# app.railway.up.engine-production-3bdc/vhgengine

Agents-first viral-hook engine: generate, score, and remix short-form hooks over MCP.

- **Type:** MCP server
- **Trust:** 60/100 (B), scored on the content rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 2.3.0
- **Author:** app.railway.up.engine-production-3bdc
- **License:** Unknown
- **Endpoints:** streamable-http https://engine-production-3bdc.up.railway.app/mcp
- **Source:** https://engine-production-3bdc.up.railway.app/llms.txt
- **Endpoint health:** reachable (last checked 2026-09-14T13:22:10.131Z, 4 samples) — uptime is not a security property and is not part of the trust score
- **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport)

## Trust

60/100 (B), scored on the content rubric
- Publisher verified: no
- Install scripts: nothing suspicious found
- Prompt-injection scan: clean
- Obfuscation scan: clean
- Evidence age: 1 day

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-14T13:22:10.131Z
- **Version scanned:** live
- **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it.

## Tools

45 declared. Observed from a live `tools/list` probe.
- `signup` — Redeem a private-beta code and create an account. No API key needed. Standard codes are single-use with ten product requests. Owner codes are reusable and unlim
- `getting_started` — The 5-step agent quickstart: modes, wait guidance, links. Free, no auth. Written to be parsed and acted on. Returns {what_this_is, five_steps, modes (cost + liv
- `list_archetypes` — List the hook archetypes with psychology, platforms, and templates. Free, no auth. Returns {archetypes:[{id, name, description, psychological_trigger, best_for,
- `pricing` — The machine-readable price list, with per-mode expected_wait. Free, no auth. Every customer operation is zero-priced during private beta. Returns {unit, usd_per
- `get_estimates` — The measured/expected wait per generation mode. Free, no auth. Size a call before spending. Returns {op, modes:{instant|smart|research: {p50_ms, p90_ms, samples
- `health` — Deep health: DB read+write probe, worker/queue, backup + integrity. Free. Uses the same DB, backup, offsite, and integrity probes as GET /health; status is "ok"
- `get_account` — Return this account's state + remaining rate-limit budget. Free read. `rate_limit` carries {limit, remaining, reset_epoch, reset_at, window_seconds} for the per
- `get_usage` — Return the credit balance, per-operation totals, and recent ledger. Free. Args: recent_limit (1-200, default 50), offset (>=0, pages `recent` past the newest ro
- `export_usage` — Export ledger, hook, instance, lineage, outcome, profile, and retained-job data. Free; run BEFORE delete_account. Same JSON body as GET /v1/usage/export; CSV ha
- `list_runs` — Every call this account was charged for, newest first. Free read. Recover a lost response in two calls, never re-charged: list_runs(request_id=...) for the rece
- `quote` — Read archived generation price and wait metadata without spending. Free. Validates the retained input schema and computes its historical price ceiling, balance,
- `add_credits` — Compatibility credit grant (1-10000); beta customer operations are already free. When VHGENGINE_ADMIN_KEY is configured on the deployment this requires a matchi
- `list_billing_events` — Recent billing events (usage.recorded, credits.granted, credits.low). Free. Newest first, paged with limit/offset like list_hooks and list_outcomes. Returns {ev
- `create_checkout` — Get a hosted-checkout link outside beta. Disabled while beta pricing is free. The REQUIRED idempotency_key creates or replays one durable order and Stripe is ca
- `create_creator_profile` — Create an owned, versioned creator profile. Free; admin scope. At least one creator/audience/stance/fact is required. Returns the exact version, deny-by-default
- `list_creator_profiles` — List current creator-profile versions, newest changed first. Free; read scope. Returns {profiles, limit, offset, total}. Each profile carries its immutable vers
- `get_creator_profile` — Get the current or one exact historical creator-profile version. Read scope. Foreign, deleted, and unknown ids all return the same not_found envelope. Returns t
- `update_creator_profile` — Append a full immutable profile version with compare-and-swap. Admin scope. expected_version prevents lost updates. Returns version+1, or unchanged:true when th
- `delete_creator_profile` — Erase profile facts and consent history; retain a retraction marker. Admin scope. Already committed customer hook outputs are not silently deleted. No profile d
- `create_key` — Mint a new named API key; the plaintext is returned ONCE. Requires admin scope. Delegate safely (WP-SCOPE): optional scopes (subset of read|spend|admin; omit fo
- `list_keys` — List this account's API keys as PREFIXES only (never the raw key). Admin scope. Returns {keys:[{prefix, name, scopes, daily_credit_cap, spent_today, created_at,
- `revoke_key` — Revoke the key with `prefix` (from list_keys): it stops working, others keep working. Use to kill a leaked or old key. Args: prefix (the 12-char key prefix, e.g
- `delete_account` — Permanently delete this account. TERMINAL, not reversible. Admin scope (WP-LIFE). Pass confirm="delete" (guards accidents). Revokes ALL keys and deletes live pr
- `research_hook_evidence` — Return an unpadded portfolio selected deterministically from verified evidence. Hard gates precede relevance and diversity; views are observed platform views. O
- `synthesize_hooks` — Write original hooks derived from verified viral source evidence. Each hook cites one admitted source: verbatim opening, timestamps or explicit nulls for untime
- `generate_hooks` — Archived source-free writer. Use research_hook_evidence instead. Always fails before model, template, provider, storage, or billing work. Research requires a re
- `generate_hooks_batch` — Archived source-free batch writer. Use research_hook_evidence instead. Always fails before model, template, provider, job, storage, or billing work. It cannot p
- `score_hook` — Score any hook text on 5 dimensions with rewrite tips. Free during beta. Deterministic heuristic scorer (no LLM). Args: text (3-300), platform, topic (optional,
- `score_hooks_batch` — Score many hooks ranked with `best`, or compare named SETS. Free during beta. All-or-nothing charge. Plain: texts (1-25, each 3-300 chars). Self-test (E13): com
- `remix_hook` — Archived source-free remix writer. Use research_hook_evidence instead. Always fails before rewriting, model, storage, or billing work. An extracted source hook 
- `list_hooks` — List the hooks this account has bought, newest first. Free (WP-G). Retrievable for 90 days. Args: mode (instant|smart|research|remix, or a generate alias such a
- `get_hook` — Fetch one bought hook in full, including its parsed score. Free (WP-G). Account-scoped: a foreign or unknown id is not_found (no existence leak). Args: hook_id 
- `list_outcomes` — List the posted outcomes THIS account has reported, newest first. Free (WP-LIFE). Retrieve submitted telemetry in bulk. Args: platform (tiktok|instagram|youtube
- `report_outcome` — Report what a bought hook actually did once posted. FREE (WP-H). Caller-supplied, unverified, and not used by generation/scoring/retrieval today. Retained for p
- `start_generate_job` — Archived source-free writer job. Use research_hook_evidence instead. Always fails before a job, model, provider, storage, or billing work. Async execution canno
- `get_job` — Poll an async job: status, real engine stage, progress, ETA, result/error. Poll after poll_after_seconds until status is "succeeded" (result holds the full gene
- `wait_for_job` — Block until a job is terminal, then return it. Free, bounded, no poll loop. Returns the chosen get_job result_view plus timed_out, waited_ms and polls; branch o
- `cancel_job` — Cancel a job that is STILL QUEUED. Free, repeatable, never refunds. ALWAYS branch on `cancelled`; reason + next_action say what to do. A queued job was never ch
- `list_jobs` — List this account's jobs, newest first (summaries without the result blob). Args: limit (1-200, default 50), offset (>=0), api_key. Returns {jobs:[{job_id, stat
- `set_webhook` — Register (or replace) this account's webhook; the secret is returned ONCE. Admin scope. Hook Detector POSTs signed job.succeeded/job.failed/credits.low (WP-M). 
- …and 5 more

## Install

**Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
**Cautions** (coverage gaps and advisories — never blocking)
- No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"vhgengine\": {\n      \"type\": \"http\",\n      \"url\": \"https://engine-production-3bdc.up.railway.app/mcp\"\n    }\n  }\n}"
```

## Blast radius

Extensive blast radius — deletes data; runs on someone else's infrastructure.
- Floor 34, ceiling 58 (tier: extensive)
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/app.railway.up.engine-production-3bdc%2Fvhgengine
- Install plan: https://forgeregistry.com/api/v1/packages/app.railway.up.engine-production-3bdc%2Fvhgengine/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/app.railway.up.engine-production-3bdc%2Fvhgengine
- HTML page: https://forgeregistry.com/registry/app.railway.up.engine-production-3bdc%2Fvhgengine
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.