# coingecko probes, 2026-09-28T18:23Z, from a cloud container (one IP), no credentials, no payment # Responses are cut at 6000 bytes (initialize), 20000 (tools/list), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential. ## 1. MCP initialize, POST https://mcp.api.coingecko.com/mcp $ curl -sS -i -m 25 -X POST https://mcp.api.coingecko.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '' HTTP/1.1 200 Connection Established HTTP/2 200 date: Mon, 28 Sep 2026 18:23:09 GMT content-type: text/event-stream access-control-allow-origin: * cache-control: no-cache access-control-allow-headers: Content-Type, Accept, Authorization, mcp-session-id, mcp-protocol-version access-control-allow-methods: GET, POST, DELETE, OPTIONS access-control-expose-headers: mcp-session-id access-control-max-age: 86400 mcp-session-id: [redacted by the prober: a per-session id, reused for step 1b only] server: cloudflare cf-ray: a424c7106882bc53-BOS alt-svc: h3=":443"; ma=86400 event: message data: {"result":{"protocolVersion":"2025-06-18","capabilities":{"tools":{},"logging":{}},"serverInfo":{"name":"coingecko_coingecko_typescript_api","version":"8.1.0"},"instructions":"\n This is the coingecko MCP server.\n\n Available tools:\n - search_docs: Search SDK documentation to find the right methods and parameters.\n - execute: Run TypeScript code against a pre-authenticated SDK client. Define an async run(client) function.\n\n Workflow:\n - If unsure about the API, call search_docs first.\n - Write complete solutions in a single execute call when possible. For large datasets, use API filters to narrow results or paginate within a single execute block.\n - If execute returns an error, read the error and fix your code rather than retrying the same approach.\n - Variables do not persist between execute calls. Return or log all data you need.\n - Individual HTTP requests to the API have a 30-second timeout. If a request times out, try a smaller query or add filters.\n - Code execution has a total timeout of approximately 5 minutes. If your code times out, simplify it or break it into smaller steps.\n "},"jsonrpc":"2.0","id":1} ## 1b. MCP tools/list, POST https://mcp.api.coingecko.com/mcp (initialize answered 200; the session id from step 1 is sent back when the server issued one) $ curl -sS -i -m 25 -X POST https://mcp.api.coingecko.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -H 'MCP-Protocol-Version: 2025-06-18' [-H 'Mcp-Session-Id: '] -d '' # tools counted over the whole response before the cut, by occurrences of "inputSchema": 2 (0 means no list came back) HTTP/1.1 200 Connection Established HTTP/2 200 date: Mon, 28 Sep 2026 18:23:09 GMT content-type: text/event-stream access-control-allow-origin: * cache-control: no-cache access-control-allow-headers: Content-Type, Accept, Authorization, mcp-session-id, mcp-protocol-version access-control-allow-methods: GET, POST, DELETE, OPTIONS access-control-expose-headers: mcp-session-id access-control-max-age: 86400 mcp-session-id: [redacted by the prober: a per-session id] server: cloudflare cf-ray: a424c716fc1878bc-BOS alt-svc: h3=":443"; ma=86400 event: message data: {"result":{"tools":[{"name":"execute","description":"Runs JavaScript code to interact with the Coingecko API.\n\nYou are a skilled TypeScript programmer writing code to interface with the service.\nDefine an async function named \"run\" that takes a single parameter of an initialized SDK client and it will be run.\nFor example:\n\n```\nasync function run(client) {\n const price = await client.simple.price.get({ vs_currencies: 'usd', ids: 'bitcoin' });\n}\n```\n\nYou will be returned anything that your function returns, plus the results of any console.log statements.\nDo not add try-catch blocks for single API calls. The tool will handle errors for you.\nDo not add comments unless necessary for generating better code.\nCode will run in a container, and cannot interact with the network outside of the given SDK client.\nVariables will not persist between calls, so make sure to return or log any data you might need later.\nRemember that you are writing TypeScript code, so you need to be careful with your types.\nAlways type dynamic key-value stores explicitly as Record instead of {}.","inputSchema":{"type":"object","properties":{"code":{"type":"string","description":"Code to execute."},"intent":{"type":"string","description":"Task you are trying to perform. Used for improving the service."}},"required":["code"]},"annotations":{"readOnlyHint":true}},{"name":"search_docs","description":"Search SDK documentation to find methods, parameters, and usage examples for interacting with the API. Use this before writing code when you need to discover the right approach.","inputSchema":{"type":"object","properties":{"query":{"type":"string","description":"The query to search for."},"language":{"type":"string","description":"The language for the SDK to search for.","enum":["http","python","go","typescript","javascript","terraform","ruby","java","kotlin"]},"detail":{"type":"string","description":"The amount of detail to return.","enum":["default","verbose"]}},"required":["query","language"]},"annotations":{"readOnlyHint":true}}]},"jsonrpc":"2.0","id":2} ## 2. Protected-resource metadata, GET https://mcp.api.coingecko.com/.well-known/oauth-protected-resource/mcp (not named in the challenge; the path-aware well-known URI, the first fallback the specification names) HTTP/1.1 200 Connection Established HTTP/2 404 date: Mon, 28 Sep 2026 18:23:10 GMT content-type: text/plain; charset=UTF-8 content-length: 13 server: cloudflare cf-ray: a424c71ccc9029a9-BOS alt-svc: h3=":443"; ma=86400 404 Not Found ## 2b. Protected-resource metadata, GET https://mcp.api.coingecko.com/.well-known/oauth-protected-resource (the root well-known URI, the second fallback; tried because step 2 answered 404, not 200) HTTP/1.1 200 Connection Established HTTP/2 404 date: Mon, 28 Sep 2026 18:23:11 GMT content-type: text/plain; charset=UTF-8 content-length: 13 server: cloudflare cf-ray: a424c720cf57188c-BOS alt-svc: h3=":443"; ma=86400 404 Not Found ## 3. Authorization-server metadata: no authorization_servers in step 2 ## 4. REST, GET https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd, no Authorization header HTTP/1.1 200 Connection Established HTTP/2 200 date: Mon, 28 Sep 2026 18:23:12 GMT content-type: application/json; charset=utf-8 server: cloudflare x-frame-options: SAMEORIGIN x-xss-protection: 0 x-content-type-options: nosniff x-permitted-cross-domain-policies: none referrer-policy: strict-origin-when-cross-origin x-data-source: 2.0 cache-control: max-age=30, public, must-revalidate, s-maxage=60 access-control-allow-origin: * access-control-allow-methods: POST, PUT, DELETE, GET, OPTIONS access-control-request-method: * access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization access-control-expose-headers: link, per-page, total vary: Accept-Encoding, Origin etag: W/"48d78bb8a8129bd8be9066be75038ea3" x-request-id: 76195ce5-3ee6-4902-904f-16bcb75e3175 x-runtime: 0.006348 content-security-policy-report-only: script-src https://accounts.google.com/gsi/client; frame-src https://accounts.google.com/gsi/; connect-src https://accounts.google.com/gsi/; strict-transport-security: max-age=600 strict-transport-security: max-age=15724800; includeSubdomains age: 20 cf-cache-status: HIT cf-ray: a424c72468464cf8-BOS alt-svc: h3=":443"; ma=86400 {"bitcoin":{"usd":83900}} # Part B: hand-made requests, 2026-09-28 18:2xZ, no credentials, no payment ## B1. GET https://pro-api.coingecko.com/api/v3/x402/simple/price?vs_currencies=usd&symbols=btc, no key, no wallet, no payment HTTP/1.1 200 Connection Established HTTP/2 402 date: Mon, 28 Sep 2026 18:23:36 GMT content-type: application/json; charset=utf-8 x-frame-options: SAMEORIGIN x-xss-protection: 0 x-content-type-options: nosniff x-permitted-cross-domain-policies: none referrer-policy: strict-origin-when-cross-origin x-data-source: 1.0 payment-required: eyJ4NDAyVmVyc2lvbiI6MiwicmVzb3VyY2UiOnsidXJsIjoiaHR0cHM6Ly9wcm8tYXBpLmNvaW5nZWNrby5jb20vYXBpL3YzL3g0MDIvc2ltcGxlL3ByaWNlIiwiZGVzY3JpcHRpb24iOiJRdWVyeSBwcmljZXMgXHUwMDI2IG1hcmtldCBkYXRhIG9mIGNvaW5zIGxpc3RlZCBvbiBDb2luR2Vja28sIGJ5IGNvaW4gSURzLCBuYW1lcywgb3Igc3ltYm9scy4iLCJtaW1lVHlwZSI6ImFwcGxpY2F0aW9uL2pzb24ifSwiYWNjZXB0cyI6W3sic2NoZW1lIjoiZXhhY3QiLCJuZXR3b3JrIjoiZWlwMTU1Ojg0NTMiLCJhbW91bnQiOiIxMDAwMCIsImFzc2V0IjoiMHg4MzM1ODlmQ0Q2ZURiNkUwOGY0YzdDMzJENGY3MWI1NGJkQTAyOTEzIiwicGF5VG8iOiIweDExMGNkQmJhN0ZFNjQzNEVjNENFMzQ2NENDNTIzOTQyYWQ2RmI3ODQiLCJtYXhUaW1lb3V0U2Vjb25kcyI6NjAsImV4dHJhIjp7Im5hbWUiOiJVU0QgQ29pbiIsInZlcnNpb24iOiIyIn19LHsic2NoZW1lIjoiZXhhY3QiLCJuZXR3b3JrIjoic29sYW5hOjVleWt0NFVzRnY4UDhOSmRUUkVwWTF2enFLcVpLdmRwIiwiYW1vdW50IjoiMTAwMDAiLCJhc3NldCI6IkVQakZXZGQ1QXVmcVNTcWVNMnFOMXh6eWJhcEM4RzR3RUdHa1p3eVREdDF2IiwicGF5VG8iOiI4WGhuZ1RSaXRUY1VKTWlhREo2YXp3OEdSU2lGUHB3aG5tVjNIWVFMSFVwTCIsIm1heFRpbWVvdXRTZWNvbmRzIjo2MCwiZXh0cmEiOnsiZmVlUGF5ZXIiOiJENlpodE5RNW5UOVpuVEhVYnFYWnNUeDVNSDJyUEZpQkJnZ1g0aFkxV2VQTSJ9fV0sImV4dGVuc2lvbnMiOnsiYmF6YWFyIjp7ImluZm8iOnsiaW5wdXQiOnsidHlwZSI6Imh0dHAiLCJtZXRob2QiOiJHRVQiLCJxdWVyeVBhcmFtcyI6eyJ2c19jdXJyZW5jaWVzIjoidXNkIiwiaWRzIjoiYml0Y29pbixldGhlcmV1bSIsIm5hbWVzIjoiQml0Y29pbixFdGhlcmV1bSIsInN5bWJvbHMiOiJidGMsZXRoIiwiaW5jbHVkZV90b2tlbnMiOiJ0b3AiLCJpbmNsdWRlX21hcmtldF9jYXAiOnRydWUsImluY2x1ZGVfMjRocl92b2wiOnRydWUsImluY2x1ZGVfMjRocl9jaGFuZ2UiOnRydWUsImluY2x1ZGVfbGFzdF91cGRhdGVkX2F0Ijp0cnVlLCJwcmVjaXNpb24iOiIyIn19LCJvdXRwdXQiOnsidHlwZSI6Impzb24iLCJleGFtcGxlIjp7ImJpdGNvaW4iOnsidXNkIjo2NzE4Ny4zNCwidXNkX21hcmtldF9jYXAiOjEzMTc4MDI5ODgzMjYuMjUsInVzZF8yNGhfdm9sIjozMTI2MDkyOTI5OS41MiwidXNkXzI0aF9jaGFuZ2UiOjMuNjQsImxhc3RfdXBkYXRlZF9hdCI6MTcxMTM1NjMwMH19fX0sInNjaGVtYSI6eyIkc2NoZW1hIjoiaHR0cHM6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQvMjAyMC0xMi9zY2hlbWEiLCJ0eXBlIjoib2JqZWN0IiwicHJvcGVydGllcyI6eyJpbnB1dCI6eyJ0eXBlIjoib2JqZWN0IiwicHJvcGVydGllcyI6eyJ0eXBlIjp7InR5cGUiOiJzdHJpbmciLCJjb25zdCI6Imh0dHAifSwibWV0aG9kIjp7InR5cGUiOiJzdHJpbmciLCJlbnVtIjpbIkdFVCJdfSwicXVlcnlQYXJhbXMiOnsidHlwZSI6Im9iamVjdCIsInByb3BlcnRpZXMiOnsidnNfY3VycmVuY2llcyI6eyJ0eXBlIjoic3RyaW5nIn0sImlkcyI6eyJ0eXBlIjoic3RyaW5nIn0sIm5hbWVzIjp7InR5cGUiOiJzdHJpbmcifSwic3ltYm9scyI6eyJ0eXBlIjoic3RyaW5nIn0sImluY2x1ZGVfdG9rZW5zIjp7InR5cGUiOiJzdHJpbmciLCJlbnVtIjpbInRvcCIsImFsbCJdfSwiaW5jbHVkZV9tYXJrZXRfY2FwIjp7InR5cGUiOiJib29sZWFuIn0sImluY2x1ZGVfMjRocl92b2wiOnsidHlwZSI6ImJvb2xlYW4ifSwiaW5jbHVkZV8yNGhyX2NoYW5nZSI6eyJ0eXBlIjoiYm9vbGVhbiJ9LCJpbmNsdWRlX2xhc3RfdXBkYXRlZF9hdCI6eyJ0eXBlIjoiYm9vbGVhbiJ9LCJwcmVjaXNpb24iOnsidHlwZSI6InN0cmluZyIsImVudW0iOlsiZnVsbCIsIjAiLCIxIiwiMiIsIjMiLCI0IiwiNSIsIjYiLCI3IiwiOCIsIjkiLCIxMCIsIjExIiwiMTIiLCIxMyIsIjE0IiwiMTUiLCIxNiIsIjE3IiwiMTgiXX19LCJyZXF1aXJlZCI6WyJ2c19jdXJyZW5jaWVzIl19fSwicmVxdWlyZWQiOlsidHlwZSIsIm1ldGhvZCJdLCJhZGRpdGlvbmFsUHJvcGVydGllcyI6ZmFsc2V9LCJvdXRwdXQiOnsidHlwZSI6Im9iamVjdCIsInByb3BlcnRpZXMiOnsidHlwZSI6eyJ0eXBlIjoic3RyaW5nIn0sImV4YW1wbGUiOnsidHlwZSI6Im9iamVjdCJ9fSwicmVxdWlyZWQiOlsidHlwZSIsImV4YW1wbGUiXX19LCJyZXF1aXJlZCI6WyJpbnB1dCIsIm91dHB1dCJdfX19fQ== access-control-allow-origin: * access-control-allow-methods: POST, PUT, DELETE, GET, OPTIONS access-control-request-method: * access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization access-control-expose-headers: link, per-page, total vary: Accept-Encoding, Origin cache-control: no-cache x-request-id: 945bfa5f-0970-42b9-be85-5c90106ad4cd x-runtime: 0.003918 cf-cache-status: BYPASS server: cloudflare cf-ray: [redacted by the prober: a per-request id] {"error":"Payment required","message":"Payment is required to access this resource"}