# Vokko

> Multi-protocol capability index for the agent web.

Vokko probes a host for UCP, AP2, TAP, MCP, A2A, x402, MPP, llms.txt, and OpenAPI. We do not complete checkout, do not send PAYMENT-SIGNATURE to the target, and do not invent well-knowns.

## API

- [Host report (cached, free)](https://www.vokko.eu/api/v1/hosts/{domain}): GET JSON protocol matrix plus additive `capabilityMatrix`, `participation` (`open` | `gated` | `blocked` | `unknown`, with evidence), and `paymentRails` (x402, mpp, other). A2A records which of `agent-card.json` or `agent.json` hit. HTML 200 and auth-gated cards are not `callable`. `payable: true` only after a parsed live payment challenge. AP2 with nothing on the origin is `not_probeable_on_origin`, not a payment miss. Presence cached 24h; callability 15 minutes. Old fields stay.
- [Changes](https://www.vokko.eu/api/v1/hosts/{domain}/changes): newest-first drift since the previous snapshot. Anonymous callers get the last 5 summaries. A paid subscriber for that origin gets full `from`/`to` history (`?limit=`, default 20, max 50). Does not 402 and does not spend a live refresh. Paid refresh bodies include `changesSincePrevious`.
- [Host report (live)](https://www.vokko.eu/api/v1/hosts/{domain}/refresh): paid re-probe, $0.02 USDC on Base (eip155:8453). `?refresh=1` on the host path is equivalent. Humans use [pricing](https://www.vokko.eu/pricing) (Bearer vok_…). Agents send x402 V2 PAYMENT-SIGNATURE to *Vokko*, never to the target. When the free report has `callabilityStale: true`, this is the live probe.
- [Host report (live example)](https://www.vokko.eu/api/v1/hosts/allbirds.com/refresh): concrete payable URL (no query). GET as-is for a 402.
- [One protocol (live)](https://www.vokko.eu/api/v1/hosts/{domain}/protocols/{protocol}/refresh): paid, $0.005 USDC on Base. `protocol` is a detector id (x402, mcp, a2a, ucp, and the rest). Unknown id is 400. Example: [allbirds x402](https://www.vokko.eu/api/v1/hosts/allbirds.com/protocols/x402/refresh).
- [Batch refresh](https://www.vokko.eu/api/v1/hosts/refresh): POST `{"domains":["a.com","b.com"],"mode":"full"}`. Cap 10. One payment, $0.01 + $0.002 × N USDC on Base. A failed host is an item error.
- Paid routes 400 before the 402 on a literal-IP host, an unknown or duplicate query param, or a `network` other than the live CAIP-2 (`eip155:8453` on prod; the error names only that network). REST paid SKUs are rate-limited at 60/min per IP before x402 verify/settle. Free lookups ignore extra query params.
- [Directory](https://www.vokko.eu/api/v1/index): indexed hosts.
- [Origin-owner report](https://www.vokko.eu/report/{domain}): HTML or `Accept: application/json`. Cached free. `?refresh=1` uses the same paywall as the API. Missing spec fields, not grade letters.

## Agent tools

- [OpenAPI](https://www.vokko.eu/openapi.json): free lookup plus paid REST routes tagged `paid` with `x-payment-info`. Each paid op declares its real HTTP method and concrete examples (host allbirds.com, protocol x402, public receipt tx). Examples are safe to try unpaid (402, no outbound). MCP is not in the spec.
- [MCP](https://www.vokko.eu/api/v1/mcp): POST Streamable HTTP JSON-RPC. GET is 405. Protocol versions 2025-06-18 and 2025-03-26; initialize echoes a supported client protocolVersion, otherwise 2025-06-18. After initialize, a missing MCP-Protocol-Version header is 2025-03-26; unsupported is HTTP 400 with a fixed message (header never echoed). Notifications without an id (including notifications/initialized and id-less tools/call) are HTTP 202 with an empty body and do no work. ping returns result {}. Batch arrays are -32600. Unparsable JSON is -32700. Bodies over 64 KB are HTTP 413 with -32700. resources/list and prompts/list are -32601. Capabilities advertise tools only. ping and notifications use no DB, rate-limit writes, or x402. Free: `lookup_host`, `participation_check`, `list_changes`, `find_payable` (alphabetical evidence, not a rank). Paid on Base, 402 when unpaid: `refresh_host` ($0.02), `refresh_host_protocol` ($0.005), `refresh_hosts_batch` ($0.01 + $0.002 × N). Client 4xx is JSON-RPC `-32602`. Internals and upstream 503s are `-32603` with a fixed message.
- [Terms](https://www.vokko.eu/terms): /terms. Cached lookup is free. Live refresh is paid.
- [Pricing](https://www.vokko.eu/pricing): /pricing. Humans €29/mo. Agents pay the x402 prices above.
- [Agents](https://www.vokko.eu/agents): live paid SKU catalog. Machine-readable [JSON](https://www.vokko.eu/agents.json).

## Micro-SKUs

- `pay_preflight` ($0.001 USDC): Can an agent pay at this host? Rails, endpoint, price, freshness. Example: `https://www.vokko.eu/api/v1/hosts/allbirds.com/pay-preflight?intent=any`. MCP tool `pay_preflight`.
- `endpoint_health` ($0.001 USDC): Is this paid API up, and what does it charge right now? Example: `https://www.vokko.eu/api/v1/endpoints/health?method=GET&url=https%3A%2F%2Fallbirds.com%2Fapi`. MCP tool `endpoint_health`.
- `provider_finder` ($0.005 USDC): Cheapest live x402 providers for a task. Placement is never sold. Example: `https://www.vokko.eu/api/v1/providers/find?limit=10&q=weather`. MCP tool `find_provider`. Per-IP rate limit 60/min, then x402 verify and settle, then the tsv index query (health_status=ok and checked_at within 7 days). Empty answers still cost $0.005 and return 200 with {results: [], reason: 'no_match'}. Vokko does not guarantee third-party providers.
- `payto_check` ($0.002 USDC): Does this payTo address belong to the domain? Evidence, not a guarantee. Example: `https://www.vokko.eu/api/v1/hosts/allbirds.com/payto-check?address=0x07066Ea0e66CF277cd279eD7fBCA220ecB41E5a4&network=eip155%3A8453`. MCP tool `payto_check`.
- `receipt_verify` ($0.001 USDC): Did this USDC transfer settle to the expected address and amount? Example: `https://www.vokko.eu/api/v1/receipts/0x036101ac841613d67f9cf37bd262eb1c55654cb32a68564ddaf00b121af4f59e/verify?amount=1000&asset=USDC&network=eip155%3A8453&payTo=0x07066ea0e66cf277cd279ed7fbca220ecb41e5a4`. MCP tool `verify_receipt`.

## Discovery

- [Methodology](https://www.vokko.eu/methodology): cell → spec → probe → what we never do.
- [A2A agent card](https://www.vokko.eu/.well-known/agent-card.json)
- [ERC-8004 agent registration](https://www.vokko.eu/.well-known/agent-registration.json): static registration-v1 JSON. `registrations` is empty.
- [x402 discovery (Vokko's own paywall)](https://www.vokko.eu/.well-known/x402): host `/refresh`, protocol refresh, batch at N=1 (`$0.01 + $0.002×N`, amount 12000), then live micro-SKUs. Each `accepts` matches that route's live 402.
- Registry manifests `server.json` and `glama.json` exist in the git repo. Published to the official MCP Registry as `eu.vokko/vokko` 0.1.9 (2026-10-14) and listed on [Glama](https://glama.ai/mcp/connectors/eu.vokko/vokko).
- [MCP Registry domain proof](https://www.vokko.eu/.well-known/mcp-registry-auth): static `text/plain` `v=MCPv1` ed25519 public key. Private key is not in the repo.

## Identity

User-Agent: VokkoBot/0.1 (+https://vokko.eu/methodology; multi-protocol capability probe)