Search / io.github.ShoonEnterprises/shoon-a2a-sandbox
protogridR0· no sign-inFive trust services for agents: claim checks, citation audits, extraction, tripwires, work audits.
v0.1.0 · active · repository · website · descriptor JSON · versions
{
"mcpServers": {
"shoon-a2a-sandbox": {
"type": "http",
"url": "https://shoon-a2a-sandbox.onrender.com/mcp",
"headers": {
"X-API-KEY": "${X_API_KEY}"
}
}
}
}claude mcp add --transport http shoon-a2a-sandbox https://shoon-a2a-sandbox.onrender.com/mcp --header "X-API-KEY: ${X_API_KEY}"[mcp_servers.shoon-a2a-sandbox]
url = "https://shoon-a2a-sandbox.onrender.com/mcp"
env_http_headers = { "X-API-KEY" = "X_API_KEY" }
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"shoon-a2a-sandbox": {
"type": "remote",
"url": "https://shoon-a2a-sandbox.onrender.com/mcp",
"enabled": true,
"headers": {
"X-API-KEY": "{env:X_API_KEY}"
}
}
}
}{
"mcpServers": {
"shoon-a2a-sandbox": {
"type": "http",
"url": "https://shoon-a2a-sandbox.onrender.com/mcp",
"headers": {
"X-API-KEY": "${X_API_KEY}"
}
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=shoon-a2a-sandbox&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vc2hvb24tYTJhLXNhbmRib3gub25yZW5kZXIuY29tL21jcCIsImhlYWRlcnMiOnsiWC1BUEktS0VZIjoiJHtYX0FQSV9LRVl9In19"
}{
"servers": {
"shoon-a2a-sandbox": {
"type": "http",
"url": "https://shoon-a2a-sandbox.onrender.com/mcp",
"headers": {
"X-API-KEY": "${X_API_KEY}"
}
}
}
}{
"mcpServers": {
"shoon-a2a-sandbox": {
"httpUrl": "https://shoon-a2a-sandbox.onrender.com/mcp",
"headers": {
"X-API-KEY": "${X_API_KEY}"
}
}
}
}extensions:
"shoon-a2a-sandbox":
enabled: true
name: "shoon-a2a-sandbox"
type: streamable_http
uri: "https://shoon-a2a-sandbox.onrender.com/mcp"
headers:
"X-API-KEY": "${X_API_KEY}"
timeout: 300
Placeholders to fill from your own secret store: ${X_API_KEY}. The registry never accepts secret values.
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_length5 tools have descriptions over 1,024 characters, which crowds the contexttools.schemasevery tool has an object input schematools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky onestools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: claim_verification (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); proof_of_work_audit (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); citation_audit (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …tools.token_costabout 2,275 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changesno tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo +website +reachable +uptime-100% ~updated-31d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://shoon-a2a-sandbox.onrender.com/mcp streamable-http | none | yes | 100% | 337 ms | 2025-06-18 | 2026-10-20 |
citation_audit | Audit the citations in a document you are drafting, reviewing, or fact-checking — catch dead links and misquotes before your principal sees them. For each citation it fetches the URL over plain HTTPS and reports the HTTP status, content type, and whether the quoted text appears verbatim in the fetched page. It does not judge argument quality, and paywalled or JavaScript-heavy pages may fetch without matching. Up to 25 citations per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability. |
claim_verification | Before you rely on a claim — or repeat it to your principal — check it against its cited sources. Give this service the claim plus the sources and quoted text your principal provided; it fetches each source URL over plain HTTPS and reports the HTTP status and whether the quoted text appears verbatim in the page. It checks evidence presence, not underlying truth: 'supported' means your quote was found in the source, and anything it cannot check is marked 'unverified', never 'contradicted'. Up to 10 claims with up to 5 sources each per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability. |
news_tripwire | Watch a public page or feed for the keywords your principal cares about — a competitor name, a token symbol, a topic. Register the watch once, then check on demand: the service fetches the URL over plain HTTPS and reports per-keyword match counts with snippet context. Checks run when you ask (no background scheduler in the pilot); it reports keyword presence, not news judgement. Up to 20 keywords per tripwire. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability. |
proof_of_work_audit | When someone claims work was done — a deliverable shipped, a deployment live, a report published — check the evidence before you report back to your principal. Give it the work claim plus evidence URLs and the text you expect to find; it fetches each URL over plain HTTPS and reports whether it resolves and whether the expected text appears. It checks evidence presence, never that the work actually happened — results are honestly labeled as evidence-resolution checks. Up to 10 evidence items per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability. |
structured_extraction | Turn messy text or a web page into structured data — headings, links, tables, word counts — without spending your own context window on parsing. Deterministic heuristics only: no LLM, no semantic understanding, fully reproducible output, plainly labeled as heuristic. It extracts structure, not meaning. Pass raw text (up to 100,000 characters) or a URL. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability. |
Schemas: list_tools.
{
"name": "io.github.ShoonEnterprises/shoon-a2a-sandbox",
"_meta": {
"io.modelcontextprotocol.registry/publisher-provided": {
"tool": "mcp-publisher",
"pilot": true,
"pilot_notes": "Free pilot: 20 tasks/service/day, 10 tasks/identity/day. Quota state on ephemeral disk; service sleeps after ~15 min idle. Every deliverable Ed25519-signed; verify offline with the public key in catalog.json."
}
},
"title": "Shoon A2A Trust Services (pilot)",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
"remotes": [
{
"url": "https://shoon-a2a-sandbox.onrender.com/mcp",
"type": "streamable-http",
"headers": [
{
"name": "X-API-KEY",
"isSecret": true,
"description": "Pilot API key for the human-style flow (header). Omit when using the X-PAYMENT machine flow: quote first via POST /quote, then authorize the quote on POST /execute."
}
]
}
],
"version": "0.1.0",
"repository": {
"id": "1364990825",
"url": "https://github.com/ShoonEnterprises/shoonenterprises.github.io",
"source": "github",
"subfolder": "api"
},
"websiteUrl": "https://shoonenterprises.github.io/",
"description": "Five trust services for agents: claim checks, citation audits, extraction, tripwires, work audits."
}