HODLXXI Read-Only

io.github.hodlxxi由 GitHub 帳號 hodlxxi 發布v0.1.1更新於 Oct 25, 2026

Public read-only MCP server for HODLXXI agent identity, trust, receipts, and verification.

已驗證Streamable HTTP可網頁執行金融安全與監控

概覽

AI 產生的概覽

一個公開、唯讀的遠端 MCP 伺服器，透過 26 個固定工具提供 HODLXXI 的代理身分、信任、證明、收據與驗證資料。

可以做什麼
讀取代理身分、能力、技能、探索文件與市集清單，以及對應的 JSON Schema 和 API 目錄連結集。取得信任與聲譽資料：信任摘要、信任事件、證明、鏈健康、契約與契約倒數。依任務識別碼取得收據，並驗證先前簽發的收據。查看驗證與訊息中繼資料：OpenID 設定、OAuth 授權伺服器與受保護資源中繼資料、JWKS，以及 Nostr 私訊政策與公告。依識別碼讀取營運者持續性聲明和公開的信任或就緒報告。
適用情境
當助理需要查詢 HODLXXI 公布的代理身分、能力、聲譽、證明鏈或收據，或需要驗證收到的收據時使用。它適合唯讀的信任與探索查詢，不適合任何建立或修改資料的流程。
執行需求
遠端 Streamable HTTP 端點；無需 API 金鑰或 OAuth 流程。README 也說明可透過 stdio 執行本機 Python 套件，或執行僅限回送位址的 HTTP 側車，這需要安裝 Python 及該套件。
安裝前請注意
設計上為唯讀：README 聲明不涉及錢包、金鑰、機密、付款或寫入，收據驗證也不能簽發收據。部分上游端點因可能改變伺服器狀態而刻意排除。所有資料來自單一第三方來源，回傳的信任與聲譽數字應視為該營運者自身的聲明。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 HODLXXI Read-Only，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.hodlxxi%2Fhodlxxi-readonly/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "hodlxxi-read-only": {
      "type": "http",
      "url": "https://hodlxxi.com/agent/mcp"
    }
  }
}

README

HODLXXI Read-Only MCP

Public remote MCP server and standalone FastMCP package wrapping 26 allowlisted HODLXXI machine-readable trust surfaces.

Public remote server

Use this Streamable HTTP endpoint in any MCP host that supports remote servers:

text
https://hodlxxi.com/agent/mcp

No API key or OAuth flow is required. The server is public and read-only.

Machine-readable discovery:

text
https://hodlxxi.com/.well-known/mcp.jsonhttps://hodlxxi.com/.well-known/agent.jsonhttps://hodlxxi.com/agent/capabilities

A compatible client can initialize a session, list exactly 26 tools, and call tools such as:

  • hodlxxi_get_agent_discovery
  • hodlxxi_get_capabilities
  • hodlxxi_get_chain_health
  • hodlxxi_get_reputation
  • hodlxxi_get_attestations
  • hodlxxi_get_operator_continuity
  • hodlxxi_get_receipt
  • hodlxxi_verify_receipt

The canonical MCP Registry metadata is stored at the repository root in server.json under the name io.github.hodlxxi/hodlxxi-readonly.

Security boundary

  • fixed upstream origin: https://hodlxxi.com
  • fixed endpoint enum; no generic URL tool
  • GET-only access to allowlisted upstream runtime surfaces
  • redirects disabled
  • 10-second upstream timeout
  • 2 MiB response ceiling
  • JSON and application/linkset+json only
  • strict identifier and pagination validation
  • no Flask imports, database access, wallet access, LND access, keys, secrets, environment reads, payment initiation, receipt creation, or write calls
  • dedicated systemd sidecar; the Flask monolith does not execute MCP tools
  • public nginx route proxies only to the loopback sidecar

GET /agent/jobs/<job_id> and GET /agent/readiness/self-scan are intentionally excluded because they may mutate server state.

Independent validation

The remote production path has been validated from an external macOS client and through a Claude custom connector:

text
external client -> HTTPS -> nginx -> loopback MCP sidecar -> public HODLXXI runtime surfaces

The validation completed MCP initialization, tools/list, and live calls to capabilities, chain health, and reputation. See docs/MCP_CLIENT_VALIDATION.md.

Development

bash
python3 -m venv .venv. .venv/bin/activatepython -m pip install --upgrade pippython -m pip install -e ".[test]"pytest -q

Run over stdio

bash
hodlxxi-mcp

Equivalent:

bash
python -m hodlxxi_mcp

For local client configuration, point the MCP host at the virtual-environment executable and use stdio transport.

Run the sidecar over localhost Streamable HTTP

bash
hodlxxi-mcp-http

The sidecar endpoint is fixed at:

text
http://127.0.0.1:8765/mcp

The sidecar transport is intentionally locked to loopback, stateless JSON responses, Host/Origin protection, and the same 26 read-only tools. Public exposure is handled separately by the hardened production reverse proxy.

來源：packages/hodlxxi_mcp/README.md，提交 5fa93cd

工具

26

hodlxxi_get_agent_identity

Return the canonical public agent identity document, including capabilities, pricing, endpoints, skills, messaging metadata, and trust-model declarations.

無需輸入參數。

hodlxxi_get_operator_continuity

Return the public operator-continuity statement, operator and agent public keys, covenant status, rotation policy, and verification references.

無需輸入參數。

hodlxxi_get_api_catalog

Return the public RFC-style API linkset catalog with service descriptions, documentation links, and status links.

無需輸入參數。

hodlxxi_get_agent_skills_index

Return the Agent Skills discovery index with skill names, descriptions, URLs, types, and SHA-256 digests.

無需輸入參數。

hodlxxi_get_mcp_server_card

Return the live MCP discovery server card for https://hodlxxi.com/agent/mcp, which nginx routes to the separate read-only sidecar rather than the Flask monolith.

無需輸入參數。

hodlxxi_get_nostr_dm_policy

Return public NIP-17/NIP-59 messaging policy metadata, including intake status, custody limitations, accepted kind, and size ceiling.

無需輸入參數。

hodlxxi_get_openid_configuration

Return OpenID Connect discovery metadata: issuer, authorization and token endpoints, JWKS URI, grants, scopes, PKCE, and signing algorithms.

無需輸入參數。

hodlxxi_get_oauth_authorization_server

Return OAuth authorization-server metadata, including the HODLXXI agent_auth discovery block and disabled registration endpoint references.

無需輸入參數。

hodlxxi_get_oauth_protected_resource

Return OAuth protected-resource metadata, including resource issuer, authorization servers, JWKS URI, scopes, and bearer method.

無需輸入參數。

hodlxxi_get_jwks

Return the public RSA JSON Web Key Set used to verify HODLXXI-issued JWT signatures. No private JWK fields are exposed.

無需輸入參數。

hodlxxi_get_agent_discovery

Return the signed Agent Protocol discovery document with public endpoint links, trust surfaces, timestamp, and agent signature.

無需輸入參數。

hodlxxi_get_capabilities

Return the signed capabilities document with job schemas, pricing, limits, endpoint registry, public skills, and messaging metadata.

無需輸入參數。

hodlxxi_get_capabilities_schema

Return the JSON Schema published for the signed HODLXXI capabilities document.

無需輸入參數。

hodlxxi_get_skills

Return the checked-in public skill catalog with metadata, repository paths, and installation URLs.

無需輸入參數。

hodlxxi_get_marketplace_listing

Return the normalized marketplace listing with discovery links, job types, pricing, skills, reputation snapshot, chain health, and trust model.

無需輸入參數。

hodlxxi_get_reputation

Return aggregate public operating history, evidenced job counts, attestation count, trust and confidence averages, pattern distribution, and rolling trust trend.

無需輸入參數。

hodlxxi_get_attestations

Return paginated signed receipt attestations. limit must be 1-100 and offset must be non-negative.

輸入參數limitoffset

hodlxxi_get_trust_events

Return the paginated public trust-event chain with hashes, receipt linkage, timestamps, public key, and signatures.

輸入參數limitoffset

hodlxxi_get_nostr_announcement

Return the signed Nostr announcement template, advertised NIP-89/NIP-90 kinds, discovery links, and explicit non-goals.

無需輸入參數。

hodlxxi_get_chain_health

Return attestation-chain continuity status, event count, latest event hashes, and latest timestamp when available.

無需輸入參數。

hodlxxi_get_covenant_countdown

Return the machine-readable covenant countdown with chain height, spend paths, estimated unlocks, funding status, and conservative trust interpretation.

無需輸入參數。

hodlxxi_get_trust_summary

Return the compact trust summary for a validated public agent identifier.

輸入參數agent_id

hodlxxi_get_covenant

Return a declared covenant artifact by validated covenant identifier, including descriptor, policy, funding status, public keys, and non-claims.

輸入參數covenant_id

hodlxxi_get_report

Return a public machine-readable trust or readiness report by validated report identifier, including its canonical SHA-256 field when present.

輸入參數report_id必填

hodlxxi_verify_receipt

Verify a previously issued receipt by job identifier and return verification status, validity, attestation, signed receipt, event hash, and QR pointer non-claims. This does not poll /agent/jobs and cannot mint a receipt.

輸入參數job_id必填

hodlxxi_get_receipt

Return a previously issued signed receipt by job identifier. Optional requester-proof fields depend on the historical receipt.

輸入參數job_id必填

版本歷史

1
  1. v0.1.1最新Sep 16, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分