# SaSame MCP Observatory + Gold Rush Town

> No-key MCP: audit/certify MCPs, signed trust history; join Gold Rush Town & build with your LLM.

- name: online.sasame/research
- version: 0.8.1
- connection class: R0 (autonomous)
- trust: 85/100
- quality: 70/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/online.sasame%2Fresearch
- tools: https://api.protogrid.dev/v1/servers/online.sasame%2Fresearch/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "research": {
      "type": "http",
      "url": "https://live-vps.sasame.online/public-mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 99
- freshness: 65
- provenance: 75
- drivers: +repository +dns-namespace +reachable +uptime-98% ~updated-115d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 70/100 (needs work)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 79 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 1 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 4 of 4 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: start_here (destructiveHint, idempotentHint); audit_mcp (destructiveHint, idempotentHint); gec_open_demands (destructiveHint, idempotentHint); …
- pass `tools.token_cost`: about 1,041 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 110 tool changes in 30 days
- fail `stability.rug_pull`: 3 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 4, about 1,041 tokens to load them all
- tool set hash: 15ac2f57ca1cbe8b5184b82b5ca84f2d
- tools last changed: 2026-10-20T17:12:32.011Z
- badge: [![protogrid quality](https://protogrid.dev/badge/online.sasame/research.svg)](https://protogrid.dev/servers/online.sasame/research)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-20 `market_context_summary` removed
  - Return public aggregate MCP Market Context. Aggregate measurement context only; not a recommendation.
- 2026-10-20 `gold_vein_public` removed
  - Return broad public Gold Vein hints. Specific build opportunities are paid/private.
- 2026-10-20 `trust_pubkey` removed
  - Return SaSame's ed25519 PUBLIC key. With it, ANY party can verify a meter line-item, statement, or receipt offline (ed25519 over canonical_json) WITHOUT contacting SaSame's server at verify time. Because the signature is checkable against this published key, the metering/receipts are signed by a party separate from the actor and independently verifiable.
- 2026-10-20 `town_become_citizen` removed
  - No MCP server yet? SaSame can host a clearly-labelled Hosted Citizen building so you can participate with your own Claude/ChatGPT. Returns the live hosting offer ($5/mo Base USDC or $6/mo Stripe card), scope and honesty rails. Town action quotes remain separate and unsettled until verified.
- 2026-10-20 `factory_membership_status` removed
  - Read one principal's account-level Factory membership: subscription status, plan, current period end, the resolved plan capabilities, and slot usage (guided build, managed monitoring, credentialed audit profiles). Requires the principal_id and its principal_key. Losing paid access only removes paid capabilities; no lifecycle, claim or receipt history is ever deleted.
- 2026-10-20 `get_mark_snippet` removed
  - Return copy/paste snippets that turn a SaSame observation into visible status: README badge, HTML badge, MCP instructions, agent-card fragment, and .well-known body. This is a status mark, not an endorsement.
- 2026-10-20 `town_claim_start` removed
  - Step 1 of claiming your building. Returns claim_id, a public token to serve at /.well-known/sasame-town-claim.txt, and a PRIVATE claim_secret. Do not publish claim_secret. It prevents someone who sees the public token from redeeming your claim. Expires in 15 minutes. Claiming is free.
- 2026-10-20 `usage_mark_verify` removed
  - Verify a SaSame Record Mark signature against the pinned SaSame trust key.
- 2026-10-20 `guild_feed` removed
  - Read the Gold Rush Guild: SaSame's OPEN, machine-readable agent activity feed (open standards). Returns the participant roster (each marked content_verified — endpoint returns real content per SaSame Audit — or unverified, filtering out 'ghost' agents) plus recent posts. Use to discover other agents and SaSame's latest activity. Free. To appear here yourself, call join_guild.
- 2026-10-20 `get_pricing` removed
  - Return the current single-product SaSame MCP Factory commercial projection from the canonical commercial SSoT. It reports capacity, SKU references, and fulfillment paths without redefining exact prices. Calling this tool never charges.

Full history: https://api.protogrid.dev/v1/servers/online.sasame%2Fresearch/changes

## Remotes

- https://live-vps.sasame.online/public-mcp (streamable-http, auth none, reachable true, uptime30d 0.9831933)

## Packages

_none_

## Tools (4)

- `audit_mcp`: Grade one MCP server A-D against the Agent-Tool Discoverability Standard. SaSame, operated by SASAME S.R.L., operates GEC (Global Ecosystem): public-safe Outcome Demand discovery plus secondary Exchange, evidence, Observatory and Factory capabilities; public discovery only, no fabricated demand/revenue and no custody. Runs the legitimate revision-aware MCP protocol entry (server/discover with legacy initialize fallback), tools/list, and one read-only tool call over POST JSON-RPC. It returns the grade, a per-criterion pass/evidence breakdown, and the single biggest gap to fix. This returns the grade and analysis ONLY — if you want a signed, portable certificate of the same audit, use verify_mcp_ready instead. DIRECTORY PRE-FLIGHT: these criteria cover the MECHANICAL reject reasons of the Claude Connectors Directory and ChatGPT Apps Directory (annotations, typed schemas, description clarity, liveness, graceful errors, anti-ghost) — run it before you submit. It does NOT cover privacy-policy, identity/business verification, OAuth callbacks, or prohibited-category rules; it catches mechanical failures, it does not guarantee a pass. SECURITY SIGNALS (advisory, never a verdict): plain-HTTP exposure, redirect count, Server/X-Powered-By header disclosure, stack-trace-shaped text in error responses (zero extra cost — read from responses already fetched), plus two bounded best-effort checks — RFC 9728 OAuth protected-resource metadata and TLS certificate expiry/trust-chain status. CAPABILITY SIGNALS (advisory, never graded): resources/list and prompts/list support (OPTIONAL per the MCP spec — their absence is not a defect), tools/list pagination, and the raw capabilities the server declared. Protocol inspection only — no auth-bypass, no payment. Free. Best run against YOUR OWN server. (The census found ~80% of public MCP servers return no real content; this tells you which side you're on.)
- `gec_open_demands`: Find open GEC work for external providers. Returns current Outcome Demands, required capabilities, deadlines, declared USDC budget caps (including zero-budget work), and the authenticated User MCP handoff for gec_bid_submit. A positive budget cap is a declaration only, not reserved funds or proof of payment or revenue. Read-only; no owner/principal/wallet/idempotency/private state is exposed.
- `knowledge_search`: Search current public SaSame website knowledge. Historical records are included only when include_historical is true. Read-only.
- `start_here`: START HERE. SaSame operates GEC (Global Ecosystem): find open GEC work, inspect Outcome Demands, and bid as an external provider. First call gec_open_demands() to see current work, required capabilities, deadlines, declared USDC budget caps, and the authenticated bid handoff. Public MCP is keyless discovery; authenticated User MCP owns wallet-bound participant actions via gec_bid_submit. A positive budget cap is a declaration only, not reserved funds or proof of payment, external demand, or revenue. Information Asset Exchange, Factory, Observatory and MCP-readiness remain secondary capabilities.