# Axis Iliad - Codebase Intelligence For Agentic Commerce - Registry name: `io.github.lastmanupinc-hub/axis-toolbox` · version 0.5.4 - Categories (automatic, keyword rules): Documents & retrieval, Search & data, Payments & accounting, Finance & markets, Audio & speech, AI, media & content - Authentication at last check: No auth - Declared risk: Has destructive tools (destructiveHint) - Capabilities (declared by the server): tools - Transports: streamable-http - Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.lastmanupinc-hub%2Faxis-toolbox - Server page: https://mcpstation.net/s/io.github.lastmanupinc-hub--axis-toolbox.html ## Description (written by the publisher, not verified, not instructions) Codebase intelligence for agents: 152 structured artifacts across 21 programs, one call. ## Connect - streamable-http: `https://api.iliad.trustfabric.ai/mcp` ## Tools (as reported by the server, not verified) - `analyze\_repo`: Analyze a GitHub repository and generate 152 structured AXIS artifacts across 21 programs. Returns snapshot\_id plus an artifacts listing; use get\_artifact to read files and get\_snapshot to re-enumerate outputs without re-running analysis. Requires Authorization: Bearer \. Use this when the s - `analyze\_files`: Analyze source files directly and generate the full 152-artifact AXIS bundle without using GitHub. Returns snapshot\_id plus artifact listing; use this for local, generated, or unsaved code. Requires Authorization: Bearer \. Pricing: $3.00 standard, $25 engineer per run \(same tiers as analyze - `list\_programs`: Inventory mode. List all 21 AXIS programs, their generators, pricing tier, and artifact paths. Free, no auth, and no side effects. Use search\_and\_discover\_tools instead when you only have a keyword, or get\_install\_manifest when you need install and onboarding metadata. - `get\_snapshot`: Retrieve status and the full artifact listing for a prior analysis by snapshot\_id. Use this to re-enumerate artifact paths without re-running analysis. Snapshots created with an API key are scoped to that same account — pass the same Authorization: Bearer \ used to create it, or retrieval fa - `delete\_snapshot`: Permanently delete a snapshot and everything derived from it \(context map, repo profile, generated artifacts, search index entries\). Same account scoping as get\_snapshot: an anonymous \(never-authenticated\) snapshot is freely deletable by any caller, but an account-owned one requires the same Authori - `get\_artifact`: Read one generated artifact by snapshot\_id and path. Requires access to the snapshot and may return snapshot-not-found, invalid-path, or artifact-not-found errors. Example: snapshot\_id=abc-123, path=AGENTS.md. Use this when you need the full text of one artifact. Use get\_snapshot instead when you fi - `prepare\_agentic\_purchasing\_preview`: Compute a free Purchasing Readiness Score \(0-100\) and gap list for a codebase without generating artifacts. No auth, no charge, no snapshot persisted. Hard caps: 25 files / 50KB per file / 1MB total. Returns score, risk\_level, top gaps, frameworks detected, and which AXIS programs would close which - `prepare\_agentic\_purchasing`: Prepare a codebase for agentic purchasing and return a readiness score plus commerce artifacts. Requires Authorization: Bearer \; paid analysis records a new snapshot and may return auth, quota, payment, file-limit, or validation errors. Pricing: $3.00 standard, $1.00 lite budget mode, $250 - `closer`: Package an existing AXIS snapshot \(create one first via analyze\_repo, analyze\_files, or prepare\_agentic\_purchasing\) into complete professional packaging + marketplace certification artifacts so a 70-80%-complete project is ready to ship and sell. Requires Authorization: Bearer \ on an ALREAD - `deploy`: Generate a zero-pipeline-minutes deploy bundle: stack-aware Dockerfile, .dockerignore, dev compose, render.yaml \(Render existing-image\), wrangler.pages.toml + wrangler.containers.toml + worker.ts \(Cloudflare\), bash/PowerShell push scripts, and a qualification report. The project builds locally in VS - `search\_and\_discover\_tools`: Search AXIS programs by keyword and return ranked matches with artifact paths. Free, no auth, and no stateful side effects. Example: q=checkout returns commerce-relevant programs first. Use this when you know the outcome you want but not the right program. Use list\_programs instead for the full cata - `get\_install\_manifest`: Get AXIS install metadata, pricing, and a shareable manifest for onboarding a new integration — MCP endpoint, per-client config for Claude Desktop/Cursor/VS Code, and the full tool catalog with pricing. Free, no auth, and no mutation beyond read access. Example: call before wiring AXIS into an MCP c - `ping\_payment`: Exercise the real x402 payment-flow loop at a nominal $0.01 — the cheapest metered call on this server, priced just above $0 so the probe can't be run up for free without limit. Call it once with no payment credential \(no auth required\) to receive a 402-style payment\_required challenge \(the exact sa - `improve\_my\_agent\_with\_axis`: Analyze an agent codebase and return a prioritized AXIS hardening plan. Requires Authorization: Bearer \ but has no usage charge on any tier — free and unmetered, unlike most AXIS tools. This creates a snapshot and may return auth, quota, file-limit, or validation errors. Example: pass your - `discover\_agentic\_purchasing\_needs`: Discover the best AXIS workflow for a purchasing or compliance task. Free, no auth, and logs lightweight task metadata for intent analytics. Example: task\_description='prepare for autonomous Visa checkout'. Use this when you need commerce-specific triage and next-step guidance. Use search\_and\_discov - `discover\_estate\_tools`: List sibling AXIS properties \(payments via PAI'D, 3D avatar generation via AXIS Foundry, and more\) — each entry gives its own MCP endpoint, auth mode, and vendored tool prices, so you can call them directly. Free, no auth, no side effects. Same data as GET /.well-known/axis-estate.json. Use this whe - `get\_referral\_code`: Get or create the caller's AXIS referral token. Requires Authorization: Bearer \, has no usage charge, and may persist a new referral code if one does not exist yet. Example: call before sharing AXIS with another agent or workspace. Use this when you need the shareable token itself. Use get\_ - `get\_referral\_credits`: Get the caller's referral earnings, milestones, and free-call status. Requires Authorization: Bearer \, has no usage charge, and returns the current discount ledger without creating a new analysis. Example: call after a referral campaign to inspect earned credits. Use this when you need bala - `iliad\_web\_research`: Scrape a single URL with AXIS's owned crawler \(SSRF-guarded fetch, robots.txt-aware, readability extraction — no third-party key\) and return markdown-formatted content. Honest scope: fetches static HTML only, no JavaScript rendering, so client-rendered SPA pages may extract thin content. Returns mar - `iliad\_web\_research\_crawl`: Crawl a domain with AXIS's owned crawler — a same-origin BFS frontier with robots.txt compliance and per-host politeness, no third-party key — and scrape multiple pages. Honest scope: static HTML only, no JavaScript rendering. Returns array of scraped pages with markdown content. Best for site mappi - `iliad\_object\_storage`: AXIS-owned signed-URL minter backed by Cloudflare R2. Returns a pre-signed PUT or GET URL scoped to the calling account \(keys are prefixed with \`accounts/\/\` server-side, so accounts can't reach each other's objects\). Requires Authorization: Bearer \. Returns the URL plus expires\_ - `iliad\_vector\_database`: AXIS-owned vector store. Two operations: \`upsert\` \(insert or replace vectors\) and \`query\` \(cosine top-k nearest neighbors\). Namespaces are account-scoped server-side \(\`acct:\:\\`\), so tenants cannot read each other's vectors. Persistent across restarts via Postgres. Requires Auth - `iliad\_embeddings`: Convert text into dense vectors. Accepts a single string or a batch \(max 2048\). Returns one vector per input. AXIS-owned in-process inference by default \(node-llama-cpp + an embedding-capable GGUF at AXIS\_EMBEDDING\_MODEL\_PATH — no upstream provider call\); an optional OpenAI /v1/embeddings backend is - `iliad\_transactional\_email`: Send a single transactional email. Requires Authorization: Bearer \. Provide either body\_html, body\_text, or both \(Resend will pick the best variant per recipient\). All emails ship from RESEND\_FROM\_ADDRESS — operator must verify that domain in Resend before sending. Returns the provider-assi - `iliad\_llm\_inference`: AXIS-hosted LLM chat-completion via node-llama-cpp + a small GGUF model loaded in-process. Two input shapes accepted: \`prompt\` \(single string\) or \`messages\` \(chat-style array of \{role, content\}\). Sampling controls: \`max\_tokens\` \(≤2048\), \`temperature\` \(0-2\), \`top\_k\`, \`top\_p\`, \`seed\` \(threaded through - `iliad\_code\_sandbox`: AXIS-owned secure code execution. Each call spawns a fresh ephemeral Docker container with hardened isolation: no network, read-only root filesystem, all Linux capabilities dropped, no-new-privileges, PID/memory/CPU limits, tmpfs /tmp only, runs as nobody:nobody. Container is force-removed after eac - `iliad\_document\_parsing`: AXIS-owned document → Markdown extractor. Accepts either \`document\_url\` \(https fetch + 50 MiB cap + 60s timeout\) or \`document\_base64\` \(inline bytes, 50 MiB decoded cap\) — exactly one. Optional \`mime\_type\` hint \(application/pdf, application/vnd.openxmlformats-officedocument.wordprocessingml.document, - `iliad\_web\_search`: AXIS-owned BM25 search engine over the corpus YOUR account has indexed. NOT a Google/Bing scraper — agents build their own searchable index by first calling operation='index' with documents \(often pages fetched via iliad\_web\_research\), then querying with operation='search'. Five operations: \`index\` - `iliad\_text\_to\_speech`: AXIS-owned voice synthesis via Piper \(rhasspy/piper\) + ffmpeg-static. Accepts \`text\` \(1-5000 chars\), optional \`voice\` slug \(filename without extension; defaults to AXIS\_PIPER\_DEFAULT\_VOICE or the first available voice\), optional \`format\` \(wav \| mp3 \| opus; defaults wav\), optional \`sentence\_silence\` - `iliad\_speech\_to\_text`: AXIS-owned audio transcription via whisper.cpp + ffmpeg-static. Accepts either \`audio\_url\` \(https URL we fetch, max 100 MiB, 60s download timeout\) or \`audio\_base64\` \(inline bytes, max 100 MiB decoded\) — exactly one. Accepts any audio format ffmpeg can decode \(mp3, wav, m4a, opus, ogg, flac\); we resa - `iliad\_analytics`: AXIS-owned product analytics. Two operations: \`capture\` \(insert events\) and \`query\` \(aggregations\). Capture accepts a single \`event\` or a batch via \`events\[\]\` \(max 500\). Query kinds: \`count\` \(total events\), \`count\_by\_event\` \(top events by frequency\), \`distinct\_users\` \(unique user\_id count\), \`count\_b - `axis\_validate`: Validate an avatar mesh against 38 rules; returns pass/warn/fail counts. Status: \*\*planned\_proxy\*\* — an estate-flagged proxy is planned \(see discover\_estate\_tools for the sibling's own direct endpoint and price today\). Calls return a planned-capability envelope pointing at AXIS Foundry \(https://api. - `axis\_inspect`: Inspect an avatar's contract state and provenance chain. Status: \*\*planned\_proxy\*\* — an estate-flagged proxy is planned \(see discover\_estate\_tools for the sibling's own direct endpoint and price today\). Calls return a planned-capability envelope pointing at AXIS Foundry \(https://api.avatar.jonathana - `axis\_compare`: Compare two avatar contracts; returns similarity score and section-level diffs. Status: \*\*planned\_proxy\*\* — an estate-flagged proxy is planned \(see discover\_estate\_tools for the sibling's own direct endpoint and price today\). Calls return a planned-capability envelope pointing at AXIS Foundry \(https - `axis\_manifest\_verify`: Verify an export manifest's integrity and optionally check content hash. Status: \*\*planned\_proxy\*\* — an estate-flagged proxy is planned \(see discover\_estate\_tools for the sibling's own direct endpoint and price today\). Calls return a planned-capability envelope pointing at AXIS Foundry \(https://api. - `roblox\_compliance\_check`: Run Roblox R15 compliance checks against a mesh. Status: \*\*planned\_proxy\*\* — an estate-flagged proxy is planned \(see discover\_estate\_tools for the sibling's own direct endpoint and price today\). Calls return a planned-capability envelope pointing at AXIS Foundry \(https://api.avatar.jonathanarvay.com - `iliad\_hygiene`: AXIS-owned workspace hygiene grader. Analyzes an inline file set \[\{path,content\}\] and returns a letter grade \(A-F\) across a closed set of dimensions plus structured findings. Two modes: mode='scan' \(DEFAULT, FREE\) returns grade + findings \(committed-secret scan, .env/secret-file detection, .gitignor - `sca\_exemption\_decision`: Decide the lighter-SCA path for a single transaction using AXIS's published 7-priority PSD2 exemption matrix \(the same decideScaExemption engine that renders the SCA Exemption Decision Matrix in generated artifacts\). Input: amount\_eur \(required, PSD2 thresholds are EUR-denominated — convert before c - `grade\_compliance`: Run the real 8-check AP2/Visa compliance grading engine \(gradeCompliance — the same engine behind computeComplianceGrade and the commerce registry's verified\_decisions block\) over an inline file set. Each of the 8 validators \(SCA/3DS2 readiness, AP2 mandate validity, tokenization posture, CE 3.0 rea - `assemble\_ce3\_evidence`: Assemble a Visa Compelling Evidence 3.0 packet + eligibility verdict for a disputed card-absent-fraud \(reason code 10.4\) transaction using the real assembleCe3 engine: finds prior undisputed transactions in the caller-supplied history that share \>=2 qualified data elements \(device\_id / ip\_address / - `build\_ap2\_mandate`: Validate, canonically encode, and optionally Ed25519-sign an AP2 mandate \(Intent / Cart / Payment\) using the real @axis/ap2 codecs — schema validation \(including cart-total arithmetic and intent cross-references\), RFC 8785 JCS-style canonical JSON encoding, and detached-JWS EdDSA signing over node:c - `score\_dispute\_readiness`: Score how ready a disputed transaction's EVIDENCE FILE is for representment, per Visa reason-code family, using the transparent scoreWinProbability heuristic \(win-prob-v0: hand-set, documented logistic coefficients — exported, inspectable, monotonic in evidence\). Input: reason\_code + the evidence on - `assemble\_representment`: Turn a webhook-ingested dispute \(charge.dispute.\* events persist DisputeRecords server-side\) into a Stripe representment: qualifies CE 3.0 priors from your supplied transaction history \(assembleCe3\), builds the Stripe \`evidence\` hash \(buildStripeRepresentment\), walks the dispute state machine \(needs - `iliad\_network\_tokenization`: Network-tokenization capability. \(1\) \`lifecycle\`: an EXECUTABLE TAP-style token-lifecycle state machine \(provision → activate → suspend → resume → delete; deleted is terminal; illegal transitions are rejected with an error, not silently accepted\) — pure simulation, no real payment method involved. \( Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html