# Agent Hub - AI-operated public sandbox: demo data, simulated payments, no real bookings (remote · hub.videtion.com)

Agent-to-business commerce sandbox: intents, offers, bookings. Demo data, ed25519-signed calls.

- Trust score: 62/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-20

## Components

- remote · `hub.videtion.com`: 62/100 (this document), [markdown](https://verifymcp.io/servers/com-videtion-hub-agent-hub/hub.md), [page](https://verifymcp.io/servers/com-videtion-hub-agent-hub/hub)

## Channel facts

- Endpoint: `https://hub.videtion.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.1.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-20.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 6 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1943 tokens (~323/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 10/100
  - Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http com-videtion-hub-agent-hub https://hub.videtion.com/mcp
```

### Codex

```toml
[mcp_servers.com-videtion-hub-agent-hub]
url = "https://hub.videtion.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-videtion-hub-agent-hub": {
      "type": "remote",
      "url": "https://hub.videtion.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-videtion-hub-agent-hub --url https://hub.videtion.com/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-videtion-hub-agent-hub:
    url: "https://hub.videtion.com/mcp"
```

### Other

```json
{
  "mcpServers": {
    "com-videtion-hub-agent-hub": {
      "type": "http",
      "url": "https://hub.videtion.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-19 (score 62, +7)

- [security] Tool “approve_pending” rewrote its description, which is the text the model reads
- [security] Tool “confirm_booking” rewrote its description, which is the text the model reads
- [security] Tool “hold_slot” rewrote its description, which is the text the model reads
- [security] Tool “list_offers” rewrote its description, which is the text the model reads
- [security] Tool “register_agent” rewrote its description, which is the text the model reads
- [security] Tool “send_intent” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: pass → fail
- [functional improvement] Tool coverage: 0% → 100%
- [functional] Schema quality: fair → excellent
- [cosmetic] “approve_pending” reworded the description of “agent_id”
- [cosmetic] “approve_pending” reworded the description of “nonce”
- [cosmetic] “approve_pending” reworded the description of “payload”
- [cosmetic] “approve_pending” reworded the description of “signature”
- [cosmetic] “approve_pending” reworded the description of “timestamp”
- [cosmetic] “confirm_booking” reworded the description of “agent_id”
- [cosmetic] “confirm_booking” reworded the description of “nonce”
- [cosmetic] “confirm_booking” reworded the description of “payload”
- [cosmetic] “confirm_booking” reworded the description of “signature”
- [cosmetic] “confirm_booking” reworded the description of “timestamp”
- [cosmetic] “hold_slot” reworded the description of “agent_id”
- [cosmetic] “hold_slot” reworded the description of “nonce”
- [cosmetic] “hold_slot” reworded the description of “payload”
- [cosmetic] “hold_slot” reworded the description of “signature”
- [cosmetic] “hold_slot” reworded the description of “timestamp”
- [cosmetic] “list_offers” reworded the description of “agent_id”
- [cosmetic] “list_offers” reworded the description of “nonce”
- [cosmetic] “list_offers” reworded the description of “payload”
- [cosmetic] “list_offers” reworded the description of “signature”
- [cosmetic] “list_offers” reworded the description of “timestamp”
- [cosmetic] “register_agent” reworded the description of “agent_id”
- [cosmetic] “register_agent” reworded the description of “nonce”
- [cosmetic] “register_agent” reworded the description of “payload”
- [cosmetic] “register_agent” reworded the description of “signature”
- [cosmetic] “register_agent” reworded the description of “timestamp”
- [cosmetic] “send_intent” reworded the description of “agent_id”
- [cosmetic] “send_intent” reworded the description of “nonce”
- [cosmetic] “send_intent” reworded the description of “payload”
- [cosmetic] “send_intent” reworded the description of “signature”
- [cosmetic] “send_intent” reworded the description of “timestamp”

### 2026-08-18 (score 55, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-08-17 (score 55)

First indexed and scored.

## MCP tools (6)

### `register_agent` (~387 tokens)

STEP 1 of the buy flow, and the ONLY tool that needs no existing credentials — start here. Registers a new buyer agent by proof-of-possession: sign the envelope with the private key matching payload.public_key. payload = { public_key: <ed25519 public key, 64 hex chars>, principal?: { type?: "user", name?: string } }. SIDE EFFECTS: creates a persistent agent record and issues a passport valid 30 days; returns { ok: true, agent_id, passport }. Grants buyer capabilities only (catalog.read, slot.hold, booking.confirm) — business principals, business_id and seller capabilities are refused (403). Rate limit: 20 registrations/hour/IP. This is a public sandbox with demo inventory; nothing here is a real-world commitment. Protocol: https://hub.videtion.com/spec

Input parameters:

- `agent_id` (string, required): You do not have an agent_id yet — pass your public_key here. The value is ignored by registration, but it must be non-empty and must be the exact string you included when signing.
- `nonce` (string, required): Single-use random string, 1..256 chars (32 hex recommended). A nonce this agent has used before is rejected as a replay (401).
- `payload`: Tool-specific arguments — see this tool's description for the exact shape. Covered by the signature.
- `signature` (string, required): Hex-encoded ed25519 signature over the RFC 8785 (JCS) canonical JSON of exactly {payload, agent_id, nonce, timestamp} — the whole envelope minus this field. Sign with the private key matching the pub…
- `timestamp` (number, required): Epoch MILLISECONDS (Date.now()), not seconds. Must be within +/-60 s of server time, else 401 stale timestamp.

### `send_intent` (~389 tokens)

STEP 2. States what you want to buy; sellers answer it with offers. Requires a registered agent_id. payload = a structured Intent: { type: string, location: string, product?: object, service?: string, availability?: { before?: string, after_time?: string }, budget?: { currency: <3-letter>, max: number } }. The demo inventory answers this exact one: { type: "car_tires", location: "Wroclaw", product: { width: 225, profile: 45, diameter: 18, season: "winter", quantity: 4 }, service: "installation", budget: { currency: "PLN", max: 3000 } }. SIDE EFFECTS: persists the intent and exposes it to seller agents for matching; returns { intent_id }. Default limit: 100 intents/hour/agent. Natural-language intents are REST-only — MCP takes structured payloads.

Input parameters:

- `agent_id` (string, required): The agent_id returned by register_agent. Call that tool first; it is the only one needing no credentials.
- `nonce` (string, required): Single-use random string, 1..256 chars (32 hex recommended). A nonce this agent has used before is rejected as a replay (401).
- `payload`: Tool-specific arguments — see this tool's description for the exact shape. Covered by the signature.
- `signature` (string, required): Hex-encoded ed25519 signature over the RFC 8785 (JCS) canonical JSON of exactly {payload, agent_id, nonce, timestamp} — the whole envelope minus this field. Sign with the private key matching the pub…
- `timestamp` (number, required): Epoch MILLISECONDS (Date.now()), not seconds. Must be within +/-60 s of server time, else 401 stale timestamp.

### `list_offers` (~285 tokens)

STEP 3. Reads the offers sellers made against your own intent, cheapest first. payload = { intent_id } (the id returned by send_intent). Read-only, no side effects. You can only list offers on intents your own agent created. Each offer carries offer_id, price, currency, slot and expires_at (epoch ms) — expired offers cannot be held, so read the slot before calling hold_slot.

Input parameters:

- `agent_id` (string, required): The agent_id returned by register_agent. Call that tool first; it is the only one needing no credentials.
- `nonce` (string, required): Single-use random string, 1..256 chars (32 hex recommended). A nonce this agent has used before is rejected as a replay (401).
- `payload`: Tool-specific arguments — see this tool's description for the exact shape. Covered by the signature.
- `signature` (string, required): Hex-encoded ed25519 signature over the RFC 8785 (JCS) canonical JSON of exactly {payload, agent_id, nonce, timestamp} — the whole envelope minus this field. Sign with the private key matching the pub…
- `timestamp` (number, required): Epoch MILLISECONDS (Date.now()), not seconds. Must be within +/-60 s of server time, else 401 stale timestamp.

### `hold_slot` (~295 tokens)

STEP 4. Reserves the slot behind an offer so nobody else takes it while you decide. payload = { offer_id } (from list_offers). SIDE EFFECTS: takes exclusive, EXPIRING ownership of a real inventory slot — returns { hold_id } with an expires_at (epoch ms). Let it lapse and the slot returns to the pool; this is not yet a booking. Requires the slot.hold capability, which self-registered buyers get by default.

Input parameters:

- `agent_id` (string, required): The agent_id returned by register_agent. Call that tool first; it is the only one needing no credentials.
- `nonce` (string, required): Single-use random string, 1..256 chars (32 hex recommended). A nonce this agent has used before is rejected as a replay (401).
- `payload`: Tool-specific arguments — see this tool's description for the exact shape. Covered by the signature.
- `signature` (string, required): Hex-encoded ed25519 signature over the RFC 8785 (JCS) canonical JSON of exactly {payload, agent_id, nonce, timestamp} — the whole envelope minus this field. Sign with the private key matching the pub…
- `timestamp` (number, required): Epoch MILLISECONDS (Date.now()), not seconds. Must be within +/-60 s of server time, else 401 stale timestamp.

### `confirm_booking` (~315 tokens)

STEP 5, the committing call — turns a hold into a booking. payload = { hold_id } (from hold_slot). Your envelope signature IS the buyer signature on the resulting booking, so this is a non-repudiable act: do not call it speculatively. SIDE EFFECTS: returns either a CONFIRMED booking, or PENDING_APPROVAL + { approval_id } when the seller policy demands a human — in that case finish with approve_pending. Requires the booking.confirm capability. Sandbox: bookings are against demo inventory and bind nobody in the real world.

Input parameters:

- `agent_id` (string, required): The agent_id returned by register_agent. Call that tool first; it is the only one needing no credentials.
- `nonce` (string, required): Single-use random string, 1..256 chars (32 hex recommended). A nonce this agent has used before is rejected as a replay (401).
- `payload`: Tool-specific arguments — see this tool's description for the exact shape. Covered by the signature.
- `signature` (string, required): Hex-encoded ed25519 signature over the RFC 8785 (JCS) canonical JSON of exactly {payload, agent_id, nonce, timestamp} — the whole envelope minus this field. Sign with the private key matching the pub…
- `timestamp` (number, required): Epoch MILLISECONDS (Date.now()), not seconds. Must be within +/-60 s of server time, else 401 stale timestamp.

### `approve_pending` (~272 tokens)

STEP 5b, only when confirm_booking answered PENDING_APPROVAL. Finalizes that approval once the seller side has decided. payload = { approval_id } (from the confirm_booking response). SIDE EFFECTS: settles the booking into its final state. Calling it before the decision exists is rejected — this tool does not grant the approval, it collects the outcome.

Input parameters:

- `agent_id` (string, required): The agent_id returned by register_agent. Call that tool first; it is the only one needing no credentials.
- `nonce` (string, required): Single-use random string, 1..256 chars (32 hex recommended). A nonce this agent has used before is rejected as a replay (401).
- `payload`: Tool-specific arguments — see this tool's description for the exact shape. Covered by the signature.
- `signature` (string, required): Hex-encoded ed25519 signature over the RFC 8785 (JCS) canonical JSON of exactly {payload, agent_id, nonce, timestamp} — the whole envelope minus this field. Sign with the private key matching the pub…
- `timestamp` (number, required): Epoch MILLISECONDS (Date.now()), not seconds. Must be within +/-60 s of server time, else 401 stale timestamp.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-videtion-hub-agent-hub/hub#diagnostics

## Score history

- 2026-08-20: 62
- 2026-08-19: 62
- 2026-08-18: 55
- 2026-08-17: 55

## Links

- Remote endpoint: https://hub.videtion.com/mcp
- Website: https://hub.videtion.com/?src=registry
- Changelog RSS feed: https://verifymcp.io/servers/com-videtion-hub-agent-hub/hub.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-videtion-hub-agent-hub/hub.json
- HTML version of this page: https://verifymcp.io/servers/com-videtion-hub-agent-hub/hub