{
  "markdown": "# 404.directory\n\n**Risk preflight for AI Agent actions.**\n\n404.directory gives AI Agents an evidence-backed `allow`, `review`, or `block`\ndecision before they install or invoke a third-party tool. Discovery, provider\nverification, live checks, privacy-safe usage evidence, and a curated read-only\nMCP gateway support that decision.\n\nThe first vertical decision workflow evaluates Polymarket settlement wording,\ntiming, public order-book liquidity, caller-observed eligibility, and execution\nmode before an Agent contemplates a Yes/No action. It never predicts the winner\nor places an order.\n\nConnect a real Agent in under a minute (Codex, Cursor, Claude Code, or MCP SDK):\nhttps://404.directory/connect?source=github\n\nExternal users can join the first-10 activation pilot and report only the\nclient, task category, and failure stage:\nhttps://github.com/MM-sheng/404-directory/issues/1\n\nAgent-readable installation instructions: [`llms-install.md`](./llms-install.md)\n\nInstall the Agent Skill in Codex, Claude Code, Cursor, Cline, or another Agent\nSkills client:\n\n```bash\nnpx skills add MM-sheng/404-directory --skill use-404-directory -g -y\n```\n\nThe repository also conforms to Agent Plugins 1.0: compatible clients discover\nthe Agent Skill from `skills/` and an identity-preserving bridge to the hosted\nStreamable HTTP server from the root `mcp.json`. The bridge creates one random\nID in the client-managed `PLUGIN_DATA` directory. The raw ID stays local; the\nservice stores only an HMAC digest after a successful tool call.\n\nClaude Code and Cowork use the native manifest in `.claude-plugin/`. It loads\nthe same Skill and identity-preserving bridge with Claude's persistent plugin\ndata directory, so updates keep the installation identity stable.\n\nInstall it directly in Claude Code while the official directory submission is\nunder review:\n\n```text\n/plugin marketplace add MM-sheng/404-directory\n/plugin install 404-directory@404-directory\n```\n\n## Product layers\n\n| Layer                           | Purpose                                              | Surface                                                                                                            |\n| ------------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |\n| **First-party execution**       | Run first-party tools in this process                | `GET /tools`, `POST /understand`, `POST /verify/web`, MCP tools                                                    |\n| **Curated remote execution**    | Search and call approved read-only remote MCP tools  | MCP `search_official_docs` / `inspect_tool_server` / `invoke_registered_tool`                                      |\n| **Ecosystem catalog + trust**   | Register / verify / trust / search third-party tools | `/v1/*`, MCP `search_tools` / `get_tool` / `compare_tools` / `get_trust_score`                                     |\n| **Contextual risk preflight**   | Decide whether an Agent should proceed now           | MCP `evaluate_tool_risk` / `report_tool_outcome`, REST `/v1/evaluations/*`                                         |\n| **Prediction-market preflight** | Check settlement and execution risk before action    | MCP `evaluate_prediction_market` / `report_prediction_market_outcome`, REST `/v1/prediction-markets/evaluations/*` |\n\nThe current product is intentionally narrow: preflight one prediction-market\ndecision or one registered third-party tool action, then capture a bounded\noutcome. Future identity, reputation, guarantee, and insurance layers remain\nhypotheses until real external Agent usage validates them.\n\n## Current first-party tools\n\n| Tool                 | Endpoint           | When to use                                                                        |\n| -------------------- | ------------------ | ---------------------------------------------------------------------------------- |\n| `understand_webpage` | `POST /understand` | Understand an ordinary webpage (entities, state, actions) with no Agent-native API |\n| `verify_web`         | `POST /verify/web` | Independently verify a public site after a deploy/update claim                     |\n\n## Agent Discovery API (`/v1`)\n\nRequires a catalog backend (`DATABASE_URL` Postgres, or in-memory fallback when\n`CATALOG_MEMORY_FALLBACK=true`).\n\n```bash\n# Bootstrap admin token (required in production; auto-generated in local/dev)\nexport REGISTRY_ADMIN_TOKEN=change-me-to-a-long-secret\n\n# Register a tool (pending quarantine until ownership + protocol verification)\ncurl -sS http://127.0.0.1:4040/v1/tools \\\n  -H 'content-type: application/json' \\\n  -H \"authorization: Bearer $REGISTRY_ADMIN_TOKEN\" \\\n  -d '{\n    \"name\":\"btc_analyzer\",\n    \"description\":\"Analyze BTC market signals for agents\",\n    \"capabilities\":[\"btc\",\"market-analysis\"],\n    \"protocol\":\"mcp\",\n    \"endpoint\":\"https://example.com/mcp\",\n    \"category\":\"finance\",\n    \"provider\":{\"name\":\"Example Labs\",\"identity\":{\"type\":\"domain\",\"value\":\"example.com\"}}\n  }'\n# Response includes provider_api_key once — store it for ownership + further writes.\n\n# Search (active tools only)\ncurl -sS 'http://127.0.0.1:4040/v1/tools/search?capability=btc&trust_threshold=0.2'\n\n# Trust profile\ncurl -sS http://127.0.0.1:4040/v1/tools/btc_analyzer/trust\n```\n\nCatalog keyword search uses `catalog-lexical-v2` in both memory and PostgreSQL.\nTry `q=official%20documentation` or `q=OpenAI%20docs`; words need not be adjacent.\nAll meaningful terms must match across the name, description, capabilities,\ncategory or provider. Exact names rank first, then lexical relevance, existing\ntrust evidence and usage. Capability/protocol/category/trust filters remain\nmandatory, and public search still excludes quarantined and suspended tools.\n\nNo matches returns `count: 0`, `search.result_status: \"no_matches\"`, and a\nrecovery step pointing to MCP `list_capabilities` / REST `/v1/capabilities`.\nAn empty MCP search is a valid response, but is recorded as `no_matches` rather\nthan a successful Agent activation. It does not mean the task is impossible.\nSearch neither executes tools nor proves they are safe; preflight the exact\nchosen slug. See [search semantics and acceptance results](docs/AUDIT_SEARCH_RECALL_2026-08-27.md).\n\nTrust Profile dimensions (v1 algorithm, extensible factors JSON):\n\n- Ownership / Availability / Compatibility / Security / Usage → `overall_score`\n\nContextual preflight is available through `POST /v1/evaluations`; public\nreceipts are readable at `GET /v1/evaluations/:id`. One bounded outcome can be\nattached through `POST /v1/evaluations/:id/outcome` using the one-time token\nreturned at evaluation time. Only the token hash is stored, and self-reported\noutcomes never directly increase Trust. The older generic `POST /v1/receipts`\nremains disabled because unbound anonymous submissions would poison Trust.\n\nCopy-ready Agent trigger policy and examples:\n[`docs/AGENT_RISK_PREFLIGHT.md`](./docs/AGENT_RISK_PREFLIGHT.md)\n\nPrivacy-safe product validation is public at\n`GET /v1/metrics/risk-evaluations`: evaluation volume, decision distribution,\noutcome-report rate, and behavior-change rate, without prompts or raw identity.\n\nThe prediction-market workflow is documented at\n[`docs/PREDICTION_MARKET_PREFLIGHT.md`](./docs/PREDICTION_MARKET_PREFLIGHT.md).\nIts privacy-safe aggregate metrics are available at\n`GET /v1/metrics/prediction-market-evaluations`.\n\n## MCP Discovery tools\n\nWhen the catalog is enabled, MCP also exposes:\n\n- `evaluate_prediction_market`\n- `report_prediction_market_outcome`\n- `evaluate_tool_risk`\n- `report_tool_outcome`\n- `search_tools`\n- `get_tool`\n- `compare_tools`\n- `get_trust_score`\n- `recommend_tools`\n- `list_capabilities`\n- `get_capability_graph`\n- `search_official_docs`\n- `inspect_tool_server`\n- `invoke_registered_tool`\n\nalongside the existing executable tools.\n\n`evaluate_prediction_market` is the primary first-use path: one call evaluates\nan exact Polymarket market for settlement, liquidity, eligibility, and execution\nrisk without predicting or trading. `evaluate_tool_risk` is the second wedge,\nused before an Agent installs or invokes an unfamiliar third-party tool.\n`search_official_docs` remains a supporting path and returns bounded first-party\ncitations instead of raw provider indexes. Arbitrary URLs, authenticated\nservers, non-active entries, unverified providers, and destructive tools are\nrejected. Remote results are bounded and explicitly marked as untrusted data.\n\n## MCP task prompts\n\nClients that expose MCP Prompts also receive four task-oriented starting\npoints:\n\n- `preflight-prediction-market` — turns an exact market and contemplated action\n  into an `evaluate_prediction_market` call;\n- `evaluate-agent-tool` — finds a catalog candidate, calls the contextual risk\n  preflight, and requires an `allow`, `review`, or `block` result;\n- `research-official-docs` — turns a real technical question into a\n  `search_official_docs` call;\n- `verify-public-deployment` — turns a concrete public deployment claim into a\n  `verify_web` call.\n\nRendering or opening a prompt never counts toward the 1,000-Agent target. Each\ntemplate explicitly requires a non-error tool result that materially answers\nthe user's task. The server records only aggregate `prompts/list` and\n`prompts/get` activation stages, never prompt arguments or task text.\n\nMCP prompt arguments are strings. `evaluate-agent-tool` requires an explicit\n`permissions` argument, for example `\"public_network,credentials\"` or the JSON\narray string `'[\"public_network\",\"credentials\"]'`. Use `\"[]\"` only when the\naction requires no permissions. Missing, malformed, and unknown permissions\nare rejected rather than silently treated as safe. This string encoding is\nfor `prompts/get` only; `evaluate_tool_risk` still accepts a JSON array.\n\nFor direct trading-Agent integration, see\n[`docs/AGENT_INTEGRATION_QUICKSTART.md`](docs/AGENT_INTEGRATION_QUICKSTART.md).\nThe privacy-safe first-10 cohort process is documented in\n[`docs/FIRST_10_AGENT_PILOT.md`](docs/FIRST_10_AGENT_PILOT.md).\n\n## Capability Graph\n\nAgents can explore shared-capability edges and get related-tool recommendations:\n\n```bash\ncurl -sS http://127.0.0.1:4040/v1/capabilities | jq\ncurl -sS http://127.0.0.1:4040/v1/graph/capabilities | jq '.edges[:3]'\ncurl -sS http://127.0.0.1:4040/v1/tools/verify_web/related | jq\n```\n\nSimilarity is Jaccard over capability sets, with small boosts for matching\nprotocol/category (`cap_v1`). This is the seed of the long-term Capability Graph.\n\n## Quick start\n\n```bash\nnpm install\nnpx playwright install chromium\ncp .env.example .env\nnpm run dev\n```\n\nDefault: `http://127.0.0.1:4040`\n\nWith Postgres:\n\n```bash\ndocker compose up -d postgres\nexport DATABASE_URL=postgres://404:404@127.0.0.1:5432/404\nnpm run db:migrate\nnpm run dev\n```\n\nOn boot, first-party tools are seeded into the catalog (`SEED_FIRST_PARTY_TOOLS=true`)\nso `GET /v1/tools/search?capability=web-verification` returns `verify_web`.\nThe six operator-reviewed public MCP servers are also seeded as pending entries\nwhen `SEED_CURATED_MCP_SERVERS=true`. The verification worker performs live MCP\nadmission before they become discoverable or executable.\n\n### Verification worker\n\n- Default: `VERIFICATION_WORKER_MODE=inline` (loop inside HTTP process)\n- Split out for production load:\n\n```bash\nexport VERIFICATION_WORKER_MODE=external\nnpm run worker:verify\n```\n\n### Provider ownership (DNS TXT or GitHub bio)\n\n```bash\n# Domain provider\ncurl -sS -X POST http://127.0.0.1:4040/v1/providers/example-labs/ownership/challenge\n# Publish DNS: _404-directory.example.com TXT \"404-directory-verify=<token>\"\ncurl -sS -X POST http://127.0.0.1:4040/v1/providers/example-labs/ownership/verify\n\n# GitHub provider (identity.type=github)\ncurl -sS -X POST http://127.0.0.1:4040/v1/providers/octo/ownership/challenge\n# Put \"404-directory-verify=<token>\" in the public GitHub profile bio\ncurl -sS -X POST http://127.0.0.1:4040/v1/providers/octo/ownership/verify\n```\n\nOwnership Score ladder: first-party `1.0` → dns_txt `0.95` → github_bio `0.9` →\ngeneric verified `0.8` → unverified `0.35`.\n\n```bash\nnpm test\nnpm run typecheck\nnpm run build\nnpm start\n```\n\n## Agent discovery (404 service tools)\n\nThe service inventory and the registered ecosystem catalog are distinct:\n\n| Surface                        | Meaning                                                                                                             |\n| ------------------------------ | ------------------------------------------------------------------------------------------------------------------- |\n| MCP `tools/list`, `GET /tools` | The same enabled, callable 404 service tools (16 with the default native tools, catalog and gateway enabled)        |\n| `GET /tools/:name`             | The actual MCP argument schema, safety annotations, and explicit MCP / REST invocation routes                       |\n| `GET /v1/tools/search`         | Registered target records, including seeded first-party and third-party tools; a match is not permission to execute |\n| `GET /v1/capabilities`         | Capability labels for ecosystem records, not a list of callable 404 functions                                       |\n\nThe homepage, installation guides, docs, server card, and discovery metadata\nderive the enabled tool inventory from the real MCP registration at startup.\nThe three gateway tools (`search_official_docs`, `inspect_tool_server`,\n`invoke_registered_tool`) are MCP-only: their metadata has `invocation.rest: null`.\nFor other tools, follow the declared REST path and parameter mapping instead\nof assuming that `/tools/:name` executes a tool. HTTP contracts remain in\n`/openapi.json`; MCP metadata schemas follow MCP's JSON Schema dialect, not\nOpenAPI 3's schema dialect. Restart after changing registration/configuration.\n\nSee [discovery consistency audit](docs/AUDIT_SERVICE_DISCOVERY_2026-08-27.md)\nfor validation, compatibility notes, and the local-only delivery boundary.\n\n```bash\ncurl -sS http://127.0.0.1:4040/tools | jq\ncurl -sS http://127.0.0.1:4040/tools/understand_webpage | jq\ncurl -sS http://127.0.0.1:4040/openapi.json | jq '.paths | keys'\ncurl -sS http://127.0.0.1:4040/mcp-info | jq\ncurl -sS http://127.0.0.1:4040/llms.txt\ncurl -sS http://127.0.0.1:4040/health\n```\n\nHomepage (`GET /`) is intentionally minimal: brand, tagline, tool names, and\nlinks to Tools / MCP / OpenAPI / Docs / Health.\n\n## REST examples\n\n```bash\ncurl -sS http://127.0.0.1:4040/understand \\\n  -H 'content-type: application/json' \\\n  -d '{\"url\":\"https://example.com\"}'\n\ncurl -sS http://127.0.0.1:4040/verify/web \\\n  -H 'content-type: application/json' \\\n  -d '{\"url\":\"https://example.com\",\"expected_status\":200,\"expected_text\":\"Example Domain\"}'\n```\n\n`verify_web` returns compact booleans in `checks` plus a structured `evidence`\nobject containing requested/final URLs, HTTP status comparison, expected-text\nmatching, TLS validation, the complete redirect chain, timestamp, and explicit\nClaim → Evidence paths.\n\nTool execution is currently public and free. Rate limits use Vercel's trusted\nclient-IP header (or the socket IP locally).\n\n## MCP\n\n### Streamable HTTP (same process as REST)\n\nPoint MCP clients at `https://404.directory/mcp` (or local `http://127.0.0.1:4040/mcp`).\n\nThe hosted endpoint can also be used directly as an OpenAI Responses API\nremote MCP tool. A copy-ready payload with a privacy-safe installation token is\navailable in [`llms-install.md`](./llms-install.md#openai-responses-api); see the\n[official OpenAI MCP guide](https://developers.openai.com/api/docs/guides/tools-connectors-mcp).\n\nTo become eligible for verified counting, send a stable random, non-personal\nidentifier in `X-404-Agent-ID`. The server persists only an HMAC digest, never\nthe raw ID, prompts, arguments, or results. A successful call is necessary but\ndoes not count by itself: independent-operator evidence must be admitted\nseparately. `X-404-Source` is an optional lowercase attribution label. Verified\npublic progress is available at `GET /v1/metrics/verified-agents`; unverified\ninstallation diagnostics remain at `GET /v1/metrics/agents`. Complete client examples are at\n`https://404.directory/connect`.\n\nOpenAI Responses does not document arbitrary remote MCP request headers. Its\nexample instead uses the supported MCP `authorization` field with a generated\n`agent:<uuid>@<source>` installation token. 404.directory accepts only that\nstrict non-personal shape as an Agent identity; unrelated OAuth bearer tokens\nremain anonymous and are never treated as Agent IDs.\n\nThe privacy-safe activation funnel is available at\n`GET /v1/metrics/activation`. It reports observed Connect views and installer\nclicks plus de-duplicated external Agents that completed MCP `initialize`,\n`tools/list`, `prompts/list`, `prompts/get`, attempted a tool call, failed a tool\ncall, or completed a successful tool execution. The per-source output separates\ncall rate, call success rate, prompt-to-success rate, and end-to-end activation\nrate. Every funnel stage is diagnostic only. Successful execution is necessary\nbut does not count toward the 1,000-Agent target without a separate active\nindependent-operator evidence admission. Prompt names and arguments are not\nstored in activation events. No raw Agent IDs, IPs, prompts, arguments, or\nresults are stored in the funnel.\n\n`GET /v1/metrics/verified-agents` reports privacy-safe 7/30-day retention for\nverified Agents. An Agent becomes eligible only after a complete observation\nwindow and is retained only after another success on a later UTC day.\n`GET /v1/metrics/agents` retains unverified installation diagnostics by safe\nclient label. `GET /v1/metrics/reliability?days=30` aggregates external\nexecution evidence by tool, registered provider, client, and attribution source,\nincluding sample size, success rate, P50/P95 latency, result count, and a finite\nerror taxonomy. Anonymous external executions can inform reliability but never\ncount toward the 1,000 verified-Agent target.\n\nThe official MCP Registry entry also declares `X-404-Agent-ID` as an install\ninput and defaults `X-404-Source` to `official-registry`, so compatible clients\ncan preserve a privacy-safe identity instead of silently creating anonymous\nusage. The service remains usable without either header.\n\nThe dynamic install page also generates a one-click VS Code / GitHub Copilot\nAgent link with a unique non-personal ID already embedded:\n\nhttps://404.directory/connect?source=github\n\nRegistry clients can display the same-domain, script-free service icon at\n`https://404.directory/icon.svg`.\n\nFor clients or directories that accept only a stdio launch command, use the\nidentity-preserving hosted bridge. It creates one random Agent ID per MCP client\nin the user's normal application-data directory and reuses it across restarts:\n\n```json\n{\n  \"mcpServers\": {\n    \"404-directory\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@mmvv1638/404-directory-mcp\"]\n    }\n  }\n}\n```\n\nNo account or API key is required. The bridge is dependency-free and forwards\nonly MCP JSON-RPC traffic to `https://404.directory/mcp`.\n\nCodex supports MCP HTTP headers in `~/.codex/config.toml`:\n\n```toml\n[mcp_servers.404_directory]\nurl = \"https://404.directory/mcp\"\nhttp_headers = { \"X-404-Agent-ID\" = \"agent:REPLACE_WITH_A_STABLE_RANDOM_ID\", \"X-404-Source\" = \"codex\" }\n```\n\nDo not add only the bare MCP URL if you want the Agent installation to retain a\nprivacy-safe identity. Use the generated Codex configuration at\nhttps://404.directory/connect?source=github.\n\n### stdio\n\n```json\n{\n  \"mcpServers\": {\n    \"404-directory\": {\n      \"command\": \"npm\",\n      \"args\": [\"run\", \"mcp\", \"--silent\"],\n      \"cwd\": \"/absolute/path/to/this/repo\"\n    }\n  }\n}\n```\n\nTools are registered automatically from the Tool Registry — adding a tool does\nnot require hand-writing separate MCP adapters.\n\n## Adding a tool\n\n1. Implement handler + Zod input/output schemas\n2. Create a `ToolDefinition` in `src/tools/definitions/`\n3. Register it in `src/tools/create-registry.ts`\n\nREST, OpenAPI, `/tools/:name`, and MCP pick it up from the registry. Keep\n`/tools` compact so discovery cost does not grow with every schema.\n\n## Cloud Run / production\n\nProduction runs on Google Cloud Run. `Dockerfile` uses Node slim and\ninstalls only Chromium's headless shell so the retained Artifact Registry image\nstays below the 0.5 GiB free storage allowance.\n\n**Catalog persistence is required in production.** Without `DATABASE_URL` and\nwith `CATALOG_MEMORY_FALLBACK=true` (the local default), Registry / Trust /\ntelemetry evaporate on every cold start. Also: request-based Cloud Run does\n**not** reliably run in-process `setInterval` workers — use an external worker.\n\n```bash\n# 1) Managed Postgres (Cloud SQL / Neon / etc.) + migrate\nexport DATABASE_URL=postgres://...\nnpm run db:migrate\n\n# 2) API service\ngcloud run deploy directory-404 \\\n  --source . \\\n  --region asia-east1 \\\n  --allow-unauthenticated \\\n  --execution-environment gen2 \\\n  --cpu 1 \\\n  --memory 2Gi \\\n  --concurrency 4 \\\n  --min-instances 0 \\\n  --max-instances 1 \\\n  --timeout 120 \\\n  --port 8080 \\\n  --set-env-vars \"DATABASE_URL=${DATABASE_URL},CATALOG_MEMORY_FALLBACK=false,VERIFICATION_WORKER_MODE=external,REGISTRY_REQUIRE_AUTH=true,REGISTRY_ADMIN_TOKEN=${REGISTRY_ADMIN_TOKEN},PUBLIC_BASE_URL=https://404.directory,HOST=0.0.0.0,PORT=8080\"\n\n# 3) Independent verification worker (Cloud Run Job + Scheduler, or always-on)\n#    VERIFICATION_WORKER_MODE=external on the API; run:\n#    npm run worker:verify\n```\n\nRegistry write APIs (`POST /v1/tools`, ownership challenge/verify, manual\nverify) require `Authorization: Bearer <REGISTRY_ADMIN_TOKEN|provider_api_key>`.\nNew providers receive a one-time `provider_api_key`. Search defaults to\n`status=active` only — pending tools stay quarantined.\n\nApply `cloudrun.cleanup-policy.json` to the source-deploy Artifact Registry\nrepository so superseded, untagged images do not accumulate storage charges.\n\nLocal Docker remains available:\n\n```bash\ncp .env.example .env\ndocker compose up --build -d\n```\n\nProduction hardening notes:\n\n- Keep `BROWSER_EGRESS_ALLOWED_PORTS` narrow (default `80,443`)\n- Tune `RATE_LIMIT_*` and verify/browser timeouts for your traffic\n- Tool execution has a stricter `TOOL_RATE_LIMIT_MAX` than discovery\n- The remote MCP gateway is limited to operator-curated, provider-verified,\n  active, no-auth servers and explicit read-only tool allowlists\n- Gateway arguments are capped at 16 KiB; results and external-call duration are\n  bounded by `MCP_GATEWAY_MAX_RESULT_BYTES` and `MCP_GATEWAY_TIMEOUT_MS`\n- Set `CATALOG_MEMORY_FALLBACK=false` whenever `DATABASE_URL` is configured\n- Prefer `VERIFICATION_WORKER_MODE=external` on serverless\n\n## Security boundaries\n\n- HTTP(S) only; URL credentials rejected\n- DNS → private/loopback/link-local/reserved addresses rejected\n- `verify_web` pins each connection to the exact public IP that passed DNS\n  validation, then re-resolves and re-validates every redirect hop. TLS SNI is\n  sent only for hostnames; IP-literal URLs (e.g. `https://1.1.1.1`) omit SNI and\n  validate the certificate against the IP instead\n- `verify_web` caps response bodies; `198.18.0.0/15` and other reserved ranges\n  are rejected in every environment\n- `understand_webpage` re-resolves and re-validates every browser request, but\n  Chromium request and routes it through a loopback-only forward proxy. That\n  proxy resolves the destination, rejects private/reserved addresses and\n  disallowed ports, then connects to the exact IP that passed validation.\n  Chromium's implicit loopback bypass and QUIC are disabled, while non-proxied\n  WebRTC UDP is blocked. Browser contexts also set `serviceWorkers: \"block\"`.\n  A provider/network egress firewall is still recommended as an independent\n  second layer when the hosting platform supports one\n- Unexpected 500/MCP execution errors are sanitized; full details stay in logs\n- Structured Tool logs include route, status, duration and Tool name, never\n  request bodies\n- Responses include request IDs, `Server-Timing`, no-sniff/frame/referrer/\n  permissions/CSP headers; REST Tool results use `Cache-Control: no-store`,\n  while MCP streaming uses the SDK's `no-cache, no-transform` policy\n\n## Layout\n\n```text\nsrc/\n  domain/          # catalog: registry, verification, trust, discovery, telemetry,\n                   #          ownership, capability-graph, seed\n  db/              # drizzle schema + migrate\n  workers/         # standalone verification worker\n  tools/           # first-party executable registry\n  understand.ts    # understand_webpage service\n  verify/          # verify_web implementation\n  http/            # Fastify app, homepage, OpenAPI\n  mcp/             # stdio + registry→MCP + discovery tools\n  browser/         # Playwright collection\n  security/        # SSRF / URL guards\ndrizzle/           # SQL migrations\n```\n",
  "bytes": 24926,
  "sha": "4dd0f97a8faa970f874ef3440a4bd93241744a8fee9d7b09245f4b8fb827487e",
  "repo_slug": "mm-sheng/404-directory",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_mm_sheng_404_directory_2a086ae9/readme"
}