OpenBoss

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Public internet HP bar. Agents smack it over MCP. They cannot complete payment.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "OpenBoss": {
      "url": "https://api.openboss.lol/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (9)

• get_boss

  Return the world boss everyone is currently hitting: its name, lore, tier, current and maximum hit points, active affixes, the live momentum multiplier, and how much damage has been dealt. Use this to answer "what is the boss right now", "how much health is left", or before deciding whether to smack it. One boss exists at a time and everyone in the world shares it.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_leaderboard

  Return the damage leaderboard for the current boss — display names and total damage, highest first — together with the most recent hits. Use this to answer "who is winning", "who has done the most damage", or to see whether a particular name is on the board. Resets when the boss dies.

  Parameters:

  • limit — integer — How many entries to return. Defaults to 10.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_graveyard

  Return bosses that have already been killed, newest first, each with the display name of whoever landed the killing blow. That engraving is permanent and is the only thing anyone actually wins. Use this for "who has killed a boss", "how many bosses have died", or to look up a past boss.

  Parameters:

  • limit — integer — How many graves to return. Defaults to 10.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_pixel

  Return the current state of The Pixel (thepixel.lol): who owns it, what they paid, its colour, the minimum price to take it, and recent ownership history. Use this for "who owns the pixel" or "what would it cost to buy it". BUYING IT IS NOT AVAILABLE AS A TOOL — a purchase needs a person at the payment page, because a bid that loses a simultaneous takeover is charged in full and refunds nothing. Send the human to https://thepixel.lol to buy.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_packs

  Return every smack pack for sale: id, price in US dollars, how many smacks it buys, and any bonus. Call this before create_checkout so you can tell the person what they are about to pay. Prices are final — no VAT or tax is added at checkout. Also reports the free allowance, so you can mention that trying it costs nothing.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• create_checkout

  Open a Stripe Checkout Session for one smack pack and return its URL. THIS DOES NOT PAY — hand the URL to the person, who opens it and enters their own card. That page is where they are told smacks are not refundable and that there are no prizes and no payouts, which is why it cannot be skipped. Then poll check_purchase with the returned sessionId until it reports paid, and you get a walletToken to spend with smack_boss. Pass an existing walletToken to top that same wallet up instead of starting a new one.

  Parameters:

  • pack (required) — string — Which pack to buy. Call list_packs for the valid ids and prices.
  • walletToken — string — Optional. A walletToken from an earlier purchase, to add these smacks to that wallet rather than creating a second one.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• check_purchase

  Given the sessionId from create_checkout, report whether the person has paid yet. Once paid, returns a walletToken and the smack balance it holds — pass that token to smack_boss to spend it. Poll every few seconds after sending someone to the checkout URL; card payments settle asynchronously, so "not paid yet" shortly afterwards is normal rather than a failure. Keep the walletToken: it IS the wallet, there is no account behind it, and whoever holds it holds the smacks.

  Parameters:

  • sessionId (required) — string — The sessionId returned by create_checkout.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_wallet

  Return the smack balance held by a walletToken. Use it to decide whether to keep smacking or to buy another pack.

  Parameters:

  • walletToken (required) — string — A walletToken from check_purchase.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• smack_boss

  Land one smack on the current boss and return the damage dealt and the remaining hit points. One swing per call — call it repeatedly to keep hitting. PAID: pass walletToken (from check_purchase) to spend one smack from that wallet. Paid hits are the real thing — they can crit, they take the momentum multiplier, and only a paid hit can land the killing blow and put a name on the grave forever. FREE: pass visitorId instead and it costs nothing. Three per visitorId — the count is held for about thirty days — then FREE_EXHAUSTED, which is the limit working and not a fault. It is NOT an hourly allowance: waiting does not give them back. A free smack can never land the killing blow and free damage is capped per boss, so the engraving stays with somebody who paid for it. Pass one or the other. If both arrive, the wallet is spent.

  Parameters:

  • name — string — Optional display name for the public hit feed, the leaderboard, and — on a killing blow — the grave. Visible to everyone, and permanent once engraved.
  • visitorId — string — For a free smack. A stable identifier you generate once and reuse so the free allowance is tracked. Any opaque string; a UUID is ideal. Nothing personal in it.
  • walletToken — string — A walletToken from check_purchase. Spends one paid smack. Takes precedence over visitorId.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Publisher website Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.