HODLXXI Read-Only

io.github.hodlxxi由 GitHub 账号 hodlxxi 发布v0.1.1更新于 Oct 25, 2026

Public read-only MCP server for HODLXXI agent identity, trust, receipts, and verification.

已验证Streamable HTTP可网页运行金融安全与监控

概览

AI 生成的概览

一个公开、只读的远程 MCP 服务器，通过 26 个固定工具提供 HODLXXI 的代理身份、信任、证明、收据与验证数据。

可以做什么
读取代理身份、能力、技能、发现文档与市场列表，以及对应的 JSON Schema 和 API 目录链接集。获取信任与声誉数据：信任摘要、信任事件、证明、链健康、契约与契约倒计时。按任务标识获取收据，并验证此前签发的收据。查看认证与消息元数据：OpenID 配置、OAuth 授权服务器与受保护资源元数据、JWKS，以及 Nostr 私信策略与公告。按标识读取运营者连续性声明和公开的信任或就绪报告。
适用场景
当助手需要查询 HODLXXI 公布的代理身份、能力、声誉、证明链或收据，或需要验证收到的收据时使用。它适合只读的信任与发现查询，不适合任何创建或修改数据的流程。
运行要求
远程 Streamable HTTP 端点；无需 API 密钥或 OAuth 流程。README 还说明可通过 stdio 运行本地 Python 包，或运行仅限回环地址的 HTTP 边车，这需要安装 Python 及该包。
安装前请注意
设计上为只读：README 声明不涉及钱包、密钥、机密、支付或写入，收据验证也不能签发收据。部分上游端点因可能改变服务器状态而被有意排除。所有数据来自单一第三方来源，返回的信任与声誉数字应视为该运营者自身的声明。

安装

在 SourceWeft 中

  1. 打开 控制台中的 HODLXXI Read-Only，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.hodlxxi%2Fhodlxxi-readonly/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "hodlxxi-read-only": {
      "type": "http",
      "url": "https://hodlxxi.com/agent/mcp"
    }
  }
}

README

HODLXXI Read-Only MCP

Public remote MCP server and standalone FastMCP package wrapping 26 allowlisted HODLXXI machine-readable trust surfaces.

Public remote server

Use this Streamable HTTP endpoint in any MCP host that supports remote servers:

text
https://hodlxxi.com/agent/mcp

No API key or OAuth flow is required. The server is public and read-only.

Machine-readable discovery:

text
https://hodlxxi.com/.well-known/mcp.jsonhttps://hodlxxi.com/.well-known/agent.jsonhttps://hodlxxi.com/agent/capabilities

A compatible client can initialize a session, list exactly 26 tools, and call tools such as:

  • hodlxxi_get_agent_discovery
  • hodlxxi_get_capabilities
  • hodlxxi_get_chain_health
  • hodlxxi_get_reputation
  • hodlxxi_get_attestations
  • hodlxxi_get_operator_continuity
  • hodlxxi_get_receipt
  • hodlxxi_verify_receipt

The canonical MCP Registry metadata is stored at the repository root in server.json under the name io.github.hodlxxi/hodlxxi-readonly.

Security boundary

  • fixed upstream origin: https://hodlxxi.com
  • fixed endpoint enum; no generic URL tool
  • GET-only access to allowlisted upstream runtime surfaces
  • redirects disabled
  • 10-second upstream timeout
  • 2 MiB response ceiling
  • JSON and application/linkset+json only
  • strict identifier and pagination validation
  • no Flask imports, database access, wallet access, LND access, keys, secrets, environment reads, payment initiation, receipt creation, or write calls
  • dedicated systemd sidecar; the Flask monolith does not execute MCP tools
  • public nginx route proxies only to the loopback sidecar

GET /agent/jobs/<job_id> and GET /agent/readiness/self-scan are intentionally excluded because they may mutate server state.

Independent validation

The remote production path has been validated from an external macOS client and through a Claude custom connector:

text
external client -> HTTPS -> nginx -> loopback MCP sidecar -> public HODLXXI runtime surfaces

The validation completed MCP initialization, tools/list, and live calls to capabilities, chain health, and reputation. See docs/MCP_CLIENT_VALIDATION.md.

Development

bash
python3 -m venv .venv. .venv/bin/activatepython -m pip install --upgrade pippython -m pip install -e ".[test]"pytest -q

Run over stdio

bash
hodlxxi-mcp

Equivalent:

bash
python -m hodlxxi_mcp

For local client configuration, point the MCP host at the virtual-environment executable and use stdio transport.

Run the sidecar over localhost Streamable HTTP

bash
hodlxxi-mcp-http

The sidecar endpoint is fixed at:

text
http://127.0.0.1:8765/mcp

The sidecar transport is intentionally locked to loopback, stateless JSON responses, Host/Origin protection, and the same 26 read-only tools. Public exposure is handled separately by the hardened production reverse proxy.

来源：packages/hodlxxi_mcp/README.md，提交 5fa93cd

工具

26

hodlxxi_get_agent_identity

Return the canonical public agent identity document, including capabilities, pricing, endpoints, skills, messaging metadata, and trust-model declarations.

无需输入参数。

hodlxxi_get_operator_continuity

Return the public operator-continuity statement, operator and agent public keys, covenant status, rotation policy, and verification references.

无需输入参数。

hodlxxi_get_api_catalog

Return the public RFC-style API linkset catalog with service descriptions, documentation links, and status links.

无需输入参数。

hodlxxi_get_agent_skills_index

Return the Agent Skills discovery index with skill names, descriptions, URLs, types, and SHA-256 digests.

无需输入参数。

hodlxxi_get_mcp_server_card

Return the live MCP discovery server card for https://hodlxxi.com/agent/mcp, which nginx routes to the separate read-only sidecar rather than the Flask monolith.

无需输入参数。

hodlxxi_get_nostr_dm_policy

Return public NIP-17/NIP-59 messaging policy metadata, including intake status, custody limitations, accepted kind, and size ceiling.

无需输入参数。

hodlxxi_get_openid_configuration

Return OpenID Connect discovery metadata: issuer, authorization and token endpoints, JWKS URI, grants, scopes, PKCE, and signing algorithms.

无需输入参数。

hodlxxi_get_oauth_authorization_server

Return OAuth authorization-server metadata, including the HODLXXI agent_auth discovery block and disabled registration endpoint references.

无需输入参数。

hodlxxi_get_oauth_protected_resource

Return OAuth protected-resource metadata, including resource issuer, authorization servers, JWKS URI, scopes, and bearer method.

无需输入参数。

hodlxxi_get_jwks

Return the public RSA JSON Web Key Set used to verify HODLXXI-issued JWT signatures. No private JWK fields are exposed.

无需输入参数。

hodlxxi_get_agent_discovery

Return the signed Agent Protocol discovery document with public endpoint links, trust surfaces, timestamp, and agent signature.

无需输入参数。

hodlxxi_get_capabilities

Return the signed capabilities document with job schemas, pricing, limits, endpoint registry, public skills, and messaging metadata.

无需输入参数。

hodlxxi_get_capabilities_schema

Return the JSON Schema published for the signed HODLXXI capabilities document.

无需输入参数。

hodlxxi_get_skills

Return the checked-in public skill catalog with metadata, repository paths, and installation URLs.

无需输入参数。

hodlxxi_get_marketplace_listing

Return the normalized marketplace listing with discovery links, job types, pricing, skills, reputation snapshot, chain health, and trust model.

无需输入参数。

hodlxxi_get_reputation

Return aggregate public operating history, evidenced job counts, attestation count, trust and confidence averages, pattern distribution, and rolling trust trend.

无需输入参数。

hodlxxi_get_attestations

Return paginated signed receipt attestations. limit must be 1-100 and offset must be non-negative.

输入参数limitoffset

hodlxxi_get_trust_events

Return the paginated public trust-event chain with hashes, receipt linkage, timestamps, public key, and signatures.

输入参数limitoffset

hodlxxi_get_nostr_announcement

Return the signed Nostr announcement template, advertised NIP-89/NIP-90 kinds, discovery links, and explicit non-goals.

无需输入参数。

hodlxxi_get_chain_health

Return attestation-chain continuity status, event count, latest event hashes, and latest timestamp when available.

无需输入参数。

hodlxxi_get_covenant_countdown

Return the machine-readable covenant countdown with chain height, spend paths, estimated unlocks, funding status, and conservative trust interpretation.

无需输入参数。

hodlxxi_get_trust_summary

Return the compact trust summary for a validated public agent identifier.

输入参数agent_id

hodlxxi_get_covenant

Return a declared covenant artifact by validated covenant identifier, including descriptor, policy, funding status, public keys, and non-claims.

输入参数covenant_id

hodlxxi_get_report

Return a public machine-readable trust or readiness report by validated report identifier, including its canonical SHA-256 field when present.

输入参数report_id必填

hodlxxi_verify_receipt

Verify a previously issued receipt by job identifier and return verification status, validity, attestation, signed receipt, event hash, and QR pointer non-claims. This does not poll /agent/jobs and cannot mint a receipt.

输入参数job_id必填

hodlxxi_get_receipt

Return a previously issued signed receipt by job identifier. Optional requester-proof fields depend on the historical receipt.

输入参数job_id必填

版本历史

1
  1. v0.1.1最新Sep 16, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分