# allium probes, 2026-09-28T18:04Z, from a cloud container (one IP), no credentials, no payment # Responses are cut at 6000 bytes (initialize), 20000 (tools/list), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential. ## 1. MCP initialize, POST https://mcp.allium.so/ $ curl -sS -i -m 25 -X POST https://mcp.allium.so/ -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '' HTTP/1.1 200 Connection Established HTTP/2 401 www-authenticate: Bearer resource_metadata="https://mcp.allium.so/.well-known/oauth-protected-resource" x-cloud-trace-context: 9fa563f55dfde1aa41fbb8a156852740 set-cookie: GAESA=[redacted by the prober: a session cookie, never published] date: Mon, 28 Sep 2026 18:04:41 GMT content-type: text/html server: Google Frontend content-length: 0 via: 1.1 google alt-svc: h3=":443"; ma=2592000 ## 2. Protected-resource metadata, GET https://mcp.allium.so/.well-known/oauth-protected-resource HTTP/1.1 200 Connection Established HTTP/2 200 cache-control: public, max-age=3600 content-type: application/json x-cloud-trace-context: c29d8215f64ebc4f3fc5ee0a04fc28f9 set-cookie: GAESA=[redacted by the prober: a session cookie, never published] date: Mon, 28 Sep 2026 18:04:42 GMT server: Google Frontend content-length: 156 via: 1.1 google alt-svc: h3=":443"; ma=2592000 {"resource":"https://mcp.allium.so/","authorization_servers":["https://mcp.allium.so/"],"scopes_supported":["openid"],"bearer_methods_supported":["header"]} ## 3. Authorization-server metadata, GET https://mcp.allium.so/.well-known/oauth-authorization-server HTTP/1.1 200 Connection Established HTTP/2 200 cache-control: public, max-age=3600 content-type: application/json x-cloud-trace-context: 46904e368ab97a6a844a786f515a97bf set-cookie: GAESA=[redacted by the prober: a session cookie, never published] date: Mon, 28 Sep 2026 18:04:44 GMT server: Google Frontend content-length: 526 via: 1.1 google alt-svc: h3=":443"; ma=2592000 {"issuer":"https://mcp.allium.so/","authorization_endpoint":"https://mcp.allium.so/authorize","token_endpoint":"https://mcp.allium.so/token","registration_endpoint":"https://mcp.allium.so/register","scopes_supported":["openid"],"response_types_supported":["code"],"grant_types_supported":["authorization_code","refresh_token"],"token_endpoint_auth_methods_supported":["client_secret_post","client_secret_basic","private_key_jwt","none"],"code_challenge_methods_supported":["S256"],"client_id_metadata_document_supported":true} ## 4. REST, GET https://agents.allium.so/api/v1/supported-chains/realtime-apis/simple, no Authorization header HTTP/1.1 200 Connection Established HTTP/2 200 date: Mon, 28 Sep 2026 18:04:47 GMT content-type: application/json server: cloudflare vary: Accept-Encoding strict-transport-security: max-age=31536000; includeSubDomains via: 1.1 google cf-cache-status: DYNAMIC x-content-type-options: nosniff cf-ray: a424ac28cc862520-BOS {"/api/v1/developer/wallet/balances/history":["arbitrum","avalanche","bsc","base","bitcoin","celo","ethereum","near","optimism","polygon","robinhood","solana","stellar","unichain","x_layer"],"/api/v1/developer/wallet/balances":["arbitrum","arc","avalanche","bsc","base","bitcoin","celo","ethereum","hyperevm","monad","near","optimism","polygon","robinhood","solana","stellar","unichain","x_layer","xdc_network"],"/api/v1/developer/wallet/transactions":["arbitrum","arc","avalanche","bsc","base","bitcoin","celo","ethereum","hyperevm","monad","near","optimism","polygon","robinhood","solana","stellar","unichain","x_layer","xdc_network"],"/api/v1/developer/wallet/pnl":["arbitrum","avalanche","bsc","base","bitcoin","celo","ethereum","hyperevm","monad","optimism","polygon","robinhood","solana","unichain","x_layer","zksync"],"/api/v1/developer/wallet/holdings/history":["arbitrum","avalanche","bsc","base","bitcoin","celo","ethereum","hyperevm","monad","optimism","polygon","solana","unichain","zksync"],"/api/v1/developer/prices/history":["arbitrum","avalanche","bsc","base","celo","ethereum","hyperevm","optimism","polygon","robinhood","solana","unichain","zksync"],"/api/v1/developer/prices":["arbitrum","avalanche","bsc","base","celo","ethereum","hyperevm","optimism","polygon","robinhood","solana","unichain","zksync"],"/api/v1/developer/prices/stats":["arbitrum","avalanche","bsc","base","celo","ethereum","hyperevm","optimism","polygon","robinhood","solana","unichain","zksync"],"/api/v1/developer/prices/at-timestamp":["arbitrum","avalanche","bsc","base","celo","ethereum","hyperevm","optimism","polygon","robinhood","solana","unichain","zksync"],"/api/v1/developer/tokens/transfers":["arbitrum","avalanche","bsc","base","celo","ethereum","hyperevm","monad","optimism","polygon","robinhood","solana","stellar","unichain","x_layer","zksync"],"/api/v1/developer/tokens":["arbitrum","base","ethereum","near","optimism","polygon","solana","stellar"],"/api/v1/developer/tokens/search":["arbitrum","base","ethereum","near","optimism","polygon","solana","stellar"],"/api/v1/developer/trading/hyperliquid/info/fills":["hyperevm"],"/api/v1/developer/trading/hyperliquid/info/order/history":["hyperevm"],"/api/v1/developer/trading/hyperliquid/info/order/status":["hyperevm"],"/api/v1/developer/trading/hyperliquid/info":["hyperevm"],"/api/v1/developer/wallet/positions":["arbitrum","avalanche","bsc","base","celo","ethereum","hyperliquid","monad","optimism","polygon","solana","unichain","x_layer"]} # Part B: hand-made requests, 2026-09-28 from 18:0xZ, no credentials, no payment. Part A above is the same script that produced probes-0631Z.txt this morning. ## B1. POST https://mcp.allium.so/ tools/call get_realtime_supported_chains, no credentials $ curl -sS -i -m 25 -X POST https://mcp.allium.so/ -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_realtime_supported_chains","arguments":{}}}' HTTP/1.1 200 Connection Established HTTP/2 401 www-authenticate: Bearer resource_metadata="https://mcp.allium.so/.well-known/oauth-protected-resource" x-cloud-trace-context: [redacted by the prober: a per-request trace id] set-cookie: GAESA=[redacted by the prober: a session cookie, never published] date: Mon, 28 Sep 2026 18:06:18 GMT content-type: text/html server: Google Frontend content-length: 0 via: 1.1 google alt-svc: h3=":443"; ma=2592000 ## B1. POST https://mcp.allium.so/ tools/call realtime_get_supported_chains, no credentials $ curl -sS -i -m 25 -X POST https://mcp.allium.so/ -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"realtime_get_supported_chains","arguments":{}}}' HTTP/1.1 200 Connection Established HTTP/2 401 www-authenticate: Bearer resource_metadata="https://mcp.allium.so/.well-known/oauth-protected-resource" x-cloud-trace-context: [redacted by the prober: a per-request trace id] set-cookie: GAESA=[redacted by the prober: a session cookie, never published] date: Mon, 28 Sep 2026 18:06:18 GMT content-type: text/html server: Google Frontend content-length: 0 via: 1.1 google alt-svc: h3=":443"; ma=2592000 ## B2. POST https://mcp.allium.so/ tools/list, no credentials, no session header HTTP/1.1 200 Connection Established HTTP/2 401 www-authenticate: Bearer resource_metadata="https://mcp.allium.so/.well-known/oauth-protected-resource" x-cloud-trace-context: [redacted by the prober: a per-request trace id] set-cookie: GAESA=[redacted by the prober: a session cookie, never published] date: Mon, 28 Sep 2026 18:06:19 GMT content-type: text/html server: Google Frontend content-length: 0 via: 1.1 google alt-svc: h3=":443"; ma=2592000 ## B3. POST https://mcp-oauth.allium.so/ MCP initialize, no credentials HTTP/1.1 200 Connection Established HTTP/2 401 www-authenticate: Bearer resource_metadata="https://mcp-oauth.allium.so/.well-known/oauth-protected-resource" x-cloud-trace-context: [redacted by the prober: a per-request trace id] set-cookie: GAESA=[redacted by the prober: a session cookie, never published] date: Mon, 28 Sep 2026 18:06:20 GMT content-type: text/html server: Google Frontend content-length: 0 via: 1.1 google alt-svc: h3=":443"; ma=2592000 ## B4. GET https://mcp-oauth.allium.so/.well-known/oauth-protected-resource HTTP/1.1 200 Connection Established HTTP/2 200 cache-control: public, max-age=3600 content-type: application/json x-cloud-trace-context: [redacted by the prober: a per-request trace id] set-cookie: GAESA=[redacted by the prober: a session cookie, never published] date: Mon, 28 Sep 2026 18:06:20 GMT server: Google Frontend content-length: 168 via: 1.1 google alt-svc: h3=":443"; ma=2592000 {"resource":"https://mcp-oauth.allium.so/","authorization_servers":["https://mcp-oauth.allium.so/"],"scopes_supported":["openid"],"bearer_methods_supported":["header"]} ## B5. GET https://agents.allium.so/api/v1/developer/tokens/search?q=usdc, no wallet, no payment HTTP/1.1 200 Connection Established HTTP/2 402 date: Mon, 28 Sep 2026 18:06:22 GMT content-type: application/json server: cloudflare www-authenticate: Payment id="[elided by the prober: an ephemeral per-response challenge id]", realm="agents.allium.so", method="tempo", intent="charge", request="[elided by the prober: base64 of the MPP challenge; it decodes to amount 30000 for the token search and 20000 for prices, chain id 4217, a recipient address, a five-minute expiry, and extra.stripe_mode custody with a Stripe payment intent id, which is elided for the same reason]" payment-required: [elided by the prober: base64 of the x402 document, several thousand characters, cut by this transcript's byte limit. Decoded from the bytes as received: x402Version 2, scheme exact, four accepts at eip155:8453 (Base), solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp, eip155:196 (X Layer) and eip155:137 (Polygon), all at 30000 units for /tokens/search and 20000 for /prices, resource url the endpoint itself, extra.stripe_payment_intent_id and stripe_mode custody on the Base and Solana entries only. Identical to the 06:32Z reading in probes-0631Z.txt] ## B6. POST https://agents.allium.so/api/v1/developer/prices body {"addresses":[]}, no payment HTTP/1.1 200 Connection Established HTTP/2 402 date: Mon, 28 Sep 2026 18:06:23 GMT content-type: application/json server: cloudflare www-authenticate: Payment id="[elided by the prober: an ephemeral per-response challenge id]", realm="agents.allium.so", method="tempo", intent="charge", request="[elided by the prober: base64 of the MPP challenge; it decodes to amount 30000 for the token search and 20000 for prices, chain id 4217, a recipient address, a five-minute expiry, and extra.stripe_mode custody with a Stripe payment intent id, which is elided for the same reason]" payment-required: [elided by the prober: base64 of the x402 document, several thousand characters, cut by this transcript's byte limit. Decoded from the bytes as received: x402Version 2, scheme exact, four accepts at eip155:8453 (Base), solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp, eip155:196 (X Layer) and eip155:137 (Polygon), all at 30000 units for /tokens/search and 20000 for /prices, resource url the endpoint itself, extra.stripe_payment_intent_id and stripe_mode custody on the Base and Solana entries only. Identical to the 06:32Z reading in probes-0631Z.txt]