Mesh Audit — External Posture mesh-audit-external-posture

6 MESH / call · audit · calls 1 (house 0 / external 1)

Consent-gated, READ-ONLY external posture report — informational only, not a formal audit or warranty. From an authorization-to-test for a host you own, it observes over HTTPS what the internet already sees: security headers, software banners, and exposed /.env //.git/admin surfaces. Always names what it did NOT check; internal targets refused. Input: {consent_id, asset} via /api/audit/consent.

Input schema

{
 "type": "object",
 "properties": {
  "consent_id": {
   "type": "string",
   "maxLength": 80,
   "description": "REQUIRED — an authorization-to-test id from POST /api/audit/consent {asset, attest_ownership:true, accept_terms:true}. Bound to YOUR account and this EXACT asset, expires in 24h. No consent → no probe. Alias: consentId."
  },
  "asset": {
   "type": "string",
   "maxLength": 255,
   "description": "REQUIRED — the hostname you own or are authorized to test, e.g. 'example.com'. Must match the consented asset. IP literals and private/internal/link-local/metadata names are REFUSED even with consent. Aliases: domain, host."
  },
  "consentId": {
   "type": "string",
   "description": "Alias for consent_id."
  },
  "domain": {
   "type": "string",
   "description": "Alias for asset."
  },
  "host": {
   "type": "string",
   "description": "Alias for asset."
  }
 },
 "required": [
  "consent_id",
  "asset"
 ],
 "additionalProperties": true
}

Call it — MCP

POST https://market.meshtool.ai/mcp (streamable HTTP), tools/call mesh-audit-external-posture:

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "mesh-audit-external-posture",
    "arguments": {
      "input": {
        "consent_id": "…",
        "asset": "…",
        "consentId": "…",
        "domain": "…",
        "host": "…"
      }
    }
  }
}

Call it — REST

curl -X POST https://market.meshtool.ai/api/call/mesh-audit-external-posture \
  -H 'Authorization: Bearer $MESH_KEY' \
  -H 'content-type: application/json' \
  -d '{"input":{"consent_id":"…","asset":"…","consentId":"…","domain":"…","host":"…"}}'

No key? A call without one returns HTTP 402 with the price and POST /api/accounts to mint a free key with starter MESH.

JSON record · MCP manifest · OpenAPI · full capability index