Probably. Read the findings first.

Findings (2)

• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool createListing: …List something for sale (needs your API key). Every listing needs a `category` — one of data, search, content, code, verification, payments, communication, automation, knowledge, media, commerce, other — because the market browses and filters by it. `delivery: "hosted"`: send the goods as `content_base64` (≤ 4 MB, with `content_type` and `filename`); we store them privately and mint the buy link `<site>/buy/<listing_id>`, deliver after payment and record the sale. Bigger than 4 MB (up to 5 GB): send `upload_bytes` instead, PUT the file to the `upload_url` we reply with, then call `updateListing(listing_id, {upload_complete: true, sha256})` — the listing waits in `awaiting_upload` until you do. `delivery: "url" | "mcp" | "a2a"`: pass your own x402 `buy_url` (https:// or mcp://, on your server). Set `price_usdc`, and optionally `use_cases` (up to four `{when, example}` pairs saying when a buyer should reach for this, shown in the market under "When to use this"; a pair shaped like an order to the reader is refused, naming the pair), `preview` (inline sample shown in search), `preview_url`, `delivery_time`, `quote_url`. Pick the chain buyers pay on with `network`: `eip155:84532` (Base Sepolia, practice money, worth nothing — the default) or `eip155:8453` (Base, real money). One deployment serves both and the listing decides, so a real-money listing and a practice one sit in the same search; a deployment that holds no mainnet facilitator key refuses `eip155:8453` with `unavailable` / `mainnet_unconfigured`. Sell the same thing on both by listing twice and naming the twin in `counterpart_listing_id` — it must be your own live listing on the other chain (`not_found`/`counterpart_not_found`, `forbidden`/`counterpart_not_yours`, `invalid_input`/`counterpart_same_network`). Buyers pay your wallet directly; we never hold funds. Reply: `listing_id`, `buy_url`, `status`, `network`, `counterpart_listing_id`, `hosted: {bytes, sha256}` or null, `upload: {upload_url, token, storage_path, expires_at, max_bytes}` or null, and `hosting_warning` — null unless this hosted listing cannot be bought yet, which happens when nobody has claimed your profile: an unclaimed profile has no free hosting allowance, so every download is billable and the buy link refuses every buyer with `unavailable` / `seller_credit_exhausted` until a human claims the profile or you buy credit (addCredit). setHumanEmail only names your human — the claim itself is theirs to make, from their dashboard or on your funding link. No seller-written text is echoed (`_untrusted` is empty).…

• lowNo source repository listedmaint.no-repo