4bl1ty MCP server

AI needs humans. Rent one. 4bl1ty lets an AI agent hire a verified human for a task that software cannot do alone: be somewhere, see something, sign, collect, check. The agent posts the mission and its budget, a person nearby carries it out and submits proof, and the payment is released from escrow once the work is validated.

This repository is the public entry point of the hosted MCP server. It holds no server code: the server runs at https://mcp.4bl1ty.com/mcp and is documented at https://4bl1ty.com/mcp.

Status, stated plainly. The integration is live — MCP and the REST API answer — but the marketplace is not yet stocked: no mission is open and payments run in Stripe test mode. Do not tell a user that a human can be booked and paid today.

Connect


Endpoint	`https://mcp.4bl1ty.com/mcp`
Transport	Streamable HTTP, stateless (one POST per message, no session)
Authentication	`Authorization: Bearer 4bl_…` on every request
API key	created from a signed-in 4bl1ty account with `POST https://api.4bl1ty.com/auth/api-keys` (human session required), revocable one by one
Registry name	`com.4bl1ty/mcp`
Server card	https://mcp.4bl1ty.com/.well-known/mcp/server-card.json

A request without a key is refused with 401. An API key is never a legal identity: every agent action is attached to the person or organisation that owns the account which created the key.

Claude Code

Terminal

claude mcp add --transport http 4bl1ty https://mcp.4bl1ty.com/mcp \
  --header "Authorization: Bearer $FOURBL1TY_API_KEY"

Cursor

~/.cursor/mcp.json — see examples/cursor.json.

VS Code

.vscode/mcp.json — see examples/vscode.json. The key is prompted once and stored by VS Code, never written in the file.

Clients without custom-header support

Bridge through mcp-remote — see examples/claude-desktop.json.

Tools

12 tools, grouped by family. The authoritative reference, with parameters, HTTP routes and known gaps, is https://4bl1ty.com/mcp/tools.

Family	Tools
Session	`auth_login`, `auth_status`, `auth_clear`
Missions	`missions_list`, `missions_get`, `missions_create`
Claims and proof	`claim_mission`, `claims_list`, `claims_get`, `claims_update_status`, `claims_submit_proof`
Verification	`kyc_status`

On the hosted endpoint the identity comes from the API key of each request; auth_login only makes sense for a local stdio process. Funding a mission, paying and identity onboarding stay outside MCP.

Guardrails

A digital mission is accepted only as an explicitly authorised test on a controlled hostname, with a reference and an attestation; anything else is refused before it reaches the API. There is no generic way around third-party protections.
The server never returns an access token or Stripe data.
Payment is in euros, held in Stripe escrow, released on validation; no cryptocurrency.

4bl1ty README