AIBITIOUS 404 LAB - 32 Free Agent Experiments

io.github.aibitiousPublished by GitHub account aibitiousv0.3.0Updated Nov 12, 2026

32 free tools: CVE/data checks and offline agent decisions on permissions, budgets and recovery.

The publisher's own server: Silent Door Repository Handoff Planner

VerifiedStreamable HTTPWeb executableCloud & InfrastructureDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A free, rate-limited remote suite of 32 offline verification and preflight tools for agent decisions, data checks and CVE lookups.

What you can do
  • Resolve CVE identifiers via NIST NVD and report missing public data topics
  • Validate JSON against a safe schema subset, diff JSON shapes, lint OpenAPI contracts and MCP server metadata, and audit supplied HTTP headers or robots.txt
  • Detect probable secret patterns, check CSV data quality, audit invoice arithmetic and compare claim citations
  • Dry-run agent policy rules, permission scope changes, approval packets, budgets, retry schedules, duplicate actions, evidence prerequisites and expiry
  • Plan workflow compensations, triage webhook deliveries, forecast queues, measure SLO burn, check release gates, manifest drift and receipt chains
  • Select context chunks within a token limit and generate…
When to use it
Useful when you want an assistant to run quick, advisory preflight checks before acting: validating schemas or API contracts, spotting secrets or stale evidence, sanity-checking budgets and permissions, or looking up a CVE. All checks are offline and advisory, so it suits planning and review rather than enforcement.
Requirements
A remote streamable HTTP endpoint; no package, account, API key or environment variable is declared. Most tools work on data you supply, while the CVE lookup relies on NIST NVD records and the public service is described as free and rate-limited.
Before you install
Results are advisory only and not official validation, legal or tax advice, or fact checking. Do not submit secrets, personal data or real credentials to the public demo; secret detection is meant for pattern checks only. The README also discusses an unrelated experimental payment protocol with unaudited contracts handling real USDC, which is not part of these tools.

Installation

In SourceWeft

  1. Open AIBITIOUS 404 LAB - 32 Free Agent Experiments in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.aibitious%2Fagent404/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "aibitious-404-lab-32-free-agent-experime": {
      "type": "http",
      "url": "https://aibitious.com/404/mcp/"
    }
  }
}

README

🤖 AI Micropayment Network (AiMPN)

Looking for the free AIBITIOUS 404 LAB MCP server?
Launch the tool directory · Try live synthetic demos · MCP endpoint · REST/OpenAPI · LAB source and safety notes.

These are separate experiments in one repository. AIBITIOUS 404 LAB is a public, free, rate-limited suite of ten verification/preflight tools. It requires no wallet, cryptocurrency, account, or payment, and is not backed by the payment smart contracts discussed below. Neither the LAB tools nor the contracts are independently certified. Do not submit secrets or personal data to the public demo. Registration in an MCP directory is not evidence of user adoption.

AiMPN is an experimental open-source protocol for Zero-Gas Machine-to-Machine (M2M) payments on Base L2.

[Base Mainnet] [ERC-4337 Account Abstraction] [Slither Analysis] [License: MIT]

🚨 SECURITY NOTICE: AiMPN is in early-stage Alpha. The smart contracts handle real USDC on Base Mainnet but have NOT been independently audited. This is an experimental proof-of-concept. Please read our SECURITY.md and do not use with significant funds.

🌟 What is AiMPN?

AiMPN allows AI Agents (like ElizaOS, LangChain, AutoGen) to purchase APIs, data, and compute resources from other machines using USDC. Unlike traditional wallets, AiMPN uses ERC-4337 Paymasters to sponsor 100% of the gas fees, meaning AI Agents never need to hold ETH to transact.

Our architecture is deeply inspired by and designed to be an implementation library compatible with standard x402 paradigms (e.g., Linux Foundation / Coinbase x402 initiatives).

📊 Verifiable On-Chain Data (Base Mainnet)

We believe in radical transparency. AiMPN is live on Base Mainnet. You can verify our deployed infrastructure directly on BaseScan:

Example Zero-Gas Settlement Hash: 0x3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d (Demo reference)

🛡️ Core Concept: The AI Circuit Breaker

Since AI agents operate autonomously, they pose a severe financial risk if they hallucinate or get stuck in a spending loop. AiMPN mitigates this through hardcoded EVM Circuit Breakers:

  • Daily Spend Limits: Agents are mathematically capped at a specific USDC spend per day.
  • Atomic Escrows: Funds are locked in escrow and only released when the API delivers the data (Proof-of-Delivery). If the API times out, the USDC is refunded automatically.

Read our deep-dive technical architecture here: AI Circuit Breaker Architecture.

🚀 Quickstart

Integrating AiMPN into your agent framework takes just 5 lines of code. Check out the QUICKSTART.md guide.

🤝 Contributing & Bug Bounty

We are actively looking for contributors, integrations (ElizaOS, Fetch.ai), and security researchers. Please refer to our SECURITY.md for details on our Bug Bounty program.

Source: README.md at commit 4364e16

Tools

33

resolve_public_fact

Resolve one CVE identifier (e.g. CVE-2024-3094) using NIST NVD records. This tool does not execute code, scan targets, or accept arbitrary URLs.

Parametersidentifierrequired

report_missing_information

Opt-in report of a PUBLIC missing-data topic, never include private data or secrets.

Parameterstopicrequiredconsent_to_aggregate

json_schema_guard

Validate one JSON object against a SAFE subset of JSON Schema. No remote refs. Offline.

Parametersschemarequireddocumentrequired

csv_data_doctor

Find missing fields, ragged CSV rows and duplicate key values; no raw rows are stored.

Parameterscsv_textrequireddelimiterkey_columns

invoice_math_audit

Independently recalculate invoice arithmetic, NOT legal/tax compliance. Synthetic data only.

Parameterslinesrequiredcurrencydeclared_netdeclared_taxdeclared_gross

secret_pattern_shield

Detect probable token patterns without returning or storing secret values. Never send real secrets.

Parameterstextrequired

openapi_contract_preflight

Static OpenAPI 3.x lint: missing operation IDs, responses and malformed operations. Offline.

Parametersspecrequired

mcp_registry_preflight

Check a candidate MCP server.json metadata structure; this is NOT official validation.

Parametersserverrequired

http_headers_audit

Assess supplied HTTP security response headers. No network or live website probe.

Parametersheadersrequired

robots_policy_check

Evaluate supplied robots.txt for one agent/path. Not a legal scraping permission.

Parameterspathagentrobots_txtrequired

json_shape_diff

Compare JSON object shapes for added, deleted or changed field types. Offline.

Parametersafterrequiredbeforerequired

simulate_agent_action_policy

Dry-run one proposed tool action against explicit allow/deny/approval rules; no enforcement.

Parametersrulesrequiredactionrequired

plan_workflow_recovery

Plan reverse-order compensations for a supplied workflow DAG; never execute actions.

Parametersstepsrequired

triage_webhook_deliveries

Find duplicate, failed and rate-limited deliveries from supplied HTTP status metadata.

Parametersattemptsrequired

check_claim_provenance

Check whether supplied claim references reach at least one declared source; not fact checking.

Parametersclaimsrequiredsourcesrequired

minimize_agent_data

Check declared fields, retention and model transfer against a supplied local policy.

Parametersfieldsrequiredallowed_fieldsrequiredmax_retention_daysrequired

scope_delta

Permission Scope Delta

Find newly granted permissions outside an approved set. Offline check. Supply payload like {"before":["read"],"after":["read","send"],"approved_additions":[]}. Advisory result only.

Parameterspayloadrequired

approval_packet

Approval Packet Check

Find missing or expired fields before seeking human approval. Offline check. Supply payload like {"now_unix":100,"action":{"actor":"agent","tool":"mail.send","target":"draft1","effect":"send","reason":"owner_request","expiry_unix":200}}. Advisory result only.

Parameterspayloadrequired

budget_envelope

Budget Envelope

Check worst-case proposed cost against a local hard budget. Offline check. Supply payload like {"limit_usd":"0","spent_usd":"0","reserved_usd":"0","proposed_worst_case_usd":"0"}. Advisory result only.

Parameterspayloadrequired

retry_schedule

Retry Schedule

Preview capped exponential retries against a deadline. Offline check. Supply payload like {"attempts":3,"first_delay_seconds":2,"max_delay_seconds":10,"deadline_seconds":30}. Advisory result only.

Parameterspayloadrequired

duplicate_actions

Idempotency Audit

Find duplicate attempts and conflicting key reuse. Offline check. Supply payload like {"calls":[{"idempotency_key":"k1","payload_fingerprint":"hash1"},{"idempotency_key":"k1","payload_fingerprint":"hash1"}]}. Advisory result only.

Parameterspayloadrequired

prerequisite_gate

Prerequisite Gate

Check whether all declared evidence prerequisites are present. Offline check. Supply payload like {"requirements":[{"id":"deploy","evidence_refs":["ci"]}],"available_evidence":["ci"]}. Advisory result only.

Parameterspayloadrequired

evidence_expiry

Evidence Freshness

Flag stale observations before an agent acts. Offline check. Supply payload like {"now_unix":200,"records":[{"id":"health","observed_unix":100,"ttl_seconds":120}]}. Advisory result only.

Parameterspayloadrequired

citation_matrix

Citation Matrix

Find claims with missing or unknown citation identifiers. Offline check. Supply payload like {"claims":[{"id":"claim1","citation_refs":["src1"]}],"citations":["src1"]}. Advisory result only.

Parameterspayloadrequired

schema_impact

Consumer Schema Impact

Identify downstream consumers broken by changed fields. Offline check. Supply payload like {"before":{"id":1},"after":{},"consumers":[{"id":"client","required_fields":["id"]}]}. Advisory result only.

Parameterspayloadrequired

boundary_cases

Boundary Case Builder

Generate bounded edge cases from simple field constraints. Offline check. Supply payload like {"fields":[{"name":"count","type":"integer","minimum":0,"maximum":10}]}. Advisory result only.

Parameterspayloadrequired

slo_burn

SLO Burn Check

Measure error-budget burn against a supplied target. Offline check. Supply payload like {"target_percent":"99","total":1000,"bad":20,"alert_burn_rate":2}. Advisory result only.

Parameterspayloadrequired

queue_forecast

Queue Capacity Forecast

Project backlog and drain time from supplied rates. Offline check. Supply payload like {"backlog":100,"incoming_per_hour":10,"capacity_per_hour":20,"horizon_hours":4}. Advisory result only.

Parameterspayloadrequired

permission_paths

Permission Path Explorer

Find sensitive targets reachable through declared capability edges. Offline check. Supply payload like {"start":"agent","edges":[{"from":"agent","to":"secret"}],"sensitive_targets":["secret"]}. Advisory result only.

Parameterspayloadrequired

context_budget

Context Budget Packer

Select prioritized context chunks inside a token limit. Offline check. Supply payload like {"max_tokens":100,"chunks":[{"id":"source1","tokens":40,"priority":10}]}. Advisory result only.

Parameterspayloadrequired

release_gate

Release Gate Check

Require named checks to be green before a release. Offline check. Supply payload like {"required":["test"],"checks":[{"id":"test","status":"success"}]}. Advisory result only.

Parameterspayloadrequired

manifest_drift

Manifest Drift

Compare expected and observed resource manifests. Offline check. Supply payload like {"expected":{"version":"1"},"observed":{"version":"2"}}. Advisory result only.

Parameterspayloadrequired

receipt_chain

Receipt Chain Check

Check links in a supplied digest receipt chain. Offline check. Supply payload like {"root_sha256":"0000000000000000000000000000000000000000000000000000000000000000","receipts":[{"previous_sha256":"0000000000000000000000000000000000000000000000000000000000000000","sha256":"1111111111111111111111111111111111111111111111111111111111111111"}]}. Advisory result only.

Parameterspayloadrequired

Version history

2
  1. v0.3.0LatestNov 12, 2026
  2. v0.2.0Nov 11, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.

Other Aibitious integrations

Silent Door Repository Handoff Planner

com.aibitious.silentOfficial publisher

A remote MCP server that helps an assistant plan which repository files to hand off to another agent or reviewer, using filenames only.

Streamable HTTPWeb executable
Developer Tools3 toolsOct 24, 2026