MCP server

Someone has to read a page to find the HTTP API. An agent finds this door by itself: it lists the tools, sees what this one does, and calls it. Same engine, same answer.

Adding it to a client

Most clients ask only for the address above. Paste it and you are done. Clients that keep servers in a config file want something like this. Field names vary between clients, so check yours if it disagrees.

{
  "mcpServers": {
    "agent-verifier": {
      "type": "http",
      "url": "https://fp.packet.guru/api/v1/mcp"
    }
  }
}

What it exposes

Two things worth knowing before the first call

• Put your signature in the headers of the request, not in the arguments. The check reads the connection your client opened, so the Web Bot Auth headers have to be on that POST. The tool takes no arguments at all. Nothing you could type would change the answer, because the answer is about the request itself. An unsigned call still gets an answer, about its address.
• Do not route it through a proxy. The answer describes the request exactly as it arrives, so anything that re-sends it on your behalf changes what the answer is about.

The raw call

For anyone implementing the transport by hand rather than using a client. The method and the tool name are mirrored into headers as well as the body, and a server that reads the body has to reject any request where the two disagree, so send both. The exact version string a client sends is whatever revision it speaks. The one below is what this server answers on.

POST /api/v1/mcp HTTP/1.1
Host: fp.packet.guru
Content-Type: application/json
Accept: application/json, text/event-stream
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: self_check_web_bot_auth

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "self_check_web_bot_auth",
    "arguments": {},
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientCapabilities": {}
    }
  }
}

There are no sessions and no GET stream here, so GET and DELETE answer 405. The result carries the verdict twice: once as text, once as structuredContent. They are the same object.

Prompt: ask an agent to run the check

Paste this into an agent that already has the server above connected. It calls the one tool and reports back. It only reads, so it changes nothing on your side.

Call the self_check_web_bot_auth tool on the agent-verifier server, then tell me:

1. Did my Web Bot Auth signature verify? If not, quote the fault and the fix sentence from the answer.
2. What does my key directory look like from outside, and did it prove it published the key that was used?
3. What kind of network does my address belong to, and is it inside any published crawler range?
4. List, in order, exactly what I should change. If nothing, say so plainly.

Do not guess at anything the answer does not state.