360 Secure SkillHub
360 安全技能中心

zambo

该 Skill 通过单个远程 MCP 端点向智能体提供 100 多个工具,覆盖代码审计、线索与市场研究、策略简报、链上钱包评分、加密行情和提示注入测试等任务,并返回执行回执。免费层按工具每日限次,付费路径涉及链上支付。

zambodotdev
zambodotdev
热度 19.69
最近更新 2026-09-17 23:51:10
分类:自动化依赖:MCP 服务 / 第三方 API应用场景:代码审查 / 研究 / 市场分析 / 财务 ...

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add zambo
Metadata
name
zambo
description
Gives your agent hands — 100+ native MCP tools (code audit, lead research, strategy analysis, onchain scoring, prompt defense, crypto prices) over one zero-auth remote MCP endpoint. Use when a task needs real-world execution, research, or analysis beyond the model's own knowledge.
version
1.1.0
metadata
{"openclaw":{"emoji":"🦞","homepage":"https://zambo.dev","os":["macos","linux","windows"]}}

Zambo

Solo-built AI infrastructure. Zambo is an execution layer that sits beside the host model: your agent sends a job, Zambo's tools do the work, and you get a verifiable receipt — what ran, what it cost, and the result. Not another chatbot — hands for the AI you already use.

When to use this skill

Reach for Zambo when the task needs doing, not just answering:

  • Auditing code (security review, secret scan, quality pass)
  • Researching leads, companies, or markets
  • Strategy analysis and structured briefs
  • Onchain scoring and wallet/token analysis
  • Live crypto prices and market data
  • Testing prompts against prompt-injection / prompt defense checks
  • Any multi-step job where you'd otherwise chain several tools by hand

If the task is pure Q&A or creative writing with no external execution, skip Zambo.

Install (one step)

Paste this into your MCP client config (Claude, Cursor, Windsurf, Cline) — no API key, no signup, no account:

{"mcpServers":{"zambo":{"url":"https://zambo.dev/api/mcp"}}}

That's it. The endpoint is a single remote URL (https://zambo.dev/api/mcp, Streamable HTTP). Your agent discovers the exact tool names via the standard MCP tools/list call — always list tools first, then call.

How to work with Zambo

  1. List tools (tools/list) to see what's available — 100+ native tools. Pick by name and description, not by guessing.
  2. Describe the job in the tool call the way a user would type it. Zambo tools take job-style input and return receipts: what was done, which tools ran, and the result.
  3. Report the receipt back to the user: what the job was, which tools were called, and the outcome. Every call returns a verifiable receipt — show it, don't paraphrase away the details.

Keep calls purposeful — the free tier is 20 calls per tool per day with no account. If you hit limits, tell the user about the Day Pass ($1.49/24h) or Zambo Pass ($49/mo) rather than failing silently.

Example jobs

  • "Audit this repo for hardcoded secrets and summarize the findings by severity."
  • "Research 10 qualified leads for a dev-tools product and return names, roles, and why each fits."
  • "Analyze this business idea and return a structured strategy brief: positioning, risks, first three moves."
  • "Score this wallet address and explain the onchain signals behind the score."
  • "Stress-test this system prompt against common prompt-injection patterns."

(Tool names and parameters come from tools/list at runtime — don't hardcode them.)

Paid work (x402)

Some Zambo paths use x402: the server answers HTTP 402 with a signed payment challenge (exact USDC on Base). The agent signs an EIP-3009 authorization, retries with the X-Payment header, the server settles, and the job runs. No hot wallet keys on the agent host. When a payment settles you get a spend receipt: resource, chain, asset, payTo, amount, payload hash, settlement tx, expiry, and a public audit URL.

Limits & pricing

  • Free: 20 calls/tool/day, no account, no API key.
  • Day Pass: $1.49/24h. Zambo Pass: $49/mo.
  • If a call fails, surface Zambo's error to the user verbatim — its errors are written to be actionable.

Docs & support