# io.github.philpof102-svg/xsignal

> x402 pay-per-call data tools for Base agents. Flagship get_intent ABSTAINS instead of guessing.

- name: io.github.philpof102-svg/xsignal
- version: 0.2.1
- connection class: R0 (autonomous)
- trust: 87/100
- quality: 74/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.philpof102-svg%2Fxsignal
- tools: https://api.protogrid.dev/v1/servers/io.github.philpof102-svg%2Fxsignal/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "xsignal": {
      "type": "http",
      "url": "https://xsignal-production.up.railway.app/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 65
- provenance: 80
- drivers: +repository +namespace-matches-repo +reachable +uptime-100% ~updated-111d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 74/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2024-11-05; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: get_signal (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_intent (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_token_intel (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 997 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 50 (weight 15)

- fail `deps.known_vulns`: 2 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-8r9p-f939-6h3c in follow-redirects@1.16.0 (indirect, fixed in 1.16.1), GHSA-q3jh-wrc6-jgq8 in follow-redirects@1.16.0 (indirect, fixed in 1.16.1)
- n/a `deps.mcp_sdk_version`: the official MCP SDK is not in the dependency graph
- pass `deps.resolvable`: @rakshasar/xsignal@0.2.1 resolved: 105 packages

- tools: 6, about 997 tokens to load them all
- tool set hash: 66050d0e1caa77844f97f49b4e5212d7
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.philpof102-svg/xsignal.svg)](https://protogrid.dev/servers/io.github.philpof102-svg/xsignal)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm @rakshasar/xsignal@0.2.1: resolved, 104 dependencies
  - GHSA-8r9p-f939-6h3c (high) in `` follow-redirects@1.16.0 ``, indirect, fixed in `` 1.16.1 ``, advisory summary: "follow-redirects sensitiveHeaders regex escaping can expose credential headers" https://osv.dev/vulnerability/GHSA-8r9p-f939-6h3c
  - GHSA-q3jh-wrc6-jgq8 (high) in `` follow-redirects@1.16.0 ``, indirect, fixed in `` 1.16.1 ``, advisory summary: "follow-redirects array-form headers bypass cross-origin credential stripping" https://osv.dev/vulnerability/GHSA-q3jh-wrc6-jgq8

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://xsignal-production.up.railway.app/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

- npm @rakshasar/xsignal@0.2.1

## Tools (6)

- `get_intent`: FLAGSHIP. An outcome-priced momentum verdict that ABSTAINS below your confidence bar - the only x402 signal that refuses to answer (honestly) when it is not sure. Post {addr, min_confidence 0-1} then pay $0.01, and get a mechanical momentum verdict "gaining" or "fading" IF the signal agreement clears your bar, else a calibrated "abstain". Paid answers carry a keyless tamper-evidence receipt. confidence is a transparent heuristic, NOT a prediction; not financial advice. x402-paid at GET/POST /intent (3 free calls per wallet via ?wallet=0x…). Example: GET /intent?addr=0x4ed4E862860beD51a9570b96d89aF5E1B0Efefed&min_confidence=0.7
- `get_preflight`: The Base PREFLIGHT: one call fuses MainStreet on-chain SAFETY (SAFE/WATCH/AVOID + rug flags) with xsignal MOMENTUM (the abstaining read) into a single recommendation (GO / CAUTION / AVOID / AVOID_ENTRY / NEUTRAL / UNVERIFIED) answering "is this token safe to touch AND moving?". Safety GATES momentum - never green-lights a token that can rug. x402-paid at GET/POST /preflight ($0.05; 3 free per wallet via ?wallet=0x…). Input: addr (0x Base token). Not financial advice.
- `get_screen`: BATCH watchlist screen: run the preflight (safety ⊕ momentum) over up to 10 Base tokens in one call → which are GO (safe + moving), plus a per-token verdict + a summary count. For an agent screening a watchlist. x402-paid at GET/POST /screen ($0.10; 3 free per wallet via ?wallet=0x…). Input: addrs (array or comma-separated 0x addresses). Not financial advice.
- `get_signal`: Real-time X/social signal for a topic: scored (virality + freshness) and CITED (source urls), deduped and ranked. Input: query (topic) OR candidates[] (bring your own posts to score). x402-paid at GET/POST /signal ($0.01; 3 free per wallet via ?wallet=0x…). Example: GET /signal?q=base+memecoin
- `get_token_brief`: A fused MEAL: one call combines Base token market intel + real-time social signal into a single "what is happening with $TOKEN right now" brief - market flags + top CITED social posts + a plain-language, non-advisory summary. Saves an agent the fetch-and-fuse work. x402-paid at GET/POST /brief ($0.05; 3 free per wallet via ?wallet=0x…). Example: GET /brief?addr=0x4ed4…&q=degen
- `get_token_intel`: Base token MARKET data (liquidity, 24h volume, price + change, pool age, buy/sell flow, mechanical flags) from public DEX pools. Market data, NOT a trust/safety rating. Best used as an input to get_token_brief. x402-paid at GET/POST /token ($0.01; 3 free per wallet via ?wallet=0x…).