autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/atxp-autoreg/references/mcp-full-audit-2026-06-25.md

@@ -0,0 +1,73 @@
+# ATXP MCP Full Audit (2026-06-25)
+
+**Method:** Direct curl calls to all 8 MCP servers with $10 account token
+**Total tools:** 70 (62 free + 8 paid)
+
+## Email (10 tools)
+- FREE: email_check_inbox, email_get_message, email_search, email_mark_as_read, email_delete, email_get_attachment, email_release_username
+- PAID: email_send_email ($0.01), email_reply ($0.01), email_claim_username ($1.00)
+
+## Phone (12 tools)
+- FREE: phone_release, phone_configure_voice, phone_check_sms, phone_get_sms, phone_mark_read, phone_get_attachment, phone_check_calls, phone_get_call, phone_search
+- PAID: phone_register ($2.00), phone_send_sms ($0.05), phone_call ($0.10)
+
+## Search (1 tool)
+- PAID: search_search ($0.01) — labeled FREE but actually requires payment
+
+## Image (3 tools)
+- PAID: image_create_image, image_create_image_async, image_get_image_async ($0.001)
+
+## Music (2 tools)
+- FREE: music_create_async, music_get_async
+
+## Video (2 tools)
+- FREE: create_video, wait_for_video
+
+## PaaS (31 tools) — ALL REQUIRE PAYMENT
+- Workers: deploy_worker, deploy_from_git, list_deployments, get_worker_info, get_logs, delete_worker ($0.001 each)
+- Databases: create_database, list_databases, query, delete_database
+- Storage: create_bucket, list_buckets, upload_file, get_file, list_files, delete_bucket, delete_file
+- DNS: add_domain, list_domains, create_dns_record, list_dns_records, delete_dns_record, connect_domain_to_worker
+- Analytics: query_analytics, list_analytics_events, get_analytics_stats, list_analytics_datasets, get_dataset_schema
+- Secrets: set_secret, list_secrets, delete_secret
+
+## Git (4 tools)
+- FREE: git_list_repos, git_delete_repo
+- PAID: git_create_repo ($0.50), git_get_remote_url ($0.01)
+
+## Critical Finding: "FREE" labels are misleading
+
+Tools labeled as FREE in the tools/list response still require payment when called on restricted accounts. The actual FREE tools on restricted accounts are:
+- email_check_inbox, email_get_message, email_search, email_mark_as_read, email_delete, email_get_attachment, email_release_username
+- phone_check_sms, phone_get_sms, phone_mark_read, phone_get_attachment, phone_check_calls, phone_get_call, phone_search, phone_configure_voice, phone_release
+- git_list_repos, git_delete_repo
+- music_create_async, music_get_async
+- create_video, wait_for_video
+
+## Endpoint Format
+
+```
+POST https://{name}.mcp.atxp.ai/
+Content-Type: application/json
+Accept: application/json, text/event-stream
+Authorization: Bearer https://accounts.atxp.ai?connection_token=TOKEN&account_id=ACCT_ID
+
+{"jsonrpc": "2.0", "method": "tools/call", "params": {"name": "TOOL_NAME", "arguments": {...}}, "id": 1}
+```
+
+Response is SSE format: `event: message\ndata: {...}\n\n`
+
+## Curl Working Example
+
+```bash
+curl -s -X POST "https://email.mcp.atxp.ai/" \
+  -H "Content-Type: application/json" \
+  -H "Accept: application/json, text/event-stream" \
+  -H "Authorization: Bearer https://accounts.atxp.ai?connection_token=89Bf9cw1kbKAzZLNZU3nK&account_id=atxp_acct_1uahidiHVCb5oCE93ashk" \
+  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"email_check_inbox","arguments":{}},"id":1}'
+```
+
+Returns:
+```json
+{"result":{"content":[{"type":"text","text":"{\"status\":\"success\",\"inboxAddress\":\"atxp_acct_1uahidihvcb5oce93ashk@atxp.email\",\"messages\":[]}"}]},"jsonrpc":"2.0","id":1}
+```