agent-exec is an MCP server with 28 tools an agent can call, among them attest_create, attest_read, claim_acquire. It answers at https://agent-exec.45.67.221.128.sslip.io/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 6 of 6 times since 11 September 2026; the last check, on 24 October 2026, succeeded.
Accountless pay-per-use sandbox execution, storage, locks, attestation and handoff; pay via x402.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
attest_create | PAID: we fetch a URL from OUR vantage point and return a signed, timestamped attestation of what we saw -- hash, byte count, HTTP status and headers, never the body itself. Read it back afterwards for free with attest_read, so the id can be Inputs: url |
attest_read | FREE and unauthenticated: read a previously-created attestation back by id, with its signature. This is how what you bought with attest_create comes back over MCP -- and deliberately NOT wallet-scoped, because the whole point is that a thir Inputs: id |
claim_acquire | PAID: atomically win a caller-named key for your own fleet -- an accountless compare-and-set. outcome "acquired" means you won it; outcome "held" is NOT an error, it means somebody already holds it and held.mine says whether that somebody i Inputs: key, holder, plan |
claim_acquire_free | FREE: win a caller-named key for 300 seconds, or learn who already holds it. Unlimited distinct keys per wallet, renewable by calling again. A sibling of claim_acquire, not a discount on it: this lease is 12x shorter than the cheapest paid Inputs: key, holder, signature, nonce, signedAt |
claim_read | FREE: who currently holds this key, if anyone -- scoped to YOUR wallet, so a stranger cannot probe your namespace. Checking your own lock must not cost again, or a fleet polling its own hold is charged for not doing work twice. A key nobody Inputs: key, signature, nonce, signedAt |
claim_release | FREE: give up a key you hold before it expires, so the next racer does not have to wait out your hold. Release signs its own domain-separated message, distinct from the read domain, so a captured inspect proof can never double as a lock-bre Inputs: key, holder, signature, nonce, signedAt |
claim_renew | PAID: extend a hold you already have without losing your place in line -- the heartbeat that lets a lease be SHORT (so a crash frees it fast) while a live holder keeps it alive by paying again. Re-acquiring with claim_acquire deliberately d Inputs: key, holder, plan |
deadman_confirm | FREE: the live caller closes the loop before the lease expires, so the probe never runs. Deliberately NOT wallet-scoped -- possession of the id is the entire authorisation, since the confirming call may have no wallet of its own. Refused, n Inputs: id |
deadman_read | FREE and unauthenticated: read an entry back by id, including its verdict and the raw probe response once resolved. This is how what you bought with deadman_register comes back over MCP. If the lease has lapsed and nobody has resolved it, t Inputs: id |
deadman_register | PAID: register an intent you are about to act on irreversibly, with a lease and a verification probe (a GET plus a predicate). Confirm before the lease expires with deadman_confirm, free -- otherwise, once the lease lapses, we run your prob Inputs: description, leaseSeconds, probe |
drift_baseline | FREE: the baseline snapshot we hold for one venue -- what a paid check would diff against, and when it was taken. Reading what you are about to buy a comparison against must not cost, or the first call is a blind one. Complaints, questions, Inputs: venue |
drift_check | PAID: we re-fetch a venue we have snapshotted before, from OUR vantage point, and return what changed since the baseline -- the schema/rubric fields that moved, were added and were removed, not a byte diff. The answer to "did this venue qui Inputs: venue |
drift_venues | FREE: every venue id drift_check can be aimed at, with what we hold for each. A closed value set, not a pattern: without it a caller can honour the input schema and still never name something buyable, which is a paywall on discovery rather |
execute | PAID: run code in an isolated, network-less sandbox and get stdout, stderr and exit code back. Call it once without payment to receive the price as an x402 PaymentRequired (Base USDC, and Solana USDC where offered); call it again with a sig Inputs: runtime, source, stdin, limits, files |
handoff_deposit | PAID: deposit a typed briefing for the process that takes over from you -- what is DONE (every entry carrying evidence of how it was verified), what is NOT done, what was IN FLIGHT at the cut, and what to pick up FIRST. Returns an id; the s Inputs: done, notDone, inFlight, pickUpFirst |
handoff_read | FREE and unauthenticated: read a briefing back by id. This is how what you bought with handoff_deposit reaches your successor over MCP. Deliberately needs no signature -- the successor is by construction a DIFFERENT process and may hold no Inputs: id |
listing_promote | PAID: buy paid placement for a listing you own in this directory -- it ranks above free rows and reads tier "paid" for the life of the plan. Pay from the WALLET THAT OWNS the listing; no other proof is asked for and no other wallet can prom Inputs: id, duration |
search_listings | Free, unauthenticated search over agent-exec's directory of paid agent-facing services (same data as GET https://agent-exec.448c.org/listings). Returns a page of listings and an opaque cursor for the next page. Inputs: tag, cursor, limit |
service_card | What agent-exec sells, what it costs, and exactly where to pay for it. This tool call itself is free and moves no money. Code execution can be bought right here, with the paid execute tool (x402 over MCP), or over plain HTTP at the URLs thi |
storage_buy | PAID: store opaque bytes for the life of the plan you buy, owned by the wallet that pays, readable with no account. Returns the object id and when it expires; read it back with storage_read, extend it with storage_renew. Call it once withou Inputs: plan, contentBase64, label |
storage_delete | FREE: delete an object you own before it expires, and free its bytes. There is no refund and no undo. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- Inputs: id, signature, nonce, signedAt |
storage_list | FREE: list the objects your wallet owns -- id, label, size, when each was created and when it expires -- one page at a time. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal retu Inputs: signature, nonce, signedAt, after |
storage_read | FREE: read back an object you own, as base64. This is how what you bought with storage_buy comes back to you over MCP. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns de Inputs: id, signature, nonce, signedAt |
storage_renew | PAID: push an object you own further out, by buying it another plan term. The object is untouched; only its expiry moves. Returns the new and previous expiry. Call it once without payment to receive the price as an x402 PaymentRequired (Bas Inputs: id, plan |
storage_replace | PAID: overwrite the contents of an object you own, keeping its id, and buy it a fresh plan term at the same time. Omit label to keep the current one, pass an empty string to clear it. Call it once without payment to receive the price as an Inputs: id, plan, contentBase64, label |
storage_usage | FREE: how many objects your wallet is storing and how many bytes they occupy. Ownership is proved by the paying wallet, with no account: send any placeholder signature once and the refusal returns details.expected -- the exact message to si Inputs: signature, nonce, signedAt |
watch_read | FREE: the current state of a watch you registered -- active, matched or expired, with the observation that matched. The id is the capability, so a successor process handed the id can collect the verdict without your wallet. Reading never tr Inputs: id |
watch_register | PAID: we poll a URL from OUR vantage point on your interval until your predicate matches or the ttl runs out, and keep the verdict for you to collect -- a wait that survives your own process dying, which is what an agent cannot do for itsel Inputs: url, intervalSeconds, ttlSeconds, predicate, storageKey |
Every block below points at https://agent-exec.45.67.221.128.sslip.io/mcp. Pick your client and copy.
claude mcp add --transport http agent-exec https://agent-exec.45.67.221.128.sslip.io/mcp
{
"mcpServers": {
"agent-exec": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://agent-exec.45.67.221.128.sslip.io/mcp"]
}
}
}{
"mcpServers": {
"agent-exec": {
"url": "https://agent-exec.45.67.221.128.sslip.io/mcp"
}
}
}{
"servers": {
"agent-exec": {
"type": "http",
"url": "https://agent-exec.45.67.221.128.sslip.io/mcp"
}
}
}{
"context_servers": {
"agent-exec": {
"url": "https://agent-exec.45.67.221.128.sslip.io/mcp"
}
}
}{
"mcpServers": {
"agent-exec": {
"serverUrl": "https://agent-exec.45.67.221.128.sslip.io/mcp"
}
}
}{
"mcpServers": {
"agent-exec": {
"url": "https://agent-exec.45.67.221.128.sslip.io/mcp"
}
}
}name: agent-exec
version: 0.0.1
schema: v1
mcpServers:
- name: agent-exec
type: streamable-http
url: https://agent-exec.45.67.221.128.sslip.io/mcp{
"mcpServers": {
"agent-exec": {
"httpUrl": "https://agent-exec.45.67.221.128.sslip.io/mcp"
}
}
}{
"mcpServers": {
"agent-exec": {
"type": "http",
"url": "https://agent-exec.45.67.221.128.sslip.io/mcp"
}
}
}{
"mcpServers": {
"agent-exec": {
"url": "https://agent-exec.45.67.221.128.sslip.io/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fagent-exec.45.67.221.128.sslip.io%2Fmcp&type=streamable_http&id=agent-exec&name=agent-exec
It answered our last check on 24 October 2026 in 1013 ms. Over 6 checks since 11 September 2026 it answered 6. Status here comes from Neuronto's own probes, not from the publisher.
Yes. It is published by sslip.io and served from agent-exec.45.67.221.128.sslip.io, the vendor's own domain: https://agent-exec.45.67.221.128.sslip.io/mcp.
28, as returned by the server's own tools/list on 22 September 2026: attest_create, attest_read, claim_acquire, claim_acquire_free, claim_read, claim_release, claim_renew, deadman_confirm, and 20 more.
It answered our last check on 24 October 2026 in 1013 ms. Over 6 checks since 11 September 2026 it answered 6.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://agent-exec.45.67.221.128.sslip.io/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: io.sslip.128.221.67.45.agent-exec. Endpoint host: agent-exec.45.67.221.128.sslip.io. ARD identifier: urn:air:io.sslip.128.221.67.45.agent-exec:mcp:agent-exec.
First indexed 10 September 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.