# HODLXXI Read-Only

> Public read-only MCP server for HODLXXI agent identity, trust, receipts, and verification.

- name: io.github.hodlxxi/hodlxxi-readonly
- version: 0.1.1
- connection class: R0 (autonomous)
- trust: 90/100
- quality: 79/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.hodlxxi%2Fhodlxxi-readonly
- tools: https://api.protogrid.dev/v1/servers/io.github.hodlxxi%2Fhodlxxi-readonly/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "hodlxxi-readonly": {
      "type": "http",
      "url": "https://hodlxxi.com/agent/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 65
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-100% ~updated-99d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 79/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: hodlxxi_get_oauth_protected_resource (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); hodlxxi_get_jwks (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); hodlxxi_get_capabilities (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 1,551 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 26, about 1,551 tokens to load them all
- tool set hash: 92e1280f610881d52b6c5b696ea3bd56
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.hodlxxi/hodlxxi-readonly.svg)](https://protogrid.dev/servers/io.github.hodlxxi/hodlxxi-readonly)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://hodlxxi.com/agent/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (26)

- `hodlxxi_get_agent_discovery`: Return the signed Agent Protocol discovery document with public endpoint links, trust surfaces, timestamp, and agent signature.
- `hodlxxi_get_agent_identity`: Return the canonical public agent identity document, including capabilities, pricing, endpoints, skills, messaging metadata, and trust-model declarations.
- `hodlxxi_get_agent_skills_index`: Return the Agent Skills discovery index with skill names, descriptions, URLs, types, and SHA-256 digests.
- `hodlxxi_get_api_catalog`: Return the public RFC-style API linkset catalog with service descriptions, documentation links, and status links.
- `hodlxxi_get_attestations`: Return paginated signed receipt attestations. limit must be 1-100 and offset must be non-negative.
- `hodlxxi_get_capabilities`: Return the signed capabilities document with job schemas, pricing, limits, endpoint registry, public skills, and messaging metadata.
- `hodlxxi_get_capabilities_schema`: Return the JSON Schema published for the signed HODLXXI capabilities document.
- `hodlxxi_get_chain_health`: Return attestation-chain continuity status, event count, latest event hashes, and latest timestamp when available.
- `hodlxxi_get_covenant`: Return a declared covenant artifact by validated covenant identifier, including descriptor, policy, funding status, public keys, and non-claims.
- `hodlxxi_get_covenant_countdown`: Return the machine-readable covenant countdown with chain height, spend paths, estimated unlocks, funding status, and conservative trust interpretation.
- `hodlxxi_get_jwks`: Return the public RSA JSON Web Key Set used to verify HODLXXI-issued JWT signatures. No private JWK fields are exposed.
- `hodlxxi_get_marketplace_listing`: Return the normalized marketplace listing with discovery links, job types, pricing, skills, reputation snapshot, chain health, and trust model.
- `hodlxxi_get_mcp_server_card`: Return the live MCP discovery server card for https://hodlxxi.com/agent/mcp, which nginx routes to the separate read-only sidecar rather than the Flask monolith.
- `hodlxxi_get_nostr_announcement`: Return the signed Nostr announcement template, advertised NIP-89/NIP-90 kinds, discovery links, and explicit non-goals.
- `hodlxxi_get_nostr_dm_policy`: Return public NIP-17/NIP-59 messaging policy metadata, including intake status, custody limitations, accepted kind, and size ceiling.
- `hodlxxi_get_oauth_authorization_server`: Return OAuth authorization-server metadata, including the HODLXXI agent_auth discovery block and disabled registration endpoint references.
- `hodlxxi_get_oauth_protected_resource`: Return OAuth protected-resource metadata, including resource issuer, authorization servers, JWKS URI, scopes, and bearer method.
- `hodlxxi_get_openid_configuration`: Return OpenID Connect discovery metadata: issuer, authorization and token endpoints, JWKS URI, grants, scopes, PKCE, and signing algorithms.
- `hodlxxi_get_operator_continuity`: Return the public operator-continuity statement, operator and agent public keys, covenant status, rotation policy, and verification references.
- `hodlxxi_get_receipt`: Return a previously issued signed receipt by job identifier. Optional requester-proof fields depend on the historical receipt.
- `hodlxxi_get_report`: Return a public machine-readable trust or readiness report by validated report identifier, including its canonical SHA-256 field when present.
- `hodlxxi_get_reputation`: Return aggregate public operating history, evidenced job counts, attestation count, trust and confidence averages, pattern distribution, and rolling trust trend.
- `hodlxxi_get_skills`: Return the checked-in public skill catalog with metadata, repository paths, and installation URLs.
- `hodlxxi_get_trust_events`: Return the paginated public trust-event chain with hashes, receipt linkage, timestamps, public key, and signatures.
- `hodlxxi_get_trust_summary`: Return the compact trust summary for a validated public agent identifier.
- `hodlxxi_verify_receipt`: Verify a previously issued receipt by job identifier and return verification status, validity, attestation, signed receipt, event hash, and QR pointer non-claims. This does not poll /agent/jobs and cannot mint a receipt.