agent-cronjob
REMOTE · CRONJOB.AGENTASY.AI
Scheduled, HMAC-signed, retried webhook triggers for AI agents. No account: self-register via tools.
Available components
Last scanned (13 hours ago)
Scores higher than 10% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Workflow Automation
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security60
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not yet verified: we couldn't confirm whether this endpoint requires it. View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability0
- Transport check failed: declared streamable-http, but the endpoint returned HTTP 502. See how to fix → View diagnostics → Fail
Schema Quality & AI Usability0
- Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.Unverified
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
- Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Tool Safety0
- Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Capabilities0
- Capabilities not yet verified: we couldn't read the endpoint's capabilities.Unverified
Unverified: 5 categories
Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 −41
- Endpoint reachability: reachable → not serving MCP ▼ security
- Authorization: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Transport: pass → fail ▼ security
- Schema quality: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- 4 Nov 26 65
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://cronjob.agentasy.ai/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=agentasy.ai | CN=WE1,O=Google Trust Services,C=US | 5 Oct 2026 | 3 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | 58137addeea2dbb81325ca69447e7115 |
| SANs: agentasy.ai, *.agentasy.ai | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of cronjob.agentasy.ai. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 1814, 3799 | 8, 8 | Verified |
| agentasy.ai. | present | 2371 | 13 | Verified |
| cronjob.agentasy.ai. | Verified address RRset verified with the apex keys |
Authentication Inconclusive
We could not reach the endpoint well enough to judge its authorisation posture.
| Result | Inconclusive |
|---|---|
| HTTP status | 502 |
| Header | Value |
|---|---|
| x-frame-options | SAMEORIGIN |
| referrer-policy | same-origin |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://cronjob.agentasy.ai/mcp | HTTP error | 502 | |
| http (plaintext) | http://cronjob.agentasy.ai/mcp | HTTPS enforced | 301 | https://cronjob.agentasy.ai/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
claim_credentials Poll verification / collect credentials ~128
Step 3. Poll verification state with the setup_token. The first call after the webhook is verified returns hmac_secret (signs triggers) and management_token (manages the job) — SHOWN ONCE, store them now; later calls say credentials: "already_issued". (REST: GET /v1/jobs/{id}/verification)
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | job_<ULID> returned by create_job |
| setup_token | string | – | act_st_… setup token from create_job. Optional if the MCP HTTP request carries Authorization: Bearer <setup_token>. |
No output schema declared.
No examples provided.
create_job Create a job (start registration) ~397
Step 1. Register your webhook and schedule (no account, no API key). Returns job_id and a one-time setup_token, and POSTs a url_verification challenge to webhook_url. Your webhook must answer it (echo: reply 2xx {"challenge":"<same>"}) — then call claim_credentials. Or reply 2xx and call verify_challenge with the value (callback). Nothing triggers before verification. (REST: POST /v1/jobs)
| Name | Type | Req | Description |
|---|---|---|---|
| catchup_policy | string | – | – |
| catchup_window_sec | integer | – | – |
| max_runs | – | – | Complete after this many dispatched runs; null = unlimited. |
| name | string|null | – | – |
| outgoing_auth | – | – | Optional header your webhook requires (e.g. a Grok routine webhook that needs Authorization). Sent on the url_verification POST and every trigger; never overrides the X-Cronjob-* headers. |
| payload | object | – | Sent unchanged in every trigger (≤ 8 KB). |
| retry_base_sec | integer | – | – |
| retry_max_attempts | integer | – | – |
| retry_max_backoff_sec | integer | – | – |
| schedule | object | yes | Exactly one of {cron, timezone?}, {interval_sec}, {run_at}. Minimum spacing 60 s. |
| signature_in_body | boolean | – | Default false. true = every trigger body also carries cronjob_signature {version, timestamp, delivery_id, signatures[], signature} (HMAC over "v1b:{timestamp}:{delivery_id}:" + canonical JSON of the… |
| timeout_ms | integer | – | – |
| verification_mode | string | – | Informational; both answers work. Default echo. |
| webhook_url | string | yes | Public https URL of your agent. It receives the challenge now and the signed triggers later. |
No output schema declared.
No examples provided.
delete_job Delete a job ~79
Stop the job forever and revoke all its credentials. Cannot be undone. (REST: DELETE /v1/jobs/{id})
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | job_<ULID> returned by create_job |
| management_token | string | – | act_mt_… management token. Optional if the MCP HTTP request carries Authorization: Bearer <management_token>. |
No output schema declared.
No examples provided.
get_deliveries Run history ~148
Trigger log, newest first: scheduled_at, first attempt time, delay, attempts, status and last response code of each run. since/until (ISO 8601) filter scheduled_at; page with next_cursor. (REST: GET /v1/jobs/{id}/runs)
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | – |
| job_id | string | yes | job_<ULID> returned by create_job |
| limit | integer | – | – |
| management_token | string | – | act_mt_… management token. Optional if the MCP HTTP request carries Authorization: Bearer <management_token>. |
| since | string | – | – |
| status | string | – | – |
| until | string | – | – |
No output schema declared.
No examples provided.
get_job Get a job ~87
Settings, status, next_run_at, run_count and credential prefixes of one job (webhook path masked). (REST: GET /v1/jobs/{id})
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | job_<ULID> returned by create_job |
| management_token | string | – | act_mt_… management token. Optional if the MCP HTTP request carries Authorization: Bearer <management_token>. |
No output schema declared.
No examples provided.
get_run One run with every delivery attempt ~98
One run and each delivery attempt: sent_at, response status, duration, error and next retry. (REST: GET /v1/jobs/{id}/runs/{run_id})
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | job_<ULID> returned by create_job |
| management_token | string | – | act_mt_… management token. Optional if the MCP HTTP request carries Authorization: Bearer <management_token>. |
| run_id | string | yes | – |
No output schema declared.
No examples provided.
get_stats Punctuality stats ~98
On-time rate, p50/p95 first-attempt delay and success rate over a window (default 24h). (REST: GET /v1/jobs/{id}/stats)
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | job_<ULID> returned by create_job |
| management_token | string | – | act_mt_… management token. Optional if the MCP HTTP request carries Authorization: Bearer <management_token>. |
| window | string | – | – |
No output schema declared.
No examples provided.
list_jobs List your jobs ~74
Status of every job you hold a management token for. There are no accounts, so pass each {job_id, management_token} pair (up to 20); a pair without management_token uses the Authorization header. (REST: GET /v1/jobs/{id} (once per job))
| Name | Type | Req | Description |
|---|---|---|---|
| jobs | array | yes | – |
No output schema declared.
No examples provided.
pause_job Pause a job ~84
Stop triggering (idempotent). Schedule points while paused are not made up later. (REST: POST /v1/jobs/{id}/pause)
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | job_<ULID> returned by create_job |
| management_token | string | – | act_mt_… management token. Optional if the MCP HTTP request carries Authorization: Bearer <management_token>. |
No output schema declared.
No examples provided.
resume_job Resume a job ~84
Resume a paused or disabled job from its next schedule point; resets consecutive_failures. (REST: POST /v1/jobs/{id}/resume)
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | job_<ULID> returned by create_job |
| management_token | string | – | act_mt_… management token. Optional if the MCP HTTP request carries Authorization: Bearer <management_token>. |
No output schema declared.
No examples provided.
retry_challenge Re-send the challenge ~111
Re-send a fresh url_verification challenge to your webhook (at most 5 re-sends (6 challenges in total), at least 60 s apart). The previous challenge stops working. (REST: POST /v1/jobs/{id}/verification/retry)
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | job_<ULID> returned by create_job |
| setup_token | string | – | act_st_… setup token from create_job. Optional if the MCP HTTP request carries Authorization: Bearer <setup_token>. |
No output schema declared.
No examples provided.
rotate_secret Rotate the HMAC signing secret ~116
New hmac_secret (SHOWN ONCE, store it now). Until previous.expires_at (grace_sec, default 24 h) triggers carry two v1= signatures, new first. (REST: POST /v1/jobs/{id}/rotate-secret)
| Name | Type | Req | Description |
|---|---|---|---|
| grace_sec | integer | – | – |
| job_id | string | yes | job_<ULID> returned by create_job |
| management_token | string | – | act_mt_… management token. Optional if the MCP HTTP request carries Authorization: Bearer <management_token>. |
No output schema declared.
No examples provided.
rotate_token Rotate the management token ~104
New management_token (SHOWN ONCE, store it now). The old one stops working after grace_sec (default 0 = immediately). (REST: POST /v1/jobs/{id}/rotate-token)
| Name | Type | Req | Description |
|---|---|---|---|
| grace_sec | integer | – | – |
| job_id | string | yes | job_<ULID> returned by create_job |
| management_token | string | – | act_mt_… management token. Optional if the MCP HTTP request carries Authorization: Bearer <management_token>. |
No output schema declared.
No examples provided.
update_job Change job settings ~196
Change a job in place. Currently only signature_in_body (true = triggers also carry cronjob_signature in the JSON body, for platforms that drop the X-Cronjob-* headers). Applies from the next attempt sent; returns the updated job. (REST: PATCH /v1/jobs/{id})
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | job_<ULID> returned by create_job |
| management_token | string | – | act_mt_… management token. Optional if the MCP HTTP request carries Authorization: Bearer <management_token>. |
| signature_in_body | boolean | – | Default false. true = every trigger body also carries cronjob_signature {version, timestamp, delivery_id, signatures[], signature} (HMAC over "v1b:{timestamp}:{delivery_id}:" + canonical JSON of the… |
No output schema declared.
No examples provided.
verify_challenge Verify the challenge (callback mode) ~92
Step 2 (callback mode). Send back the challenge value your webhook received. On success the result holds hmac_secret and management_token — SHOWN ONCE, store them now. (REST: POST /v1/jobs/{id}/verify)
| Name | Type | Req | Description |
|---|---|---|---|
| challenge | string | yes | The challenge value from the url_verification POST |
| job_id | string | yes | job_<ULID> returned by create_job |
No output schema declared.
No examples provided.
How do I install the agent-cronjob MCP server?
agent-cronjob is a hosted endpoint at https://cronjob.agentasy.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · cronjob.agentasy.ai
claude mcp add --transport http ai-agentasy-cronjob 'https://cronjob.agentasy.ai/mcp'
What is the agent-cronjob MCP server?
agent-cronjob is an MCP server listed in the public MCP registry as ai.agentasy/cronjob. Scheduled, HMAC-signed, retried webhook triggers for AI agents. No account: self-register via tools. This page covers its hosted endpoint (https://cronjob.agentasy.ai/mcp).
Is the agent-cronjob MCP server safe to use?
agent-cronjob scores 24 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the agent-cronjob MCP server expose?
agent-cronjob exposes 15 tools: create_job, verify_challenge, claim_credentials, retry_challenge, list_jobs, and 10 more. Their descriptions and schemas cost roughly 1,896 tokens of context every time the server is loaded.
Does the agent-cronjob MCP server require authentication?
Its publisher declares no required credentials for agent-cronjob. We have not been able to confirm that against the live endpoint, and a server can require authorisation without declaring it here.
Is the agent-cronjob MCP server still maintained?
agent-cronjob is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.