agent-exec
REMOTE · AGENT-EXEC.448C.ORG · SCANNED SEP 28
Accountless pay-per-use sandbox, storage, locks, attestation and handoff. Paid over MCP with x402.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (storage_replace). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 6956 tokens (~231/item across 30 items; 30 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (7% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 30 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the agent-exec MCP server?
agent-exec is a hosted endpoint at https://agent-exec.448c.org/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · agent-exec.448c.org
claude mcp add --transport http org-448c-agent-exec-agent-exec 'https://agent-exec.448c.org/mcp'
{
"mcpServers": {
"org-448c-agent-exec-agent-exec": {
"url": "https://agent-exec.448c.org/mcp"
}
}
} {
"servers": {
"org-448c-agent-exec-agent-exec": {
"type": "http",
"url": "https://agent-exec.448c.org/mcp"
}
}
} [mcp_servers.org-448c-agent-exec-agent-exec] url = "https://agent-exec.448c.org/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"org-448c-agent-exec-agent-exec": {
"type": "remote",
"url": "https://agent-exec.448c.org/mcp",
"enabled": true
}
}
} openclaw mcp add org-448c-agent-exec-agent-exec --url 'https://agent-exec.448c.org/mcp' --transport streamable-http
mcp_servers:
org-448c-agent-exec-agent-exec:
url: "https://agent-exec.448c.org/mcp" {
"McpServers": {
"org-448c-agent-exec-agent-exec": {
"Transport": "http",
"Url": "https://agent-exec.448c.org/mcp"
}
}
} assistant mcp add org-448c-agent-exec-agent-exec -t streamable-http -u 'https://agent-exec.448c.org/mcp'
{
"mcpServers": {
"org-448c-agent-exec-agent-exec": {
"type": "http",
"url": "https://agent-exec.448c.org/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Sept 26 +1
- The server now declares the “prompts” capability functional
- The server now declares the “resources” capability functional
- 26 Sept 26 0
- New tool “check_address” functional
- New tool “check_url” functional
- 25 Sept 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 23 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 22 Sept 26 0
- Stability: unverified → 0.03 ▲ functional
- 21 Sept 26 63
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 28 Sept 2026 · Probed https://agent-exec.448c.org/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=agent-exec.448c.org | CN=YE2,O=Let's Encrypt,C=US | 20 Sept 2026 | 19 Dec 2026 | ECDSA 256 | ECDSA-SHA384 | 5a1f2096e42033451c58b9e757d1faa238e |
| SANs: agent-exec.448c.org | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of agent-exec.448c.org. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| org. | present | 26974 | 8 | Verified |
| 448c.org. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://agent-exec.448c.org/mcp | Verified | 200 | |
| http (plaintext) | http://agent-exec.448c.org/mcp | HTTPS enforced | 308 | https://agent-exec.448c.org/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
attest_create Signed observation of a URL (paid, x402) ~257
PAID: we fetch a URL from OUR vantage point and return a signed, timestamped attestation of what we saw -- hash, byte count, HTTP status and headers, never the body itself. Read it back afterwards for free with attest_read, so the id can be cited to a THIRD PARTY who never paid us and who can verify the signature themselves. A fetch that fails to connect, times out, or is refused for safety is still billed and still signed: the observation is what is sold, not a guaranteed 200. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | An absolute http:// or https:// URL, at most 2048 UTF-8 bytes. The body is never returned to you. |
No output schema declared.
No examples provided.
attest_read Read an attestation (free) ~126
FREE and unauthenticated: read a previously-created attestation back by id, with its signature. This is how what you bought with attest_create comes back over MCP -- and deliberately NOT wallet-scoped, because the whole point is that a third party who never paid can fetch it and check the signature. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The attestation id returned by attest_create. |
No output schema declared.
No examples provided.
check_address Check an EVM address against public risk feeds (paid, x402) ~232
PAID: check an EVM address against public risk feeds (OFAC, community darklists, on-chain age) and get back a verdict, score and reasons in the same response the payment settles -- there is no separate read-back call. Charged only on success: if every risk feed is unreachable the request is refused for free (CHECK_SOURCES_UNAVAILABLE) rather than answered with an unsourced verdict. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | An EVM 0x... address. |
| chain | string | – | "base" or "ethereum", default "base". |
No output schema declared.
No examples provided.
check_url Check a URL against public risk feeds (paid, x402) ~222
PAID: check a URL against public risk feeds (phishing lists, domain age, lexical signals) and get back a verdict, score and reasons in the same response the payment settles -- there is no separate read-back call. Charged only on success: if every risk feed is unreachable the request is refused for free (CHECK_SOURCES_UNAVAILABLE) rather than answered with an unsourced verdict. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | An http(s) URL or bare domain, at most 2048 UTF-8 bytes. |
No output schema declared.
No examples provided.
claim_acquire Take a named lock (paid, x402) ~344
PAID: atomically win a caller-named key for your own fleet -- an accountless compare-and-set. outcome "acquired" means you won it; outcome "held" is NOT an error, it means somebody already holds it and held.mine says whether that somebody is you -- the signal that stops a crash-resume or a duplicated retry doing an irreversible action twice. Keys are scoped to the PAYING WALLET: one payer's keys are invisible to every other payer. Inspect it with claim_read, give it up early with claim_release, extend it with claim_renew. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| holder | string | yes | 1..256 UTF-8 bytes -- an id identifying which of your own processes is acting. It is not signed; the signature proves the wallet, not the process. |
| key | string | yes | 1..256 UTF-8 bytes, no '/' character -- the name you want to hold, scoped to your own wallet. |
| plan | string | yes | Which plan to buy; it sets both the hold duration and the price. See GET /pricing or the service_card tool for the live table. |
No output schema declared.
No examples provided.
claim_acquire_free Take a named lock for 300 seconds (free) ~369
FREE: win a caller-named key for 300 seconds, or learn who already holds it. Unlimited distinct keys per wallet, renewable by calling again. A sibling of claim_acquire, not a discount on it: this lease is 12x shorter than the cheapest paid plan, so a lock that has to survive a deploy, a batch or a day is on the paid ladder from the first minute. The free-acquire signature has its OWN domain, distinct from the read and release domains, so neither of those can be replayed into an acquire. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| holder | string | yes | 1..256 UTF-8 bytes -- an id identifying which of your own processes is acting. It is not signed; the signature proves the wallet, not the process. |
| key | string | yes | 1..256 UTF-8 bytes, no '/' character -- the name you want to hold, scoped to your own wallet. |
| nonce | string | yes | A value you have not used before on this route; it stops your signature being replayed. |
| signature | string | yes | Your ownership proof over the message the route names in details.expected. |
| signedAt | integer | yes | Unix timestamp in seconds at which you signed; the server accepts a short window around now. |
No output schema declared.
No examples provided.
claim_read Who holds this key (free) ~300
FREE: who currently holds this key, if anyone -- scoped to YOUR wallet, so a stranger cannot probe your namespace. Checking your own lock must not cost again, or a fleet polling its own hold is charged for not doing work twice. A key nobody holds answers with claim: null, never a not-found: "is this free?" is a legitimate question with a legitimate negative answer. The read signature cannot release the key. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | 1..256 UTF-8 bytes, no '/' character -- the name you want to hold, scoped to your own wallet. |
| nonce | string | yes | A value you have not used before on this route; it stops your signature being replayed. |
| signature | string | yes | Your ownership proof over the message the route names in details.expected. |
| signedAt | integer | yes | Unix timestamp in seconds at which you signed; the server accepts a short window around now. |
No output schema declared.
No examples provided.
claim_release Give up a lock you hold (free) ~361
FREE: give up a key you hold before it expires, so the next racer does not have to wait out your hold. Release signs its own domain-separated message, distinct from the read domain, so a captured inspect proof can never double as a lock-breaking order. The signature proves the WALLET and does not by itself authorize the release: holder is separate and unsigned, and the release is refused unless it names the CURRENT holder (CLAIM_NOT_YOURS) -- what stops one member of your fleet breaking a sibling's lock. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| holder | string | yes | 1..256 UTF-8 bytes -- an id identifying which of your own processes is acting. It is not signed; the signature proves the wallet, not the process. |
| key | string | yes | 1..256 UTF-8 bytes, no '/' character -- the name you want to hold, scoped to your own wallet. |
| nonce | string | yes | A value you have not used before on this route; it stops your signature being replayed. |
| signature | string | yes | Your ownership proof over the message the route names in details.expected. |
| signedAt | integer | yes | Unix timestamp in seconds at which you signed; the server accepts a short window around now. |
No output schema declared.
No examples provided.
claim_renew Extend a lock you hold (paid, x402) ~293
PAID: extend a hold you already have without losing your place in line -- the heartbeat that lets a lease be SHORT (so a crash frees it fast) while a live holder keeps it alive by paying again. Re-acquiring with claim_acquire deliberately does NOT extend, so a retry loop cannot hold a key indefinitely by accident. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| holder | string | yes | 1..256 UTF-8 bytes -- an id identifying which of your own processes is acting. It is not signed; the signature proves the wallet, not the process. |
| key | string | yes | 1..256 UTF-8 bytes, no '/' character -- the name you want to hold, scoped to your own wallet. |
| plan | string | yes | Which plan to buy; it sets both the hold duration and the price. See GET /pricing or the service_card tool for the live table. |
No output schema declared.
No examples provided.
deadman_confirm Close the loop on an intent (free) ~160
FREE: the live caller closes the loop before the lease expires, so the probe never runs. Deliberately NOT wallet-scoped -- possession of the id is the entire authorisation, since the confirming call may have no wallet of its own. Refused, never a silent no-op, once the entry has left pending: confirming an already-resolved entry could otherwise overwrite a probe verdict with a claim from a caller who may not even be the process that registered it. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The entry id returned by deadman_register. |
No output schema declared.
No examples provided.
deadman_read Read an intent and its verdict (free) ~141
FREE and unauthenticated: read an entry back by id, including its verdict and the raw probe response once resolved. This is how what you bought with deadman_register comes back over MCP. If the lease has lapsed and nobody has resolved it, the probe runs right here, synchronously, before answering -- each entry can trigger at most one live probe, ever. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The entry id returned by deadman_register. |
No output schema declared.
No examples provided.
deadman_register Register an intent with a verification probe (paid, x402) ~299
PAID: register an intent you are about to act on irreversibly, with a lease and a verification probe (a GET plus a predicate). Confirm before the lease expires with deadman_confirm, free -- otherwise, once the lease lapses, we run your probe and publish the verdict: confirmed-by-probe, refuted-by-probe, or unresolved (a first-class, honest outcome when the probe could not complete -- never guessed as refuted). The raw probe response is published beside the verdict via deadman_read, free, so you can re-run it and check our answer rather than simply believing it. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | What you are about to do. |
| leaseSeconds | number | yes | How long before an unconfirmed entry's probe runs. 1..604800 seconds. |
| probe | object | yes | At least one of expectedBodyContains / expectedStatus is required. |
No output schema declared.
No examples provided.
drift_baseline The baseline we hold for one venue (free) ~141
FREE: the baseline snapshot we hold for one venue -- what a paid check would diff against, and when it was taken. Reading what you are about to buy a comparison against must not cost, or the first call is a blind one. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| venue | string | yes | A venue id we hold a baseline snapshot for; list them free with drift_venues. A venue we have never snapshotted is a free 404, never a charge. |
No output schema declared.
No examples provided.
drift_check Re-fetch a venue and diff it against our baseline (paid, x402) ~275
PAID: we re-fetch a venue we have snapshotted before, from OUR vantage point, and return what changed since the baseline -- the schema/rubric fields that moved, were added and were removed, not a byte diff. The answer to "did this venue quietly change its rules under me?" for an agent that cannot keep its own corpus. No drift is still an answer and is still billed: the comparison is what is sold. Aim it with drift_venues (which venues we hold) and drift_baseline (what we hold for one), both free. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| venue | string | yes | A venue id we hold a baseline snapshot for; list them free with drift_venues. A venue we have never snapshotted is a free 404, never a charge. |
No output schema declared.
No examples provided.
drift_venues Which venues we can check for drift (free) ~108
FREE: every venue id drift_check can be aimed at, with what we hold for each. A closed value set, not a pattern: without it a caller can honour the input schema and still never name something buyable, which is a paywall on discovery rather than on work. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
execute Run code (paid, x402) ~227
PAID: run code in an isolated, network-less sandbox and get stdout, stderr and exit code back. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to run. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | – | Optional extra files, as POST /execute takes them. |
| limits | object | – | Optional limits (timeoutMs, memoryMb, ...); they set the price. |
| runtime | string | yes | Runtime name, e.g. python3 or node -- see GET /quote or the service_card tool for the list. |
| source | string | yes | The program to run. |
| stdin | string | – | Optional standard input. |
No output schema declared.
No examples provided.
handoff_deposit Deposit a briefing for your successor (paid, x402) ~351
PAID: deposit a typed briefing for the process that takes over from you -- what is DONE (every entry carrying evidence of how it was verified), what is NOT done, what was IN FLIGHT at the cut, and what to pick up FIRST. Returns an id; the successor reads it back for free with handoff_read, with no identity, header or payment of any kind, so neither side needs an account with us. Retained 3 days. The done section is structurally forbidden from holding an unverified claim: a briefing cannot assert something is finished on intent alone. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| done | array | yes | What is DONE. EVERY entry must have confidence 'measured' with non-null evidence; otherwise this is refused, free, as HANDOFF_DONE_REQUIRES_MEASURED. |
| inFlight | array | yes | What was IN FLIGHT at the cut -- neither finished nor abandoned. |
| notDone | array | yes | What is NOT done. May be measured or unverified. |
| pickUpFirst | string | yes | What the successor should do FIRST. Mandatory and non-empty: a briefing with no next action is not a handoff. |
No output schema declared.
No examples provided.
handoff_read Read a briefing (free) ~153
FREE and unauthenticated: read a briefing back by id. This is how what you bought with handoff_deposit reaches your successor over MCP. Deliberately needs no signature -- the successor is by construction a DIFFERENT process and may hold no wallet at all, so demanding proof of the payer would make the product undeliverable. Possession of the id is the entire authorisation; treat it as a secret. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The briefing id returned by handoff_deposit. |
No output schema declared.
No examples provided.
listing_promote Buy paid placement for a directory listing (paid, x402) ~292
PAID: buy paid placement for a listing you own in this directory -- it ranks above free rows and reads tier "paid" for the life of the plan. Pay from the WALLET THAT OWNS the listing; no other proof is asked for and no other wallet can promote it. Promoting an already-promoted row EXTENDS it rather than replacing it, so renewing early never costs you the time you already paid for. Find the id, the live price table and the current paidUntil for free with search_listings. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| duration | string | yes | Which placement plan to buy; it sets both the placement window and the price. See GET /pricing or the service_card tool for the live table. |
| id | string | yes | The listing to promote. It must already exist and be owned by the paying wallet -- create it free with POST /listings. |
No output schema declared.
No examples provided.
search_listings Search the agent-exec directory ~104
Free, unauthenticated search over agent-exec's directory of paid agent-facing services (same data as GET https://agent-exec.448c.org/listings). Returns a page of listings and an opaque cursor for the next page.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque pagination cursor from a previous call's nextCursor. |
| limit | integer | – | Max listings to return (server-bounded regardless). |
| tag | string | – | Filter to listings carrying this tag. |
| Name | Type | Req | Description |
|---|---|---|---|
| error | object | – | – |
| listings | array | – | – |
| nextCursor | string|null | – | – |
No examples provided.
service_card agent-exec service card ~108
What agent-exec sells, what it costs, and exactly where to pay for it. This tool call itself is free and moves no money. Code execution can be bought right here, with the paid execute tool (x402 over MCP), or over plain HTTP at the URLs this returns. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | – |
| directory | object | yes | – |
| execute | object | yes | – |
| llmsTxt | string | yes | – |
| network | string | yes | – |
| openapi | string | yes | – |
| payment | object | yes | – |
| quote | object | yes | – |
| resources | array | yes | – |
| service | string | yes | – |
No examples provided.
storage_buy Store an object (paid, x402) ~248
PAID: store opaque bytes for the life of the plan you buy, owned by the wallet that pays, readable with no account. Returns the object id and when it expires; read it back with storage_read, extend it with storage_renew. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| contentBase64 | string | yes | The bytes to store, base64-encoded. Decoded size must fit the plan. |
| label | string | – | Optional caller-chosen label, up to 256 characters, no control characters. |
| plan | string | yes | Storage plan; it sets both the size limit and the price. See GET /pricing or the service_card tool for the live table. |
No output schema declared.
No examples provided.
storage_delete Delete a stored object (free) ~221
FREE: delete an object you own before it expires, and free its bytes. There is no refund and no undo. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The object id returned when it was bought. |
| nonce | string | yes | A value you have not used before on this route; it stops your signature being replayed. |
| signature | string | yes | Your ownership proof over the message the route names in details.expected. |
| signedAt | integer | yes | Unix timestamp in seconds at which you signed; the server accepts a short window around now. |
No output schema declared.
No examples provided.
storage_list List your stored objects (free) ~229
FREE: list the objects your wallet owns -- id, label, size, when each was created and when it expires -- one page at a time. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Opaque cursor from a previous call's nextCursor. |
| nonce | string | yes | A value you have not used before on this route; it stops your signature being replayed. |
| signature | string | yes | Your ownership proof over the message the route names in details.expected. |
| signedAt | integer | yes | Unix timestamp in seconds at which you signed; the server accepts a short window around now. |
No output schema declared.
No examples provided.
storage_read Read a stored object (free) ~226
FREE: read back an object you own, as base64. This is how what you bought with storage_buy comes back to you over MCP. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The object id returned when it was bought. |
| nonce | string | yes | A value you have not used before on this route; it stops your signature being replayed. |
| signature | string | yes | Your ownership proof over the message the route names in details.expected. |
| signedAt | integer | yes | Unix timestamp in seconds at which you signed; the server accepts a short window around now. |
No output schema declared.
No examples provided.
storage_renew Extend a stored object (paid, x402) ~201
PAID: push an object you own further out, by buying it another plan term. The object is untouched; only its expiry moves. Returns the new and previous expiry. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The object id returned when it was bought. |
| plan | string | yes | Storage plan; it sets both the size limit and the price. See GET /pricing or the service_card tool for the live table. |
No output schema declared.
No examples provided.
storage_replace Replace a stored object (paid, x402) ~257
PAID: overwrite the contents of an object you own, keeping its id, and buy it a fresh plan term at the same time. Omit label to keep the current one, pass an empty string to clear it. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| contentBase64 | string | yes | The replacement bytes, base64-encoded. Decoded size must fit the plan. |
| id | string | yes | The object id returned when it was bought. |
| label | string | – | Optional caller-chosen label, up to 256 characters, no control characters. |
| plan | string | yes | Storage plan; it sets both the size limit and the price. See GET /pricing or the service_card tool for the live table. |
No output schema declared.
No examples provided.
storage_usage Your storage usage (free) ~198
FREE: how many objects your wallet is storing and how many bytes they occupy. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to sign, in both forms (EIP-191 for a 0x wallet, ed25519 as 'solana:<base58 pubkey>:<base58 sig>'). Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| nonce | string | yes | A value you have not used before on this route; it stops your signature being replayed. |
| signature | string | yes | Your ownership proof over the message the route names in details.expected. |
| signedAt | integer | yes | Unix timestamp in seconds at which you signed; the server accepts a short window around now. |
No output schema declared.
No examples provided.
watch_read The state and verdict of a watch (free) ~128
FREE: the current state of a watch you registered -- active, matched or expired, with the observation that matched. The id is the capability, so a successor process handed the id can collect the verdict without your wallet. Reading never triggers a poll and is never charged: polling your own pending answer must not cost again. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The watch id returned by watch_register. |
No output schema declared.
No examples provided.
watch_register Durable poll of a URL until a condition fires (paid, x402) ~385
PAID: we poll a URL from OUR vantage point on your interval until your predicate matches or the ttl runs out, and keep the verdict for you to collect -- a wait that survives your own process dying, which is what an agent cannot do for itself. Price is a function of intervalSeconds x ttlSeconds (interval 60..86400s, ttl 60..604800s), so a first unpaid call quotes YOUR request rather than a fixed plan. The reply carries the id: read it back any time, free and as often as you like, with watch_read. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a signed payment in _meta['x402/payment'] to complete it. The receipt comes back in _meta['x402/payment-response']. No account, no API key. Complaints, questions, quote requests, or a service you wish we had: POST /feedback on this host -- free, no account. Every report is read and analysed daily; there is no individual reply.
| Name | Type | Req | Description |
|---|---|---|---|
| intervalSeconds | integer | yes | Seconds between polls, 60..86400. Shorter costs more. |
| predicate | object | yes | The condition that ends the watch. |
| storageKey | string | – | Optional: on a match, the result is also written to /storage under this key for the paying wallet, so a successor process can collect it without knowing the watch id. |
| ttlSeconds | integer | yes | How long to keep watching, 60..604800. Must exceed intervalSeconds, or the watch expires before a second sample exists. |
| url | string | yes | Absolute http:// or https:// URL, at most 2048 UTF-8 bytes. We GET it; the body is never returned to you, only the verdict. |
No output schema declared.
No examples provided.
What is the agent-exec MCP server?
agent-exec is an MCP server listed in the public MCP registry as org.448c.agent-exec/agent-exec. Accountless pay-per-use sandbox, storage, locks, attestation and handoff. Paid over MCP with x402. This page covers its hosted endpoint (https://agent-exec.448c.org/mcp).
Is the agent-exec MCP server safe to use?
agent-exec scores 66 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the agent-exec MCP server expose?
agent-exec exposes 30 tools: execute, storage_buy, storage_renew, storage_replace, storage_read, and 25 more. Their descriptions and schemas cost roughly 6,956 tokens of context every time the server is loaded.
Does the agent-exec MCP server require authentication?
No. We connected to agent-exec without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the agent-exec MCP server still maintained?
agent-exec is still listed as active in the MCP registry. We last reached this channel on 28 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.