples only after current resolution consent is saved; withdrawal hides them.
- 2026-10-11 `get_policy` changed (inputSchema)
- 2026-10-11 `configure_consent` changed (description, inputSchema) **meaning changed**
  - before: Turn on and set up the privacy bar for a pixel. controller_name: the business that owns the site (shown in the bar). purposes: what the bar asks for. Choose from analytics, resolution, newsletter, email_sharing, phone_sharing, partner_email, partner_calls, partner_sms. Include "resolution" or no visitor is ever identified. site_policy_url: the site's own privacy policy (https). The bar links to it, and the hosted notice becomes a short add-on about identification. controller_type: company, person, or organization. contact_channels: email, phone, sms, agentic. Changing any setting makes a new policy version, and returning visitors are asked again. Returns the policy link and the script tag to put on the site.
  - after: Turn on and set up the consent bar for a pixel. Changing any setting makes a new policy version, and returning visitors are asked again. Returns the policy link and the script tag to put on the site.
- 2026-10-11 `check_install` changed (inputSchema)
- 2026-10-11 `get_pixel` changed (inputSchema)
- 2026-10-11 `create_pixel` changed (description, inputSchema)
  - before: Create a pixel for a domain and return the HTML snippet to paste on that site. Does not create an API key. The account must already be active. install_status starts as not_checked until check_install runs.
  - after: Create a pixel for a domain. Does not create an API key. The account must already be active. Next: call configure_consent(pixel_id, controller_name, purposes) and install the snippet it returns. Do not install a snippet before consent is configured. install_status starts as not_checked until check_install runs.
- 2026-10-11 `whoami` changed (description)
  - before: Which account this connection's API key belongs to. status is the account after email confirmation and checkout. plan is free during the 30-day trial, paid after the subscription, or unlimited for internal accounts. key_prefix is the start of the key, not the key.
  - after: Which account this connection's API key belongs to. status is the account state after email confirmation. plan is "free" (the trial plan id) during the 30-day trial, paid after the subscription, or unlimited for internal accounts. trial_ends_at is when the trial ends. key_prefix is the start of the key, not the key.
- 2026-10-11 `create_api_key` changed (description, inputSchema) **meaning changed**
  - before: Get your API key after the email is confirmed. Requires the account_id and signup_token from trial registration. Returns a private API key once. Keep the key confidential.
  - after: Issue an API key after the email is confirmed. Not needed when confirm_signup already returned api_key. Each call issues another key, so call it once. Returns the key once. Store it securely and attach it to the connection.
- 2026-10-11 `resend_code` added
  - Send a new 6-digit code to the email of an existing account. Use it when the code expired, was lost or was entered wrong 5 times. Limits: 1 per minute, 5 per day. The old code stops working. With an expired signup_token, use the new code on POST /v1/accounts/{account_id}/signup-token to get a new token.
- 2026-10-11 `confirm_signup` changed (description, inputSchema) **meaning changed**
  - before: Confirm the email address from the link in the signup email. Copy the token value from the confirmation URL (?token=...) and pass it here. This activates the confirmed trial account.
  - after: Confirm the email with the 6-digit code, or check whether the email link was clicked. Preferred: confirm_signup(account_id, code, signup_token). The first confirmation returns api_key; store it, it is shown once. Link clicked instead: call confirm_signup(account_id, signup_token) every 5 seconds, up to 10 minutes, until email_verified is true, then call create_api_key. A code allows 5 attempts and lasts 24 hours. For a new code, call resend_code(email).

Full history: https://api.protogrid.dev/v1/servers/io.agentpixel%2Fagentpixel/changes

## Remotes

- https://agentpixel.io/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (14)

- `check_install`: Fetch the pixel's homepage and store whether the tag is there.

        install_status becomes installed or not_installed. check_error says
        why a check could not decide. Evaluator accounts fetch only the fixed
        https://staging.allsourcedata.io/evaluation-test/ page and reject redirects.
        
- `configure_consent`: Turn on and set up the consent bar for a pixel.

        Changing any setting makes a new policy version, and returning visitors are asked again.
        Returns the policy link and the script tag to put on the site.
        
- `confirm_signup`: Confirm the email with the 6-digit code, or check whether the email link was clicked.

        Preferred: confirm_signup(account_id, code, signup_token). The first confirmation returns api_key; store it, it is shown once.
        Link clicked instead: call confirm_signup(account_id, signup_token) every 5 seconds, up to 10 minutes, until email_verified is true, then call create_api_key.
        A code allows 5 attempts and lasts 24 hours. For a new code, call resend_code(email).
        
- `create_api_key`: Issue an API key after the email is confirmed.

        Not needed when confirm_signup already returned api_key. Each call issues another key, so call it once.
        Returns the key once. Store it securely and attach it to the connection.
        
- `create_pixel`: Create a pixel for a domain.

        Does not create an API key. The account must already be active.
        Next: call configure_consent(pixel_id, controller_name, purposes) and install the snippet it returns.
        Do not install a snippet before consent is configured. install_status starts as not_checked until check_install runs.
        
- `get_contacts`: Contacts for one pixel.

        Pass on as a UTC day, or after as the high_water from the previous pull. Use high_water as the next cursor.
        New contacts can arrive between reads. This does not identify new visitors.
        Evaluation returns labeled synthetic examples only after current resolution consent is saved; withdrawal hides them.
        
- `get_pixel`: One pixel, including the HTML snippet to paste on its site.
- `get_policy`: Hosted privacy and data-use policy HTML for a pixel.

        A pixel with consent turned off has no policy yet.
        
- `list_pixels`: Pixels on this account. Each item has pixel_id, domain, and install_status.
- `resend_code`: Send a new 6-digit code to the email of an existing account.

        Use it when the code expired, was lost or was entered wrong 5 times. Limits: 1 per minute, 5 per day.
        The old code stops working. With an expired signup_token, use the new code on POST /v1/accounts/{account_id}/signup-token to get a new token.
        
- `setup_status`: Whether this account can use pixels and whether a tag is installed.

        setup_complete is true once at least one pixel's tag has been seen on
        its site. good_standing is the account, not the tag.
        
- `signup_free`: Start a 30-day trial, no card. After that, $1 per account per month for 3 pixels and 500 new contacts per UTC calendar month.

        Sends a 6-digit code to the email address. Returns account_id and signup_token; keep both.
        Next: ask the person for the 6-digit code in the AgentPixel email, then call confirm_signup(account_id, code, signup_token).
        The signup_token lasts 24 hours.
        
- `try_sample`: Labeled sample of what an account gets: a pixel, a consent receipt and two contacts.

        Needs no account and no key. Every record is synthetic and marked so.
        Call this first to show the person what AgentPixel returns, then call signup_free.
        
- `whoami`: Which account this connection's API key belongs to.

        status is the account state after email confirmation. plan is "free" (the trial plan id) during the 30-day trial,
        paid after the subscription, or unlimited for internal accounts. trial_ends_at is when the trial ends.
        key_prefix is the start of the key, not the key.