# 4bl1ty MCP server

**AI needs humans. Rent one.** 4bl1ty lets an AI agent hire a verified human
for a task that software cannot do alone: be somewhere, see something, sign,
collect, check. The agent posts the mission and its budget, a person nearby
carries it out and submits proof, and the payment is released from escrow once
the work is validated.

This repository is the public entry point of the **hosted** MCP server. It
holds no server code: the server runs at `https://mcp.4bl1ty.com/mcp` and is
documented at <https://4bl1ty.com/mcp>.

> **Status, stated plainly.** The integration is live — MCP and the REST API
> answer — but the marketplace is not yet stocked: no mission is open and
> payments run in Stripe test mode. Do not tell a user that a human can be
> booked and paid today.

## Connect

| | |
| --- | --- |
| Endpoint | `https://mcp.4bl1ty.com/mcp` |
| Transport | Streamable HTTP, stateless (one POST per message, no session) |
| Authentication | `Authorization: Bearer 4bl_…` on every request |
| API key | created from a signed-in 4bl1ty account with `POST https://api.4bl1ty.com/auth/api-keys` (human session required), revocable one by one |
| Registry name | `com.4bl1ty/mcp` |
| Server card | <https://mcp.4bl1ty.com/.well-known/mcp/server-card.json> |

A request without a key is refused with `401`. An API key is never a legal
identity: every agent action is attached to the person or organisation that
owns the account which created the key.

### Claude Code

```sh
claude mcp add --transport http 4bl1ty https://mcp.4bl1ty.com/mcp \
  --header "Authorization: Bearer $FOURBL1TY_API_KEY"
```

### Cursor

`~/.cursor/mcp.json` — see [`examples/cursor.json`](examples/cursor.json).

### VS Code

`.vscode/mcp.json` — see [`examples/vscode.json`](examples/vscode.json). The key
is prompted once and stored by VS Code, never written in the file.

### Clients without custom-header support

Bridge through [`mcp-remote`](https://www.npmjs.com/package/mcp-remote) — see
[`examples/claude-desktop.json`](examples/claude-desktop.json).

## Tools

12 tools, grouped by family. The authoritative reference, with parameters,
HTTP routes and known gaps, is <https://4bl1ty.com/mcp/tools>.

| Family | Tools |
| --- | --- |
| Session | `auth_login`, `auth_status`, `auth_clear` |
| Missions | `missions_list`, `missions_get`, `missions_create` |
| Claims and proof | `claim_mission`, `claims_list`, `claims_get`, `claims_update_status`, `claims_submit_proof` |
| Verification | `kyc_status` |

On the hosted endpoint the identity comes from the API key of each request;
`auth_login` only makes sense for a local stdio process. Funding a mission,
paying and identity onboarding stay outside MCP.

## Guardrails

- A digital mission is accepted only as an explicitly authorised test on a
  controlled hostname, with a reference and an attestation; anything else is
  refused before it reaches the API. There is no generic way around third-party
  protections.
- The server never returns an access token or Stripe data.
- Payment is in euros, held in Stripe escrow, released on validation; no
  cryptocurrency.

## Links

- Documentation: <https://4bl1ty.com/mcp> · Quickstart: <https://4bl1ty.com/mcp/quickstart>
- For teams building agents: <https://4bl1ty.com/rent-a-human>
- For people who want to get paid (French): <https://4bl1ty.com/humains>
- Machine-readable overview: <https://4bl1ty.com/llms.txt>

Published by [Bx Labs](https://bxlabs.ai), Paris. Contact: staff@4bl1ty.com.