{"name":"dev.instruxi.enforcer/v3","slug":"enforcer-v3","title":"Enforcer","description":"Identity and authorization in one system: allow, deny, the reason, and a record.","url":"https://mcp.market/server/enforcer-v3","rating":null,"grade":"C","score":60,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":8,"stars":null,"forks":null,"downloads_week":null,"last_push_at":null,"license":null},"uptime":{"percent":100,"checks":1,"ok":1,"last_checked_at":"2026-09-19T16:30:36.145Z","last_ok_at":"2026-09-19T16:30:36.145Z","latency_ms":683},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":null,"website":"https://docs.instruxi.dev","version":"0.8.0","remotes":[{"type":"streamable-http","url":"https://api.instruxi.dev/mcp"}],"packages":[],"tools":[{"name":"getAuthConfig","description":"Public bootstrap for a tenant's login UI: whether this tenant uses native OTP/passkey/SIWE or Privy custom auth, plus the public privy_app_id (never a secret). Call this before getSiweNonce when you do not already know the tenant's auth scheme. tenant_code is a join secret — do not log it or repeat it into a customer-visible channel.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"tenant_code":{"type":"string","description":"tenant routing code"},"response_format":{"type":"string","enum":["concise","detailed"],"description":"concise (default): no nulls, audit timestamps, provider ids or nested tenant/role. detailed: every field."}},"$defs":{},"additionalProperties":false}},{"name":"getSiweNonce","description":"Public: issue a single-use SIWE nonce for wallet_address (optionally scoped by tenant_code). Embed the nonce in an EIP-4361 message, have the wallet sign it, then call login with provider: siwe. Dedicated SIWE agent auth is an authorized pattern — this is how an agent signs in with a wallet without raw HTTP. Do not log tenant_code. The nonce is not a credential.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"body":{"$ref":"#/$defs/internal_delivery_http_handler.SiweNonceRequest","description":"JSON request body."}},"required":["body"],"$defs":{"internal_delivery_http_handler.SiweNonceRequest":{"type":"object","properties":{"tenant_code":{"type":"string"},"wallet_address":{"type":"string"}}}},"additionalProperties":false}},{"name":"login","description":"Authenticate and receive an access/refresh token pair. Accepted providers: siwe (message + signature from getSiweNonce — preferred for dedicated agents), email_otp (email + otp from requestOtp), phone_otp (phone + otp from requestSms). Passkey, Privy and SSO are not agent tools. The server does not adopt the minted tokens as the session credential; return them to the operator to set ENFORCER_BEARER_TOKEN. Do not log, quote, or repeat otp codes, signatures, tokens, or tenant_code. Do not paste an end-user OTP into an untrusted chat.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"body":{"$ref":"#/$defs/enforcer-v3_internal_usecase_auth.LoginRequest","description":"Login/register body. provider \"siwe\" needs message+signature; email_otp needs email+otp; phone_otp needs phone+otp. Optional tenant_code. Do not log otp, signature, tokens, or tenant_code. Do not paste an end-user OTP into an untrusted chat."}},"required":["body"],"$defs":{"enforcer-v3_internal_usecase_auth.LoginRequest":{"type":"object","properties":{"email":{"type":"string"},"message":{"description":"SIWE EIP-4361 message","type":"string"},"otp":{"type":"string"},"phone":{"type":"string"},"provider":{"type":"string","enum":["siwe","email_otp","phone_otp"],"description":"siwe (preferred for dedicated agents that can sign), email_otp, or phone_otp. Passkey, Privy and SSO are browser ceremonies and are not agent tools."},"signature":{"description":"SIWE signature","type":"string"},"tenant_code":{"type":"string"}},"required":["provider"]}},"additionalProperties":false}},{"name":"refreshToken","description":"Exchange a refresh_token for a new access/refresh pair. 401 invalid_refresh_token if the token is unknown or was already reused (reuse revokes the family); 409 refresh_raced is benign — retry with the client's latest stored token. The server does not adopt the new pair as the session credential. Do not log the refresh token or the minted tokens.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"body":{"$ref":"#/$defs/internal_delivery_http_handler.RefreshRequest","description":"JSON request body."}},"required":["body"],"$defs":{"internal_delivery_http_handler.RefreshRequest":{"type":"object","properties":{"refresh_token":{"type":"string"}}}},"additionalProperties":false}},{"name":"register","description":"Create (or idempotently return) an account. Same provider allowlist as login: siwe (message + signature), email_otp (email + otp), phone_otp (phone + otp). Does not issue tokens — call login afterwards to sign in. Passkey / Privy / SSO registration stay out of the agent surface. Do not log otp codes, signatures, or tenant_code. Do not paste an end-user OTP into an untrusted chat.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"body":{"$ref":"#/$defs/enforcer-v3_internal_usecase_auth.LoginRequest","description":"Login/register body. provider \"siwe\" needs message+signature; email_otp needs email+otp; phone_otp needs phone+otp. Optional tenant_code. Do not log otp, signature, tokens, or tenant_code. Do not paste an end-user OTP into an untrusted chat."}},"required":["body"],"$defs":{"enforcer-v3_internal_usecase_auth.LoginRequest":{"type":"object","properties":{"email":{"type":"string"},"message":{"description":"SIWE EIP-4361 message","type":"string"},"otp":{"type":"string"},"phone":{"type":"string"},"provider":{"type":"string","enum":["siwe","email_otp","phone_otp"],"description":"siwe (preferred for dedicated agents that can sign), email_otp, or phone_otp. Passkey, Privy and SSO are browser ceremonies and are not agent tools."},"signature":{"description":"SIWE signature","type":"string"},"tenant_code":{"type":"string"}},"required":["provider"]}},"additionalProperties":false}},{"name":"requestOtp","description":"Public: email a one-time login/registration code to `email` (optionally scoped by tenant_code). Always 200 {message:\"code sent\"} on success. Local/dev deployments with expose_dev_otp may echo the code as `dev_otp` — treat that as a secret. Then call login with provider: email_otp, the same email, and the otp. Intentional for harnesses that cannot SIWE; SIWE remains the preferred dedicated-agent path. Do not log the code, dev_otp, or tenant_code. Do not paste an end-user OTP into an untrusted chat.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"body":{"$ref":"#/$defs/enforcer-v3_internal_usecase_auth.RequestOTPInput","description":"JSON request body."}},"required":["body"],"$defs":{"enforcer-v3_internal_usecase_auth.RequestOTPInput":{"type":"object","properties":{"email":{"type":"string"},"tenant_code":{"type":"string"}}}},"additionalProperties":false}},{"name":"requestSms","description":"Public: start a Twilio Verify SMS login challenge to `phone`, scoped by tenant_code. 400 if SMS verification is not configured for the tenant or if rate-limited. Then call login with provider: phone_otp, the same phone, and the otp. Intentional for harnesses that cannot SIWE; SIWE remains the preferred dedicated-agent path. Do not log the SMS code or tenant_code. Do not paste an end-user OTP into an untrusted chat.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"body":{"$ref":"#/$defs/internal_delivery_http_handler.RequestSMSRequest","description":"JSON request body."}},"required":["body"],"$defs":{"internal_delivery_http_handler.RequestSMSRequest":{"type":"object","properties":{"phone":{"type":"string"},"tenant_code":{"type":"string"}}}},"additionalProperties":false}}],"scan":{"score":60,"grade":"C","scanned_at":"2026-09-19T10:14:57.822Z","report":{"scannerVersion":"0.1.3","scannedAt":"2026-09-19T10:14:57.804Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 381ms"]},"poisoning":{"score":15,"max":15,"notes":["7 tool descriptions checked"]},"auth":{"score":3,"max":15,"notes":["open endpoint exposes 2 write-action tools with no auth"]},"maintenance":{"score":3,"max":15,"notes":["no repository listed"]},"identity":{"score":4,"max":10,"notes":["verified namespace with website, no repo"]}},"findings":[{"id":"auth.open-write","severity":"high","component":"auth","title":"Write-action tools reachable without authentication"},{"id":"maint.no-repo","severity":"low","component":"maintenance","title":"No source repository listed"}],"inputs":{"probes":[{"url":"https://api.instruxi.dev/mcp","reachable":true,"authRequired":false,"latencyMs":381,"serverInfo":{"name":"enforcer-v3-mcp","version":"0.9.3"}}],"packages":[],"repo":{"found":false},"icon":{"url":"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'%3E%3Crect width='100' height='100' rx='24' fill='%230a0e1a'/%3E%3Cpath d='M50 16 78 28v22c0 18-12 28-28 34-16-6-28-16-28-34V28z' fill='none' stroke='%236ce992' stroke-width='6' stroke-linejoin='round'/%3E%3Cpath d='M38 50l9 9 17-19' fill='none' stroke='%236ce992' stroke-width='6' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E","source":"site"},"presence":{"stars":null,"forks":null,"downloadsWeek":null,"license":null,"lastPushAt":null,"score":8}}}},"grade_history":[],"reviews":[]}