dev.agentmetal/agentmetal
NPM · @AGENTMETAL/MCP
Rent a Linux VPS from an AI agent: provision, SSH in, run commands. Pay USDC (x402) or card.
Available components
Last scanned (5 hours ago)
Scores higher than 61% of npm servers
Category Cloud Infrastructure
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 30 of 111 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 23 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2285 tokens (~175/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management73
- Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "destroy_server" implies "destroy" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +3
- CVE-2023-54404 no longer affects this package ▲ security
- Known CVEs: fail → pass ▲ security
- 29 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.
- 27 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.
- 25 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 24 Oct 26 −3
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@agentmetal/mcp@0.3.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 111 packages
| Packages resolved | 111 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
claim_account Claim an account (request code) ~110
Begin claiming an AgentMetal account by email. Sends a one-time 6-digit code to the address; redeem it with verify_claim to get an account API key. Side effect: sends one email. Does not charge. Accounts are OPTIONAL — they add fleet management under one key, monthly card billing, and higher quotas, but are not required to provision or pay. Call verify_claim next with the emailed code.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Email address that should receive the one-time 6-digit claim code. |
No output schema declared.
No examples provided.
destroy_server Destroy a server ~115
Permanently destroy a server RIGHT NOW, before its lease expires. IRREVERSIBLE — the VM and all its data are deleted and remaining lease time is NOT refunded. Requires an account API key (AGENTMETAL_API_KEY); without one this returns an auth error. Use to free quota or stop holding an unneeded box. To let a box expire naturally instead, simply do not extend it.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Server id to destroy, e.g. "srv_abc123". This action cannot be undone. |
No output schema declared.
No examples provided.
exec_command Run a command on a server ~287
Run a single shell command as ROOT on a server over SSH and get back its exit code, stdout, and stderr. Requires (1) an account API key (AGENTMETAL_API_KEY) AND ownership of the server, and (2) a server provisioned with managed_key:true — the only way the API holds a key it can log in with; a box created without managed_key returns "no_managed_key". The command runs in a non-interactive shell with no TTY, so avoid prompts; chain steps with && or ;. Execution is bounded by `timeout_seconds` (1–120, default 60); if it overruns, the process is killed and `timed_out` is true. Output is capped at 256 KB per stream. Use to install packages, run scripts, or inspect a box you own without opening your own SSH session.
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | yes | The shell command to run as root (non-empty, ≤4096 chars). Runs non-interactively; chain steps with && or ;. |
| id | string | yes | Server id to run the command on, e.g. "srv_abc123". Must be a running, managed-key server you own. |
| timeout_seconds | integer | – | Max seconds to wait before the command is killed (1–120, default 60). On overrun, timed_out is true. |
No output schema declared.
No examples provided.
extend_server Extend a server lease ~130
Extend an existing server's lease so it is not auto-destroyed at expiry. SPENDS REAL USDC — signed on-chain via x402 (Base) up to the per-call spend cap; a real charge. Adds `days` days to the current expiry and returns the new expiry (unix seconds). Use before a lease runs out to keep a box alive; check the current expiry first with get_server.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | yes | Whole days to add to the current lease (1–30). |
| id | string | yes | Server id to extend, e.g. "srv_abc123". |
No output schema declared.
No examples provided.
get_catalog List plans, locations, and pricing ~68
List available server plans (size + price), the regions servers can run in, and add-on pricing for bandwidth and storage. FREE — read-only, charges no money and needs no wallet or account. Call this FIRST to see what sizes, regions, and prices are on offer before provisioning a server.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_firewall List a server firewall ~113
List a server's inbound firewall rules (the edge Hetzner Cloud Firewall). New boxes boot locked-down (SSH + ICMP only); other ports are opened with manage_firewall. Read-only, no charge. `managed:false` with a note means the box has no edge firewall (legacy box; nothing to manage here). Requires an account API key (AGENTMETAL_API_KEY) and ownership.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Server id whose firewall to list, e.g. "srv_abc123". |
No output schema declared.
No examples provided.
get_server Get server status ~97
Look up one server's live status (provisioning | running | suspended | expired | destroyed), public IPv4, lease expiry (unix seconds), and bandwidth usage. Read-only — never charges money or changes the server. Use to confirm a box is up and reachable, or to see how long it has before auto-destroy.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Server id returned by provision_server, e.g. "srv_abc123". |
No output schema declared.
No examples provided.
list_servers List your servers ~103
List every server (the fleet) for a payer wallet, or for the whole account when an account API key is configured. Read-only — never charges or changes anything. Defaults to the wallet configured on this MCP server; pass `wallet` to list a different payer. Use to enumerate active boxes before calling extend_server or destroy_server.
| Name | Type | Req | Description |
|---|---|---|---|
| wallet | string | – | Optional payer wallet address (0x…) whose servers to list. Defaults to this MCP server's configured wallet. |
No output schema declared.
No examples provided.
manage_firewall Open or close a firewall port ~273
Open or close a single port on a server's edge firewall so it can (or can't) serve traffic. Does not charge money. Requires an account API key (AGENTMETAL_API_KEY) and ownership of the server. The last SSH (port 22) rule cannot be removed unless force:true (it would lock you out). Use action "open" to expose e.g. 443 for a web server, "close" to remove a rule.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | "open" adds an allow rule; "close" removes the matching rule. |
| description | string | – | Optional human label for the rule. |
| force | boolean | – | Required (true) to remove the last SSH (22) rule; guards against locking yourself out. |
| id | string | yes | Server id to manage, e.g. "srv_abc123". |
| port | string | – | Port or range for tcp/udp, e.g. "443" or "8000-9000". Omit for icmp/esp/gre. |
| protocol | string | yes | Rule protocol. Most web/app ports are tcp. |
| source_ips | array | – | Allowed source CIDRs (e.g. ["0.0.0.0/0","::/0"]). Defaults to the whole internet. |
No output schema declared.
No examples provided.
provision_server Provision a server ~485
Provision a brand-new Linux VPS and pay for it in a single call. SPENDS REAL USDC — the payment is signed on-chain via x402 (Base) up to this MCP server's per-call spend cap; it is a real charge, not a quote or a dry run. Returns the server id (srv_…), public IPv4, and an SSH target (`ssh root@<ip>`, or `ssh -p <port> root@<ip>` in cdmx-1), usually reachable in under 60 seconds. Use when an agent needs its own compute to build, run, or host something with no human signup. Pass `ssh_key` to get inbound SSH; omit it and the box boots with no way to log in. The lease lasts `days` days, after which the server is automatically destroyed unless you extend_server first.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | yes | Lease length in whole days (1–30). The server auto-destroys at expiry unless extended; you pay up front for the whole lease. |
| location | string | – | Optional zone. Omit for the default (Hetzner US, with fallback). "cdmx-1" is our own bare metal in Mexico City: Ubuntu 22.04/24.04 only, SSH on a per-box port of a shared IP, no storage or firewall A… |
| managed_key | boolean | – | Generate a server-side SSH keypair, authorize it on the box, and return the private key ONCE; enables exec_command. Stored only encrypted server-side. |
| os | string | – | Optional OS image, e.g. "ubuntu-24.04" (default), "debian-12", "fedora-44", "rocky-9". Call get_catalog for the full list. |
| plan | string | yes | Server size / price tier: "nano" (smallest, cheapest), "small", or "medium". Choose the smallest that fits the workload. |
| ssh_key | string | – | Optional single-line OpenSSH public key (e.g. "ssh-ed25519 AAAA…") authorized for root SSH. Omit and the box has NO inbound SSH access. |
| via | string | – | Optional attribution tag (e.g. the calling skill name). Analytics only; does not affect provisioning. |
No output schema declared.
No examples provided.
reboot_server Reboot a server ~118
Soft-reboot a server (graceful ACPI restart) without destroying it or losing data. Use to recover a box that has become unresponsive or to apply changes that need a restart. Requires an account API key (AGENTMETAL_API_KEY) and ownership of the server; without one this returns an auth error. Does not charge money. Returns immediately with status "rebooting"; the box is back in well under a minute.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Server id to reboot, e.g. "srv_abc123". |
No output schema declared.
No examples provided.
server_logs Server diagnostics (hypervisor-level) ~150
Hypervisor-level diagnostics for a server WITHOUT logging into it: current status, recent provider actions (with any error messages), a VNC console URL + one-time password, and live CPU / disk / network metrics. Use to diagnose a stuck, unreachable, or misbehaving box from the outside. Requires an account API key (AGENTMETAL_API_KEY) and ownership; does not charge money. NOTE: the cloud provider exposes no text serial-console / boot log, so this returns actions + console access + metrics, not a plain-text log — open the VNC console URL for screen-level access.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Server id to diagnose, e.g. "srv_abc123". |
No output schema declared.
No examples provided.
verify_claim Verify an account claim ~236
Complete an account claim using the 6-digit code emailed by claim_account. Returns a long-lived account API key (am_live_…) — store it securely; it authorizes destroy_server and account-scoped calls. Optionally link a wallet so its existing servers attach to the account — this REQUIRES wallet_signature: sign the exact message "AgentMetal: link wallet <wallet> to <email>" with the wallet and pass the 0x signature (without it the API rejects the wallet with the message to sign). The code expires 10 minutes after claim_account and is invalidated after 5 wrong attempts.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The 6-digit code from the claim email. |
| string | yes | The same email address you passed to claim_account. | |
| wallet | string | – | Optional wallet address (0x…) to link to the account, attaching its existing servers. Requires wallet_signature. |
| wallet_signature | string | – | Required when `wallet` is set: the 0x signature of "AgentMetal: link wallet <wallet> to <email>" signed by that wallet, proving control of it. |
No output schema declared.
No examples provided.
How do I install the dev.agentmetal/agentmetal MCP server?
dev.agentmetal/agentmetal runs locally as an npm package, launched with npx -y @agentmetal/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @agentmetal/mcp
claude mcp add dev-agentmetal-agentmetal -- npx -y @agentmetal/mcp
What is the dev.agentmetal/agentmetal MCP server?
dev.agentmetal/agentmetal is an MCP server listed in the public MCP registry as dev.agentmetal/agentmetal. Rent a Linux VPS from an AI agent: provision, SSH in, run commands. Pay USDC (x402) or card. This page covers its npm package (@agentmetal/mcp).
Is the dev.agentmetal/agentmetal MCP server safe to use?
dev.agentmetal/agentmetal scores 79 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the dev.agentmetal/agentmetal MCP server expose?
dev.agentmetal/agentmetal exposes 13 tools: provision_server, get_server, list_servers, extend_server, destroy_server, and 8 more. Their descriptions and schemas cost roughly 2,285 tokens of context every time the server is loaded.
Is the dev.agentmetal/agentmetal MCP server still maintained?
dev.agentmetal/agentmetal is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the dev.agentmetal/agentmetal MCP server under?
dev.agentmetal/agentmetal declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.