HubVibe: Pay-per-Call Agent Tools: Web Search, Email Verify, KYC Screening, Stocks, Crypto, News

Inspect an MCP endpoint

hubvibe_security_mcp_inspect

Read-onlyIdempotent

MCP server security scan: probe any MCP endpoint's initialize handshake and tools/list and report whether it requires authentication, which protocol version it speaks, how many tools it exposes and which are not marked read-only. Use it before connecting an agent to an unknown MCP server. Input: url of the MCP endpoint. $5.00 per call. Returns: reachable, requires_auth, protocol_version, tool_count, tools[], tools_without_readonly_annotation[].

Input Schema

TableJSON Schema

Name	Required	Description	Default
`url`	Yes	http(s) URL to fetch.
`language`	No	Optional BCP-47 language tag (en, ja, ko, pt-BR): the human-readable strings of the result (notes, details, reasons) are translated into this language; data, codes, numbers and URLs are untouched. Default: as produced.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes
`status`	Yes
`worker`	Yes
`price_usd`	Yes
`provenance`	Yes
`receipt_id`	Yes
`attribution`	No
`receipt_url`	Yes
`billing_warning`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed23 schema fields changedOct 1, 2026

removedOutput schema / description

Removed value: -"The 200 body of every paid /work call. `result` is the worker's own output (its schema is per route); everything else is the same on every /work route. A receipt for the job is at `receipt_url`."

removedOutput schema / properties / attribution / description

Removed value: -"Present only when the result's text was machine-translated: the credit to show with it."

removedOutput schema / properties / attribution / items / description
```
Removed value: -"A credit."
```

removedOutput schema / properties / attribution / items / properties

Removed value: -{
-  "text": {
-    "description": "Credit.",
-    "examples": [
-      "Translated by Google"
-    ],
-    "type": "string"
-  },
-  "url": {
-    "description": "Link.",
-    "examples": [
-      "https://translate.google.com"
-    ],
-    "type": "string"
-  }
-}

removedOutput schema / properties / attribution / items / required
```
Removed value: -[
-  "text",
-  "url"
-]
```
removedOutput schema / properties / attribution / items / type
```
Removed value: -"object"
```

removedOutput schema / properties / billing_warning / description

Removed value: -"Present only when the charge was recorded with a caveat."

removedOutput schema / properties / billing_warning / examples
```
Removed value: -[
-  "settlement pending"
-]
```
removedOutput schema / properties / price_usd / description
```
Removed value: -"What this call cost, in USD."
```
removedOutput schema / properties / price_usd / examples
```
Removed value: -[
-  0.02
-]
```

removedOutput schema / properties / provenance / description

Removed value: -"How the result was produced: which providers ran and how long each took."

removedOutput schema / properties / provenance / properties

Removed value: -{
-  "attempts": {
-    "description": "Provider attempts made, including retries and failovers.",
-    "examples": [
-      1
-    ],
-    "type": "integer"
-  },
-  "elapsed_ms": {
-    "description": "Wall-clock milliseconds for the whole job.",
-    "examples": [
-      340
-    ],
-    "type": "integer"
-  },
-  "providers_used": {
-    "description": "Providers that served the job.",
-    "examples": [
-      [
-        "coinbase-advanced-trade-public"
-      ]
-    ],
-    "items": {
-      "description": "Provider name.",
-      "examples": [
-        "coinbase-advanced-trade-public"
-      ],
-      "type": "string"
-    },
-    "type": "array"
-  },
-  "steps": {
-    "description": "Every step the job ran, in order.",
-    "items": {
-      "description": "One step of the job.",
-      "properties": {
-        "ms": {
-          "description": "Milliseconds the step took.",
-          "examples": [
-            312
-          ],
-          "type": "integer"
-        },
-        "ok": {
-          "description": "Whether the step succeeded.",
-          "examples": [
-            true
-          ],
-          "type": "boolean"
-        },
-        "provider": {
-          "description": "Provider that served the step.",
-          "examples": [
-            "coinbase-advanced-trade-public"
-          ],
-          "type": "string"
-        },
-        "reason": {
-          "description": "Failure reason, on a failed step.",
-          "examples": [
-            "provider_timeout"
-          ],
-          "type": "string"
-        },
-        "step": {
-          "description": "Step name inside the worker.",
-          "examples": [
-            "quote"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "step",
-        "ok",
-        "ms"
-      ],
-      "type": "object"
-    },
-    "type": "array"
-  }
-}

removedOutput schema / properties / provenance / required

Removed value: -[
-  "steps",
-  "providers_used",
-  "attempts",
-  "elapsed_ms"
-]

removedOutput schema / properties / receipt_id / description
```
Removed value: -"Receipt id for this job."
```
removedOutput schema / properties / receipt_id / examples
```
Removed value: -[
-  "rcpt_9f1c2b3a4d5e6f70"
-]
```

removedOutput schema / properties / receipt_url / description

Removed value: -"Where to fetch the machine-readable receipt (free, no payment)."

removedOutput schema / properties / receipt_url / examples

Removed value: -[
-  "/work/receipts/rcpt_9f1c2b3a4d5e6f70"
-]

removedOutput schema / properties / result / properties

Removed value: -{
-  "initialize_status": {
-    "description": "HTTP status of the initialize call.",
-    "examples": [
-      200
-    ],
-    "type": "integer"
-  },
-  "protocol_version": {
-    "description": "MCP protocol version the server negotiated.",
-    "examples": [
-      "2025-06-18"
-    ],
-    "type": [
-      "string",
-      "null"
-    ]
-  },
-  "reachable": {
-    "description": "Whether the server answered the MCP initialize handshake.",
-    "examples": [
-      true
-    ],
-    "type": "boolean"
-  },
-  "requires_auth": {
-    "description": "Whether an unauthenticated initialize was refused.",
-    "examples": [
-      false
-    ],
-    "type": "boolean"
-  },
-  "server_name": {
-    "description": "serverInfo.name.",
-    "examples": [
-      "example-mcp"
-    ],
-    "type": [
-      "string",
-      "null"
-    ]
-  },
-  "server_version": {
-    "description": "serverInfo.version.",
-    "examples": [
-      "1.0.0"
-    ],
-    "type": [
-      "string",
-      "null"
-    ]
-  },
-  "tool_count": {
-    "description": "Tools listed.",
-    "examples": [
-      3
-    ],
-    "type": "integer"
-  },
-  "tools": {
-    "description": "Every tool listed, with its annotations.",
-    "items": {
-      "description": "One tool the inspected server lists.",
-      "properties": {
-        "annotations": {
-          "description": "The tool's annotations object, as served.",
-          "examples": [
-            {
-              "readOnlyHint": true
-            }
-          ],
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "description": {
-          "description": "Tool description.",
-          "examples": [
-            "Current weather for a city."
-          ],
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "name": {
-          "description": "Tool name.",
-          "examples": [
-            "get_weather"
-          ],
-          "type": [
-            "string",
-            "null"
-          ]
-        }
-      },
-      "required": [
-        "name"
-      ],
-      "type": "object"
-    },
-    "type": "array"
-  },
-  "tools_error": {
-    "description": "Why tools/list failed, when it did.",
-    "examples": [
-      null
-    ],
-    "type": [
-      "string",
-      "null"
-    ]
-  },
-  "tools_without_readonly_annotation": {
-    "description": "Tools that do not declare readOnlyHint: the ones an agent should treat as able to change state.",
-    "examples": [
-      [
-        "delete_records"
-      ]
-    ],
-    "items": {
-      "description": "A tool name.",
-      "examples": [
-        "delete_records"
-      ],
-      "type": "string"
-    },
-    "type": "array"
-  },
-  "url": {
-    "description": "The MCP endpoint inspected.",
-    "examples": [
-      "https://mcp.example.com/mcp"
-    ],
-    "type": "string"
-  }
-}

removedOutput schema / properties / result / required

Removed value: -[
-  "url",
-  "reachable",
-  "requires_auth",
-  "initialize_status",
-  "tool_count",
-  "tools",
-  "tools_without_readonly_annotation"
-]

removedOutput schema / properties / status / description

Removed value: -"Present only on a delivered result."

removedOutput schema / properties / worker / description

Removed value: -"Catalog name of the worker that ran."

removedOutput schema / properties / worker / examples
```
Removed value: -[
-  "market.quote"
-]
```

removedOutput schema / title

Removed value: -"security.mcp_inspect response"

Changed1 schema field changedSep 28, 2026

addedOutput schema / properties / attribution

Added value: +{
+  "description": "Present only when the result's text was machine-translated: the credit to show with it.",
+  "items": {
+    "description": "A credit.",
+    "properties": {
+      "text": {
+        "description": "Credit.",
+        "examples": [
+          "Translated by Google"
+        ],
+        "type": "string"
+      },
+      "url": {
+        "description": "Link.",
+        "examples": [
+          "https://translate.google.com"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "text",
+      "url"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Changed1 schema field changedSep 27, 2026

addedInput schema / properties / language

Added value: +{
+  "description": "Optional BCP-47 language tag (en, ja, ko, pt-BR): the human-readable strings of the result (notes, details, reasons) are translated into this language; data, codes, numbers and URLs are untouched. Default: as produced.",
+  "maxLength": 35,
+  "pattern": "^[A-Za-z]{2,3}(-[A-Za-z0-9]{2,8})*$",
+  "type": "string"
+}

Changed1 schema field changedSep 27, 2026

changedOutput schema / description

Previous value: -"The 200 body of every paid /work call. `result` is the worker's own output (its schema is per route); everything else is the same on all 38 routes. A receipt for the job is at `receipt_url`."New value: +"The 200 body of every paid /work call. `result` is the worker's own output (its schema is per route); everything else is the same on every /work route. A receipt for the job is at `receipt_url`."

AddedSep 24, 2026

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/openWorld/non-destructive, so the safety profile is covered. The description adds genuinely useful context beyond them: it performs a live network probe against the target endpoint, and it discloses the $5.00 per-call cost, which the agent cannot learn from structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the scan's scope, then use case, then Input and Returns in labeled form. Every sentence carries information; nothing is padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the Returns list is a helpful summary rather than a necessity, and the when-to-use plus cost are both supplied. It omits whether the endpoint must be publicly reachable and says nothing about the language parameter's effect, minor gaps for a two-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so 'url' and the optional BCP-47 'language' tag are already fully documented in the schema. The description only restates 'Input: url of the MCP endpoint' and adds no format, constraints, or edge cases beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource ('probe any MCP endpoint's initialize handshake and tools/list') and enumerates exactly what it reports: auth requirement, protocol version, tool count, and non-read-only tools. This is clearly distinguishable from the sibling audit_* tools, which target websites/bundles rather than MCP endpoints.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Use it before connecting an agent to an unknown MCP server' gives a concrete triggering condition. It does not, however, name or exclude any alternative (e.g. audit_security) or state what to do with a server already known to be trusted.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All HubVibe: Pay-per-Call Agent Tools: Web Search, Email Verify, KYC Screening, Stocks, Crypto, News tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.