SCRIPTMASTERLABS — GhostKey MCP

Report GhostKey server status and check whether configured ScriptMasterLabs authorities are reachable. Unknown stays unknown; no health result is fabricated.

{
  "type": "object",
  "properties": {},
  "$schema": "http://json-schema.org/draft-07/schema#"
}

List the capabilities actually exposed by this GhostKey MCP server and identify staged families without pretending they are callable.

{
  "type": "object",
  "properties": {},
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Explain how to obtain authoritative pricing for a GhostKey/SML paid capability. Pricing and settlement destination come from the fresh live HTTP 402 challenge, never a copied wallet or stale fixed price.

{
  "type": "object",
  "properties": {
    "capability": {
      "type": "string",
      "minLength": 1
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Return GhostKey's operating, payment, upstream-rights, browser-session, and trusted-device policy for autonomous agents.

{
  "type": "object",
  "properties": {},
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Create a one-time trusted-device enrollment capability. Requires GhostKey persistent trusted-device storage to be configured. The browser generates its own non-exportable P-256 private key; only the public key is uploaded.

{
  "type": "object",
  "properties": {
    "label": {
      "type": "string",
      "minLength": 1,
      "maxLength": 80
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Resolve a one-time trusted-device pairing after the browser has enrolled. Requires the original pairing ID and pairing code and is available only until that pairing capability expires.

{
  "type": "object",
  "properties": {
    "pairing_id": {
      "type": "string",
      "format": "uuid"
    },
    "pairing_code": {
      "type": "string",
      "minLength": 20,
      "maxLength": 200
    }
  },
  "required": [
    "pairing_id",
    "pairing_code"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

PAID tool ($0.10 USDC via x402 v2, Base). Create a short-lived, origin-scoped browser delegation session. Send the x402 PAYMENT-SIGNATURE header on the /mcp request; without payment the call returns the live x402 challenge (HTTP 402, amount 100000 = $0.10 USDC, network eip155:8453). Actions inside a minted session are unmetered. Optionally target a previously enrolled trusted device using its private 256-bit routing capability so its extension can claim the session automatically. The user still handles login/CAPTCHA and any new browser-origin permission themselves.

{
  "type": "object",
  "properties": {
    "allowed_origins": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "uri"
      },
      "minItems": 1,
      "maxItems": 12
    },
    "ttl_seconds": {
      "type": "integer",
      "minimum": 60,
      "maximum": 3600
    },
    "trusted_device_id": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{43}$"
    }
  },
  "required": [
    "allowed_origins"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Check whether a scoped GhostKey browser session is alive and whether its user-controlled browser bridge has a fresh heartbeat.

{
  "type": "object",
  "properties": {
    "session_id": {
      "type": "string",
      "format": "uuid"
    },
    "agent_token": {
      "type": "string",
      "minLength": 20
    }
  },
  "required": [
    "session_id",
    "agent_token"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Relay one authorized browser action into the user's already-authenticated browser. Actions: navigate, inspect, click, input, select, read, wait. Password/hidden fields and off-allowlist navigation are denied. API and bridge documentation: https://ghostkey-mcp.onrender.com/session-bridge/README.txt.

{
  "type": "object",
  "properties": {
    "session_id": {
      "type": "string",
      "format": "uuid"
    },
    "agent_token": {
      "type": "string",
      "minLength": 20
    },
    "action": {
      "type": "string",
      "enum": [
        "navigate",
        "inspect",
        "click",
        "input",
        "select",
        "read",
        "wait"
      ]
    },
    "url": {
      "type": "string",
      "format": "uri"
    },
    "selector": {
      "type": "string",
      "minLength": 1,
      "maxLength": 500
    },
    "text": {
      "type": "string",
      "maxLength": 4000
    },
    "attribute": {
      "type": "string",
      "maxLength": 100
    },
    "timeout_ms": {
      "type": "integer",
      "minimum": 1000,
      "maximum": 30000
    }
  },
  "required": [
    "session_id",
    "agent_token",
    "action"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Immediately revoke a GhostKey browser delegation session and cancel queued work.

{
  "type": "object",
  "properties": {
    "session_id": {
      "type": "string",
      "format": "uuid"
    },
    "agent_token": {
      "type": "string",
      "minLength": 20
    }
  },
  "required": [
    "session_id",
    "agent_token"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}