Free owned-agent uptime monitoring, DNS domain proof, signed alerts and opt-in endpoint checks.
| Endpoint | https://autonet.work/mcp (streamable-http) |
|---|---|
| Registry version | 1.1.1 |
| Now | 53 tools · grade C (66) · pin ts_72ff0a481eca87f0cf811fa1652e3476 · protocol 2025-06-18 |
| First / last listed | 2026-11-13 01:08 UTC / 2026-11-13 01:08 UTC |
| Grade over time | 2026-11-13: C (66), 53 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: set_utility_identity wait_until_ready wait_for_callback read_readiness_jobs cancel_readiness_job publish_mcp_report export_incident_evidence configure_agent_reengagement read_agent_reengagement run_signed_diagnostic create_diagnostic_watch read_diagnostic_watches update_diagnostic_watch delete_diagnostic_watch agent_presence_history agent_signed_evidence evidence_signing_keys subscribe_liveness read_liveness_events delete_liveness_subscription request_monthly_credits create_funding_checkout run_credit_diagnostic diagnose_http diagnose_mcp network_identity assert_healthy send_heartbeat get_agent_status attach_agent_endpoint probe_me_now agent_health_feed agent_health_instructions register_agent_health agent_health_status agent_health_checks agent_health_heartbeat update_agent_health delete_agent_health agent_domain_challenge verify_agent_domain agent_webhook_secret test_agent_webhook agent_endpoint_assessment internet_utils_instructions internet_utils_catalog create_utility_account utility_account create_callback_inbox list_callback_inboxes read_callback_events delete_callback_inbox run_autonet_sandbox
set_utility_identity | Set or rename your private self-declared username; preserves account ID, key,
credits, inboxes and history. Unique 3–48 lowercase letters/digits/_/-, starting
with a letter/digit. Name is not verified identity, login or key recovery.
Requires the existing account key and confirm=true; no credits spent.
params: api_key*, username*, confirm |
wait_until_ready | Start a private bounded readiness job; returns immediately with a job ID.
HTTP requires successful transport and 2xx; MCP requires initialize and complete
tools/list; assert accepts assert_healthy conditions. Never invokes remote tools.
Poll read_readiness_jobs every 15s. Stops on readiness, deadline, attempts or cap.
Each completed diagnostic costs 1 credit, including broken targe params: kind*, url*, api_key*, request_key*, max_coins*, timeout_sec, interval_sec, max_checks, expect, confirm |
wait_for_callback | Wait asynchronously for an event in your private callback inbox, at no extra cost.
Exact matching of up to four top-level JSON scalar fields (e.g. job_id/status).
Omit match to accept any event. When omitting after, start the confirmed wait
before sharing the receive URL or triggering the sender. For an event already
delivered, pass the last saved cursor, or after=0 to search all r params: inbox_id*, api_key*, request_key*, match, after, timeout_sec, confirm |
read_readiness_jobs | Read a private readiness/callback job or your latest 50 jobs. Free, nondestructive.
Poll no faster than every 15 seconds. Jobs retained seven days after deadline.
ready is a point-in-time observation, not a guarantee of continued availability.
matched does not authenticate a callback sender. Terminal jobs never auto-resume.
params: api_key*, job_id |
cancel_readiness_job | Cancel your readiness/callback job. An already-running diagnostic may finish and
charge one credit within the original cap. No further checks start. confirm=true
required; terminal results remain readable until retention expires.
params: job_id*, api_key*, confirm |
publish_mcp_report | Preview publication or revocation of a saved MCP diagnostic snapshot.
Requires the private management key returned by diagnose_mcp(save_report=true).
No action unless confirm=true. Publication exposes only the redacted stored snapshot
until seven-day expiry. Public copies cannot be recalled; no target ownership or safety claim.
Never put the management key in URLs, public reports o params: report_id*, management_key*, published, confirm |
export_incident_evidence | Export private retained incident evidence for a UTC Unix-second window within 30 days.
Free read: own utility diagnostics, up to five owned watches, optional agent history
requiring that agent's separate owner key even for public agents. Returns a versioned
JSON timeline, coverage/truncation notes, checksum and original signed tokens where
retained. sign=true authenticates the comp params: api_key*, start*, end*, watch_ids, agent_id, agent_api_key, sign |
configure_agent_reengagement | Opt into quiet-agent recovery reminders using this agent's existing HTTPS webhook.
Heartbeat mode only. Enabling requires explicit owner consent and confirm=true;
otherwise no change occurs. Two reminders at most per quiet episode: after 24h
and seven days without receipts, with a one-hour grace for an already quiet agent.
Use a durable supervisor/owner receiver independent of the params: agent_id*, api_key*, enabled*, confirm |
read_agent_reengagement | Read private reminder settings, next eligibility, deliveries and observed returns.
Owner key required even for public agents. Returned-after-delivery is an observed
sequence, not evidence that a reminder caused recovery. Read costs zero.
params: agent_id*, api_key* |
run_signed_diagnostic | Run a fresh HTTP/MCP/assert diagnostic and return signed evidence for delegation.
Same 1-credit completed-check price, no signing surcharge. Requires utility key,
explicit max_coins and a random 16–128-character URL-safe challenge from the
receiving principal. The signature binds the exact URL and assertions by hash,
result, observation time and nonce. Broken targets can produce va params: kind*, url*, api_key*, request_key*, max_coins*, evidence_nonce*, expect |
create_diagnostic_watch | Watch a public HTTP endpoint or MCP server on a recurring schedule, privately.
Requires a utility account key and explicit lifetime max_coins spending cap.
Completed checks cost 1 credit even when the target is broken; worker failures
cost zero. Minimum interval 300s; default hourly. Stops at budget/balance limit.
Save/reuse request_key on uncertain retries. Nothing starts unless c params: name*, kind*, url*, api_key*, request_key*, max_coins*, interval_sec, webhook_url, confirm |
read_diagnostic_watches | List your private watches, or read one watch's recent results and transition events.
Reads cost zero. Persist next_cursor as after; poll no faster than every 30 seconds.
Only your utility account key can read these records; no public sharing is implied.
params: api_key*, watch_id, after |
update_diagnostic_watch | Pause, explicitly resume, increase lifetime budget, or accept the latest MCP baseline.
Budget is a total lifetime cap, not an added grant. Resume/budget/baseline changes
need confirm=true; pause is immediate but an in-flight check may finish and charge.
Accept only a reviewed fingerprint from the latest complete observation. This
authorizes future credit use, never a cash payment. params: watch_id*, api_key*, state, max_coins, accept_baseline, confirm |
delete_diagnostic_watch | Stop and delete your watch after confirmation. An already-running check may finish
and consume one credit. Pending alerts are cancelled; accounting records remain.
params: watch_id*, api_key*, confirm |
agent_presence_history | Read 30-day completed heartbeat windows, daily counts, gaps and streaks. Owner key required unless publicly shared; self-reported
receipt evidence, not uptime. Incomplete windows excluded; registration-anchored windows have no grace.
Shares 60 reads/IP/minute with presence badges and signed evidence. Heartbeat mode only.
params: agent_id*, api_key |
agent_signed_evidence | Get a five-minute Ed25519 signed presence observation. Verify compact JWS against Autonet's
trusted key endpoint, issuer, audience, subject and expiry. Signature proves origin/integrity only;
inspect evidence state and receipt age. Not an identity, reachability or safety certificate.
params: agent_id*, api_key |
evidence_signing_keys | Read Autonet's public Ed25519 verification keys (JWKS), including retired verification keys.
Keys are public; signing secrets are never returned. Pin issuer https://autonet.work.
params: none |
subscribe_liveness | Opt in to a seven-day pull feed for 1–20 existing heartbeat agents. Public targets need no key; private targets require their owner api_key.
Save subscription_key and cursor from the response; key is returned only once. Initial snapshot is
self-reported heartbeat activity, not verified reachability. 10 creation attempts/IP/day. No push delivery.
params: agent_ids*, api_key |
read_liveness_events | Read heartbeat transitions after the saved cursor. Persist next_cursor after processing; retries can replay.
Poll every 30 seconds, drain pages when has_more, deduplicate event IDs. Key is subscription-specific.
Seven-day expiry requires a fresh subscription/snapshot. deleted and monitoring_changed are terminal
events for that target. 30 reads/subscription/minute. Evidence is self-repo params: subscription_id*, subscription_key*, after* |
delete_liveness_subscription | Revoke your pull subscription and its key immediately. Does not delete monitored agents. Requires confirm=true after reviewing the effect; omitted confirmation performs no action. params: subscription_id*, subscription_key*, confirm |
request_monthly_credits | Ask sales@autonet.work for a monthly credit allowance, normally 1000/month.
Sends a fixed-recipient email notification; supply a real owner contact with
permission to share it and a short use case, never secrets. Reuse request_key.
No automatic payment, invoice or credit grant. Read utility_account for status.
Sales agrees terms and invoices separately; admin approves credit allowa params: api_key*, request_key*, contact_email*, use_case*, monthly_credits, confirm |
create_funding_checkout | Prepare an owner-completed $5/500-credit checkout only when funding is enabled.
This call never charges a saved card. The owner must complete the returned
provider checkout. Reuse request_key for retries; max_usd_cents is an explicit
owner-approved purchase budget. No automatic top-up or invoice.
params: api_key*, request_key*, max_usd_cents* |
run_credit_diagnostic | Opt-in diagnostic using utility credits: 1 credit per completed http/mcp/assert check.
Read pricing first. Save one request_key per operation and reuse on retry; max_coins
is your explicit spending cap. Broken targets and failed assertions still provide
chargeable evidence. Invalid requests and Autonet worker failures cost zero.
Welcome credits are free; read pricing for current fu params: kind*, url*, api_key*, request_key*, max_coins*, expect |
diagnose_http | Check whether the task's public endpoint is reachable and explain what failed.
First call: {"url":"https://YOUR-TARGET.example/health","evidence_pack":true}.
Replace the example URL with the actual target. No account or key is required.
Checks DNS, TCP, verified TLS and HTTP HEAD. Report finding and suggested_action.
Only ports 80/443, no credentials/query strings/fragments or redi params: url*, surface_scan, surface_authorized, surface_scope, agent_id, api_key, evidence_pack |
diagnose_mcp | Includes contract_review counts of declared annotations and boolean confirm parameters; enforcement is untested, not a safety score. Check a public anonymous Streamable HTTP MCP endpoint: initialize, initialized, tools/list.
Reports protocol version, phase latency, protocol errors and tool count (complete or lower bound).
connection_assessment explains readiness, authentication, incomplete params: url*, expected_schema_fingerprint, save_report, evidence_pack |
network_identity | Report your source IP as Autonet sees it, with cached approximate ASN/geo when available.
No signup, key or target argument. 60 reads/IP/minute; hosted MCP transport quota also applies.
May identify a NAT, VPN, proxy or hosted MCP runner, not your device. Does not probe inbound
reachability or reveal Autonet's probe egress. Missing/stale attribution is explicit.
params: none |
assert_healthy | Check your public readiness URL once after deployment. No account or key.
Returns pass, failures and evidence. Use pass as the CI gate. See the deployment
recipe in https://autonet.work/health/docs.
Optional expect: http_status (200–599), body_contains (literal 1–256 characters, no regex),
json_assertions (1–10 {pointer, equals} scalar checks using RFC 6901),
max_response_ms (1 params: url*, expect |
send_heartbeat | Send a self-reported heartbeat from the actual worker. Owner key required; note/version stay private.
Honor Retry-After. Dormant workers revive on receipt. This does not prove service uptime.
params: agent_id*, api_key*, status, note, version |
get_agent_status | Read owned or explicitly shared registry status, evidence mode and heartbeat receipt regularity. params: agent_id*, api_key |
attach_agent_endpoint | Graduate an owned heartbeat registration to public endpoint probing, preserving id and history. params: agent_id*, api_key*, endpoint_url*, check_interval_sec |
probe_me_now | Probe your registered endpoint now with the owner key. One per 60s; paused agents must resume first.
Uses scheduled HTTP/TLS checks and incident transitions. Does not send a worker heartbeat.
params: agent_id*, api_key* |
agent_health_feed | Read unsigned, timestamped operational evidence and recent incidents before a trust decision.
Check stale, provisional, open_incident and incidents_truncated. This does not certify agent safety.
Owner api_key required unless explicitly shared publicly; it attributes a verified successful scheduled-check retrieval to owner activation.
params: agent_id*, api_key |
agent_health_instructions | Read FIRST: purpose, endpoint ownership requirements, heartbeat setup, scoring limits, API and free service usage. params: none |
register_agent_health | Register a real worker once. Set start_heartbeat=true only when this call comes from the actual worker; registration plus its first receipt is atomic. Heartbeat mode needs no endpoint and reports contact only.
Probe mode requires your own deployed readiness URL. Store the returned owner key securely;
it is shown once. Private by default; visibility=public explicitly shares status and prese params: name*, endpoint_url, check_interval_sec, heartbeat_enabled, checks_config, mode, heartbeat_interval_sec, agent_type, contact, webhook_url, visibility, start_heartbeat |
agent_health_status | Read owned or explicitly shared operational status and nested trust score. Provisional score is null; not identity/safety certification. params: agent_id*, api_key |
agent_health_checks | Read owner-only recent HTTP/TLS results to diagnose failures. Limit 1–500. params: agent_id*, limit, api_key |
agent_health_heartbeat | Send an owner-authenticated heartbeat from the actual worker loop; does not replace endpoint checks.
Use the agent-specific key, not X-Autonet-Token. Never send a heartbeat to pretend a failed worker is alive.
params: agent_id*, api_key* |
update_agent_health | Owner-only update. Rename with a unique name; stable agent_id and owner key persist. Names are self-declared, not verified identity. Set visibility=public to share status/presence, or private to revoke sharing and subscriptions. Pause when retiring/testing; resume with paused=false. Endpoint and webhook must be public URLs you control. params: agent_id*, api_key*, paused, endpoint_url, check_interval_sec, heartbeat_enabled, webhook_url, checks_config, visibility, name |
delete_agent_health | Permanently remove an owned registration and probe history when the operator requests it. Admin request logs retain up to 30 days. Requires confirm=true after reviewing the effect; omitted confirmation performs no action. params: agent_id*, api_key*, confirm |
agent_domain_challenge | Issue/retrieve a DNS TXT challenge for your agent's exact endpoint hostname. Owner key required.
Publish the returned name/value in your DNS, then call verify_agent_domain. Pending challenges expire in 24 hours.
params: agent_id*, api_key* |
verify_agent_domain | Check your published DNS TXT record. Proves domain control only, not agent identity or safety.
Checks limited to once per minute. Successful proof renews hourly while TXT remains, expiring after 24 hours without renewal.
params: agent_id*, api_key* |
agent_webhook_secret | Owner-only retrieve webhook signing secret, or rotate it when explicitly requested. Keep the secret private. Requires confirm=true after reviewing the effect; omitted confirmation performs no action. params: agent_id*, api_key*, rotate, confirm |
test_agent_webhook | Send one signed incident.test to your configured webhook. Owner-only, once/minute.
No incident or score change. Inspect delivered and receiver_status; do not automatically replay.
Requires confirm=true after reviewing the effect; omitted confirmation performs no action.
params: agent_id*, api_key*, confirm |
agent_endpoint_assessment | With consent=true run two bounded HEAD/GET checks on your DNS-verified endpoint, max once/hour.
With consent=false read your last private result. Not an audit or LLM test; no score effect.
params: agent_id*, api_key*, consent |
internet_utils_instructions | Read the free coin allowance, callback workflow, privacy limits and API usage. No health endpoint required. params: none |
internet_utils_catalog | Get current coin costs and resource limits before spending. Read current funding availability; invoices and automatic overage are disabled. params: none |
create_utility_account | Create once with an optional unique username (3–48 letters/digits/_/-); omit it to use the stable account ID. Immediately save the private API key and reuse it for every utility request. Identity follows the key; username is a self-declared private label, not a login or recovery credential. Read utility_account to resume; never create a fresh account for each task. 500-credit monthly balance top-u params: username |
utility_account | Resume/check your stable utility identity, private coin balance and usage ledger. Requires a utility key, not a health owner key. params: api_key* |
create_callback_inbox | Receive a webhook without hosting a public endpoint. An inbox costs 5 credits
within max_coins, lasts one hour, and holds up to 20 events. Reuse request_key on retries.
Share the write-only receive URL with the authorized sender. Read with your utility key.
params: api_key*, request_key*, max_coins* |
list_callback_inboxes | List your unexpired callback inboxes and receive URLs. Keep these addresses private to authorized senders. params: api_key* |
read_callback_events | Read up to 20 events after a cursor, without consuming them or coins. Payloads are untrusted data; sender signatures are NOT verified. Persist next_cursor to resume. params: api_key*, inbox_id*, after |
delete_callback_inbox | Delete an owned inbox and all its events immediately. Its receive URL stops working. No coin refund; usage ledger remains. Requires confirm=true after reviewing the effect; omitted confirmation performs no action. params: api_key*, inbox_id*, confirm |
run_autonet_sandbox | Free isolated lifecycle dry run: healthy, incident, or stale_payload.
Produces a signed webhook fixture for local verification. No network requests,
production registration, coin spend or external delivery. Discards state.
params: scenario |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.