ToolTrust
C45/100
Smithery

ciprianpater-srv-d7aoqmh5pdvs7391dcqg

mcpsmithery

@Smithery

# NWO Robotics MCP Server Control real robots, IoT devices, and autonomous agent swarms through natural language — powered by the [NWO Robotics API](https://nwo.capital). --- ## What This Server Does This MCP server exposes the full NWO Robotics API as 64 ready-to-use tools. Any MCP-compatible AI agent (Claude, ChatGPT, Cursor, etc.) can use it to: - Send natural language instructions to physical robots - Run Visual-Language-Action (VLA) inference on live camera feeds - Plan, validate, and execute multi-step robot tasks - Monitor sensors, detect slip, and fuse multi-modal data - Train robots online with reinforcement learning - Register and manage agent identities on Base mainnet via the Cardiac biometric ID system No local installation needed. The server runs on Render and is ready to connect. --- ## Tools Overview ### 🤖 VLA Inference & Models Run Vision-Language-Action inference on any supported robot. Send a text instruction and camera images, receive joint action vectors in real time. Supports auto model routing, ultra-low-latency Cloudflare edge inference (28ms avg), and WebSocket streaming at up to 50Hz. `vla_inference` · `edge_inference` · `list_models` · `get_model_info` · `get_streaming_config` --- ### 🦾 Robot Control & State Query live robot state (joint angles, gripper, battery, position), execute pre-computed action sequences, and fuse camera + lidar + thermal + force + GPS sensor inputs into a single inference call. `query_robot_state` · `execute_actions` · `sensor_fusion` · `robot_query` · `get_agent_status` --- ### 🗺️ Task Planning & Learning Decompose complex instructions into ordered subtasks, execute them step by step, poll progress, and log outcomes so the model learns and improves with every run. `task_planner` · `execute_subtask` · `status_poll` · `learning_recommend` · `learning_log` --- ### 🔑 Agent Management Self-register a new AI agent in under 2 seconds, check your monthly API quota, upgrade tiers by paying ETH, and manage robot registrations and capabilities. | Tier | Calls/month | Cost | |------|-------------|------| | Free | 100,000 | $0 | | Prototype | 500,000 | ~0.015 ETH/mo | | Production | Unlimited | ~0.062 ETH/mo | `register_agent` · `check_balance` · `pay_upgrade` · `create_wallet` · `register_robot` · `update_agent` · `get_agent_info` --- ### 🔍 Agent Discovery Discover all available execution modes (mock / simulated / live), robot types, VLA models, and sensor capabilities. Validate tasks with a dry-run before committing to execution. `nwo_health` · `nwo_whoami` · `discover_capabilities` · `dry_run` · `plan_task` --- ### 🔌 ROS2 Bridge (Physical Robots) Connect directly to physical robots over the ROS2 bridge. Send joint commands, submit action sequences, and trigger emergency stops on one or all robots within 10ms. Supported: UR5e, Panda, Spot, Unitree G1, and more. `ros2_list_robots` · `ros2_robot_status` · `ros2_send_command` · `ros2_submit_action` · `ros2_emergency_stop` · `ros2_emergency_stop_all` · `ros2_get_robot_types` --- ### 🧪 Physics Simulation Simulate trajectories, check for collisions, estimate joint torques, validate grasps, and plan collision-free motions with MoveIt2 — before touching real hardware. `simulate_trajectory` · `check_collision` · `estimate_torques` · `validate_grasp` · `plan_motion` · `get_scene_library` · `generate_scene` --- ### 📐 Embodiment & Calibration Browse the robot embodiment registry (DOF, joint limits, sensors), download URDF models, get normalization parameters for VLA inference, and run automatic joint calibration. `list_embodiments` · `get_robot_specs` · `get_normalization` · `download_urdf` · `get_test_results` · `compare_robots` · `run_calibration` · `calibrate_confidence` --- ### 🧠 Online RL & Fine-Tuning Start online reinforcement learning sessions, stream state/action/reward telemetry, build fine-tuning datasets from logged runs, and launch LoRA fine-tuning jobs on any base VLA model. `start_rl_training` · `submit_rl_telemetry` · `create_finetune_dataset` · `start_finetune_job` --- ### 🖐️ Tactile Sensing (ORCA Hand) Read 256-taxel tactile sensor arrays from the ORCA robot hand, assess grip quality and object texture, and detect slip in real time to prevent dropped objects. `read_tactile` · `process_tactile` · `detect_slip` --- ### 📦 Dataset Hub Access 1.54 million+ human robot demonstrations for the Unitree G1 humanoid (430+ hours, LeRobot-compatible format) for training and fine-tuning. `list_datasets` --- ### 🫀 Cardiac Blockchain Identity (Base Mainnet) Register AI agents on Base mainnet and receive a permanent soul-bound Digital ID (`rootTokenId`). Issue verifiable credentials for task authorization, swarm control, location access, and payments — all gasless via the NWO relayer. Smart contracts deployed on Base Mainnet (Chain ID 8453): - `NWOIdentityRegistry` — `0x78455AFd5E5088F8B5fecA0523291A75De1dAfF8` - `NWOAccessController` — `0x29d177bedaef29304eacdc63b2d0285c459a0f50` - `NWOPaymentProcessor` — `0x4afa4618bb992a073dbcfbddd6d1aebc3d5abd7c` `cardiac_register_agent` · `cardiac_identify_agent` · `cardiac_renew_key` · `cardiac_issue_credential` · `cardiac_check_credential` · `cardiac_grant_access` · `cardiac_get_nonce` · `cardiac_check_access` · `cardiac_payment_process` --- ### 🔮 Cardiac Oracle Validate ECG biometric data from smartwatches to authenticate human identities, compute cardiac hashes, and verify recent validations. `oracle_health` · `oracle_validate_ecg` · `oracle_hash_ecg` · `oracle_verify` --- ## Supported Robot Models | Model | Type | Capabilities | |-------|------|--------------| | `xiaomi-robotics-0` | VLA | Grasp, navigate, manipulate | | `pi05` | VLA | General manipulation | | `groot_n1.7` | VLA | Humanoid control | | `deepseek-ocr-2b` | OCR | Label reading, text recognition | --- ## Example Usage **Pick and place:** > "Pick up the red box from the table and place it on shelf B" **Sensor query:** > "What is the temperature in warehouse zone 3?" **Safety:** > "Run a safety check before moving robot_001 to the loading dock" **Swarm:** > "Deploy all available robots to patrol the perimeter" **Learning:** > "What grip technique should I use for fragile glass objects?" --- ## Links - 🌐 [NWO Capital](https://nwo.capital) - 📄 [Agent Skill File](https://nwo.capital/webapp/agent.md) - 📖 [API Docs](https://nwo.capital/webapp/nwo-robotics.html) - 🧬 [Cardiac SDK](https://github.com/RedCiprianPater/nwo-cardiac-sdk) - 🔑 [Get API Key](https://nwo.capital/webapp/api-key.php) - 🤗 [Live Demo](https://huggingface.co/spaces/PUBLICAE/nwo-robotics-api-demo) - 📜 [OpenAPI Spec](https://nwo.capital/openapi.yaml) --- ## Support 📧 [email protected]

By Smithery | 119 findings | Scanned 5/28/2026 | tooltrust-scanner/v0.3.12

24 High7 Medium18 Low70 Info

Risk Summary

Needs Approval

Dep Visibility plus Excessive Permissions raises enough risk that this tool should not be auto-trusted.

Potential impact: This finding indicates the tool should be reviewed before it is trusted.

Recommended action: Keep this tool behind manual approval and avoid unattended runs until the risky capabilities are narrowed or removed.

Suggested policy: keep this tool behind manual approval, do not allow unattended runs, and re-scan after narrowing risky permissions.

Security Findings (119)

  • HighAS-002

    ⚠️Excessive Permissions ×12

    tool declares network permission

    query_robot_staterobot_querydownload_urdf

    tool declares exec permission

    execute_actionsexecute_subtasklearning_recommendlearning_logdiscover_capabilitiesdry_runplan_taskros2_send_commandcreate_finetune_dataset

    Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

  • HighAS-010

    🔑Insecure Secret Handling ×12

    input parameter "api_key_hash" appears to accept a secret or credential

    cardiac_register_agentcardiac_identify_agent

    input parameter "root_token_id" appears to accept a secret or credential

    cardiac_renew_keycardiac_issue_credentialcardiac_check_credentialcardiac_grant_accesscardiac_check_accesscardiac_payment_process

    input parameter "new_api_key_hash" appears to accept a secret or credential

    cardiac_renew_key

    input parameter "credential_hash" appears to accept a secret or credential

    cardiac_issue_credential

    input parameter "credential_type" appears to accept a secret or credential

    cardiac_issue_credentialcardiac_check_credential

    Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.

  • MediumAS-002

    ⚠️Excessive Permissions ×7

    tool declares db permission

    query_robot_staterobot_query

    tool declares fs permission

    create_walletupdate_agentget_agent_infocreate_finetune_dataset

    tool declares env permission

    check_collision

    Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

  • LowAS-011

    ℹ️Missing Rate-Limit / Timeout ×15

    tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

    query_robot_stateexecute_actionsrobot_queryexecute_subtasklearning_recommendlearning_logdiscover_capabilitiesdry_runplan_taskros2_send_commandestimate_torquesdownload_urdfrun_calibrationcreate_finetune_datasetoracle_verify

    Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

  • LowAS-002

    ⚠️Excessive Permissions ×3

    tool declares http permission

    estimate_torquesrun_calibrationoracle_verify

    Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

  • InfoAS-014

    ℹ️Dependency Inventory Unavailable ×70

    Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

    vla_inferenceedge_inferencelist_modelsget_model_infoget_streaming_configquery_robot_stateexecute_actionssensor_fusionrobot_queryget_agent_statustask_plannerexecute_subtaskstatus_polllearning_recommendlearning_logregister_agentcheck_balancepay_upgradecreate_walletregister_robotupdate_agentget_agent_infonwo_healthnwo_whoamidiscover_capabilitiesdry_runplan_taskros2_list_robotsros2_robot_statusros2_send_commandros2_submit_actionros2_emergency_stopros2_emergency_stop_allros2_get_robot_typessimulate_trajectorycheck_collisionestimate_torquesvalidate_graspplan_motionget_scene_librarygenerate_scenelist_embodimentsget_robot_specsget_normalizationdownload_urdfget_test_resultscompare_robotsrun_calibrationcalibrate_confidencestart_rl_trainingsubmit_rl_telemetrycreate_finetune_datasetstart_finetune_jobread_tactileprocess_tactiledetect_sliplist_datasetscardiac_register_agentcardiac_identify_agentcardiac_renew_keycardiac_issue_credentialcardiac_check_credentialcardiac_grant_accesscardiac_get_noncecardiac_check_accesscardiac_payment_processoracle_healthoracle_validate_ecgoracle_hash_ecgoracle_verify

    Fix: Review and remediate the identified issue.

Scan this tool yourself

Reproduce this audit locally, integrate into CI, or let your agent audit its own tools.

Install once, then scan any MCP server:

$ curl -sfL https://raw.githubusercontent.com/AgentSafe-AI/tooltrust-scanner/main/install.sh | bash
$ tooltrust-scanner scan --server "npx -y ciprianpater-srv-d7aoqmh5pdvs7391dcqg"

Adjust the package name if your npm registry name differs from the tool ID. View source

Add badge to your README

Copy this Markdown to show your ToolTrust grade on GitHub.

[![ToolTrust Grade C](https://raw.githubusercontent.com/AgentSafe-AI/tooltrust-directory/main/docs/badges/grade-c.svg)](https://github.com/AgentSafe-AI/tooltrust-directory)