MCP servers › com.convertlyft › convertlyft
MCP server · registry snapshot 2026-10-23 · last tested 2026-10-23
com.convertlyft/convertlyft
Web analytics that names the fix: funnels, replays, errors, page speed and SEO for your site. — the publisher's description
Summary
com.convertlyft/convertlyft is a remote MCP server listed in the official MCP registry at version 1.0.0. On 2026-10-23 ProtocolProbe connected to it in read-only mode and read its inventory: 64 tools, 52 resources and 26 prompts.
Record checks
1 of 2 record checks met · 7 do not apply
- met: Registry entry is active and says how to run it
- not met: Source repository link opens
- not applicable: Repository is not archived
- not applicable: Code pushed to the repository in the 90 days before our check
- not applicable: Repository publishes a security policy (SECURITY.md)
- not applicable: Package names its licence with a standard (SPDX) identifier
- not applicable: The version the registry lists can be installed and is not withdrawn
- not applicable: npm package carries build provenance (attestation)
- not applicable: No known critical or high advisory in the package or its dependencies
- Not ranked by downloads: a remote server publishes no download figure
- Not ranked by stars: no public GitHub repository
From public records, not a safety rating. Each check with its reason · Is it safe to install?
Key facts
- Runs
- remote (hosted by the publisher)
- Transport
- streamable HTTP
- Sign-in
- none needed to open a session
- Tools
- 64
- Described as changing data
- 35 of 64 toolsAI-classified
- Topic
- commerce-and-marketingAI-classified
- Last tested
- 2026-10-23
Observed fact
This server accepted a session without any credential and lists 44 tools whose name or declaration suggests they change data (cvl_change_apply, cvl_change_undo, cvl_remember, cvl_propose, cvl_operator_run and 39 more). That is our reading of the names; we did not call them. Source: our connection, 2026-10-23.
Worth knowing before you connect it
- 35 tools are described as changing something (cvl_change_apply, cvl_change_undo, cvl_remember, …): our AI model's reading of the descriptions, not something we tested, and the server opened a session without any credential. We did not call them.
Each line comes from a section below, with its source and date.
How fresh this is
- Live-tested
- yes, a real session (not a text-only review)
- Last tested
- 2026-10-23
- Mode
- read-only (no tool calls)
- Latest version
- 1.0.0, published 2026-10-09 (registry, as of the 2026-10-23 snapshot)
- First listed version
- 2026-10-09 (earliest version still in the registry; older removed versions would be earlier)
- Registry data
- snapshot 2026-10-23
- Package and repository
- checked 2026-10-22
- Engine
- mcp-runtime-engine@0.1.0 · sdk@1.32.0
Changes since the last refresh
New in the registry: not in the list of 2026-10-04, listed on 2026-10-23 with version 1.0.0 (published 2026-10-09).
Source: the official MCP Registry list on 2026-10-04 and on 2026-10-23.
What it is
What does this server offer?
Observed inventory35 of 64 tools are described as changing something (creating, editing, deleting, sending or running). For 8 the reading was uncertain, so no mark is shown.
- cvl_whoamireads or searches
“What this credential is, which workspace it reads, the scopes it holds, when it expires, and how many calls are left in the current windows; today’s limit for paid search data, new public scans left …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
1 input
fieldsarray“Top-level keys to keep, e.g.”
- cvl_behavior_reportreads or searches
“Where people got stuck in a window: the pages people spend time on and scroll through, the rage clicks, the dead clicks (the tag’s own, minus the ones a link or a call answered — the Stuck spots page…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
8 inputs
window_handlestring“A handle from an earlier report, to ask about the identical window.”fromstring“Start of the window, as a full ISO 8601 TIMESTAMP: 2026-01-01T00:00:00Z.”tostring“End of the window, same full-timestamp shape.”limitnumber“Rows per list.”pages_cursorstring“counts.pages.next_cursor from the previous answer, for the pages after it.”rage_clicks_cursorstring“counts.rage_clicks.next_cursor from the previous answer.”dead_clicks_cursorstring“counts.dead_clicks.next_cursor from the previous answer.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_kpireads or searches
“Visitors, visits, the share of visits that bought or got in touch (conversion rate), revenue by currency, median engaged time and site health for a window — the same figures, from the same code, as t…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
6 inputs
window_handlestring“The handle from an earlier call in this chain.”fromstring“Start of the window, as a full ISO 8601 TIMESTAMP: 2026-01-01T00:00:00Z.”tostring“End of the window, same full-timestamp shape: 2026-01-10T23:59:59Z.”sourcestring“Restrict to one utm_source a visit carried, e.g.”campaignstring“Restrict to one campaign.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_explainreads or searches
“The methodology behind one figure on the KPI header: its definition, the population it was computed over (denominator, numerator and row count), the filters in force, the condition that decides when …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
8 inputs
figurestring“One figure to explain: visitors, sessions, converted_sessions, conversion, revenue, engaged_time, crash_free_rate, lcp_p75_ms.”verboseboolean“true adds each figure’s definition, when it is withheld, and why a row count is missing — the same prose on every call, so it is left out by default.”window_handlestring“The handle from the cvl_kpi call whose figure you are asking about.”fromstring“Start of the window, as a full ISO 8601 TIMESTAMP: 2026-01-01T00:00:00Z.”tostring“End of the window, same full-timestamp shape: 2026-01-10T23:59:59Z.”sourcestring“Restrict to one utm_source a visit carried, e.g.”campaignstring“Restrict to one campaign.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_check_claimreads or searches
“Submit the sentence you are about to say plus the evidence ids (receipt_ids) of the data you were given.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs, 2 required
sentencestringrequired“The sentence you are about to say, verbatim — or the whole paragraph, checked a sentence at a time.”receipt_idsarrayrequired“The evidence id of every answer whose figures the sentence draws on.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_change_previewreads or searches
“Show exactly what cvl_change_apply would write, and the undo it would hand back, without writing anything.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs
notestring“What you changed, in your own words.”marked_atstring“When the change went live, ISO 8601.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_change_applycreates or changes datadescribed as changing data
“Record that the site changed, so the impact can be measured against it.”
Publisher declares: read-only no · destructive yes · idempotent yes · open-world no
5 inputs, 2 required
idempotency_keystringrequired“Your own key for this change.”notestring“What you changed, in your own words.”marked_atstring“When the change went live, ISO 8601.”preview_tokenstringrequired“What cvl_change_preview returned for this same note and marked_at.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_change_undodeletesdescribed as changing data
“Remove a marker you wrote, using the undo computed when it was applied.”
Publisher declares: read-only no · destructive yes · idempotent yes · open-world no
2 inputs, 1 required
proposal_idstringrequired“The proposal_id cvl_change_apply returned.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_remembercreates or changes datadescribed as changing data
“Append one row to this workspace’s ledger so the next conversation does not derive it again.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
8 inputs, 2 required
kindstringrequired“finding = a claim about the data, needs an evidence id.”statementstringrequired“One sentence, in the words a person would read.”receipt_idstring“Required for a claim about the data (kind "finding"): the receipt_id returned by the call the claim came from.”fromstring“ISO 8601 start of the window the claim covers.”tostring“ISO 8601 end.”window_fromstring“Older name for from, still accepted.”window_tostring“Older name for to, still accepted.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_proposecreates or changes datadescribed as changing data
“Queue a fix for the OWNER to approve.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
6 inputs, 4 required
fix_identitystringrequired“Stable identity for this fix.”titlestringrequired“One line the owner reads on the card.”detailobject“What you propose to change.”baselinerequired“The state you observed before proposing.”revert_planrequired“How to put it back.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_operator_rundescribed as changing data
“Queue today’s operator run for this workspace.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
2 inputs
run_typestring“Which run to queue.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_backlinksreads or searches
“How many domains and pages link to this site, snapshot by snapshot, and the newest link-gap read: domains linking to chosen rivals but not here.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
1 input
fieldsarray“Top-level keys to keep, e.g.”
Show 52 more tools
- cvl_seo_auditreads or searches
“The latest full crawl of this site as a summary (a newer list re-check, a 0-page run or a crawl still running never replaces it; full_run names it then, and a re-check clears what it no longer finds)…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs
issuestring“An issue id from the list (the findings field), to get its fix text and sample pages.”limitinteger“Also list page rows, this many (default 25, at most 100).”cursorstring“The next_cursor value from the previous page of rows.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_run_crawldescribed as changing data
“Start a crawl of this workspace’s own site with the Convertlyft spider: every page’s status, title, description, headings, words and technical issues.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
4 inputs
max_pagesnumber“How many pages to crawl at most.”dry_runboolean“true: buy nothing; answer the estimate (at most) and what is left of today’s limit.”confirm_costinteger“Run only if the estimate is at most this number; otherwise refuse and buy nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_site_pagesreads or searches
“Every page the newest crawl found, one row each: path, status, title, H1, meta description, word count, how many technical issues it has and the worst of them, and whether it is indexable.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs
limitinteger“How many pages to list.”cursorstring“The next_cursor value from the previous page.”typestring“Only pages of this page type (confirmed or estimated; see cvl_page_types).”fieldsarray“Top-level keys to keep, e.g.”
- cvl_error_fix_shippedcreates or changes datadescribed as changing data
“Tell Convertlyft that the fix for one error is live on the site.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
3 inputs
refstring“The short ref every brief prints, like CVL-Ea1b2c3d4.”fingerprintstring“The issue fingerprint, exactly as cvl_issues_list gave it.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_crawl_startdescribed as changing data
“Start a crawl of any public website with the Convertlyft crawler and get a crawl_id straight away; the crawl runs for a few minutes.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
7 inputs, 1 required
urlstringrequired“Where to start, like https://example.com.”limitinteger“Most pages to fetch.”depthinteger“How many links deep from the start page.”modestring“"full" (default) keeps each page’s text; "links" is the URL map only.”renderstring“Load pages in a browser: "auto" (default) where the crawler sees a page needs it, "always", or "never".”webhookstring“Optional https URL we POST to once when the crawl finishes, signed with the webhook_secret this call returns.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_flowreads or searches
“Where the automatic SEO chain stands for this site: crawl, keywords, competitors, SEO to-dos (the opportunities step) and briefs, each done / running / waiting for the daily limit / failed with its r…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
1 input
fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_opportunitiesreads or searches
“The ranked to-do list: searches your competitors win and you do not, related searches around your money keywords, and Search Console near-misses (position 8–30, ≥10 impressions in 28 days) — each map…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
6 inputs
marketinteger“Market as a location code (e.g.”location_codeinteger“Older name for market, still accepted.”actionstringlimitinteger“Rows per page, at most 50 (the default).”cursorstring“The next_cursor value from the previous page.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_track_keywordscreates or changes datadescribed as changing data
“Add searches to rank tracking in a market.”
Publisher declares: read-only no · destructive yes · idempotent yes · open-world no
4 inputs, 1 required
keywordsarrayrequired“One or more searches, at most 200, each at most 120 characters.”marketinteger“Market as a location code (e.g.”location_codeinteger“Older name for market, still accepted.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_untrack_keywordsdeletesdescribed as changing data
“Remove searches from rank tracking in a market.”
Publisher declares: read-only no · destructive yes · idempotent yes · open-world no
4 inputs, 1 required
keywordsarrayrequired“One or more searches, at most 200, each at most 120 characters.”marketinteger“Market as a location code (e.g.”location_codeinteger“Older name for market, still accepted.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_set_competitor_statecreates or changes datadescribed as changing data
“Pin a competitor (always used), hide one (state hidden, or its older name dismissed: hidden 180 days, or until it shares twice as many money keywords), or clear the choice.”
Publisher declares: read-only no · destructive yes · idempotent yes · open-world no
5 inputs, 2 required
domainstringrequiredstatestringrequiredmarketinteger“Market as a location code (e.g.”location_codeinteger“Older name for market, still accepted.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_brief_keywordscreates or changes datadescribed as changing data
“Decide the searches listed under a stored SEO content brief’s "Keywords to add" — add, skip, or clear, several at once (the room’s "Add all").”
Publisher declares: read-only no · destructive yes · idempotent yes · open-world no
6 inputs, 3 required
searchstringrequired“The brief’s own search, as cvl_seo_brief names it.”keywordsarrayrequired“One or more searches, at most 200, each at most 120 characters.”decisionstringrequiredmarketinteger“Market as a location code (e.g.”location_codeinteger“Older name for market, still accepted.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_issue_on_purposecreates or changes datadescribed as changing data
“Renamed cvl_seo_issue_not_a_problem, which does the same; this name keeps working until 2026-11-18.”
Publisher declares: read-only no · destructive yes · idempotent yes · open-world no
4 inputs, 1 required
issuestringrequired“The issue id, as cvl_seo_audit lists it.”on_purposeboolean“false counts it again (the default is true).”dry_runboolean“A preview unless false (the default is true): nothing changes until the owner says yes.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_opportunity_trackcreates or changes datadescribed as changing data
“Act on an SEO to-do from cvl_seo_opportunities by tracking its search.”
Publisher declares: read-only no · destructive yes · idempotent yes · open-world no
4 inputs, 1 required
keywordstringrequired“The search, as typed.”marketinteger“Market as a location code (e.g.”location_codeinteger“Older name for market, still accepted.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_set_keyword_moneycreates or changes datadescribed as changing data
“Mark a search as a money keyword (counts for competitors and SEO to-dos) or not.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
5 inputs, 2 required
keywordstringrequired“The search, as typed.”moneybooleanrequiredmarketinteger“Market as a location code (e.g.”location_codeinteger“Older name for market, still accepted.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_map_keyword_pagecreates or changes datadescribed as changing data
“Say which page of the site targets a search.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
6 inputs, 2 required
keywordstringrequired“The search, as typed.”page_urlstringrequired“Full address of the page.”pageUrlstring“Older name for page_url, still accepted.”marketinteger“Market as a location code (e.g.”location_codeinteger“Older name for market, still accepted.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_add_keywordscreates or changes datadescribed as changing data
“Add searches to the keyword list, optionally for one page.”
Publisher declares: read-only no · destructive yes · idempotent yes · open-world no
6 inputs, 1 required
keywordsarrayrequired“One or more searches, at most 200, each at most 120 characters.”page_urlstring“Full address of the page.”pageUrlstring“Older name for page_url, still accepted.”marketinteger“Market as a location code (e.g.”location_codeinteger“Older name for market, still accepted.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_run_flowdescribed as changing data
“Run the SEO chain again from the newest crawl (or from one step): keywords, competitors, SEO to-dos and SEO content briefs.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
5 inputs
from_stepstring“Start from this step.”fromStepstring“Older name for from_step, still accepted.”dry_runboolean“true: buy nothing; answer the estimate (at most) and what is left of today’s limit.”confirm_costinteger“Run only if the estimate is at most this number; otherwise refuse and buy nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_write_fixdescribed as changing data
“Retired 2026-10-18 and no longer offered: every call answers not_offered and spends nothing.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
5 inputs, 2 required
issuestringrequired“The issue id, as cvl_seo_audit lists it.”page_urlstringrequired“The full address of the page, one of the issue's sample pages.”dry_runboolean“true: buy nothing; answer the estimate (at most) and what is left of today’s limit.”confirm_costinteger“Run only if the estimate is at most this number; otherwise refuse and buy nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_make_briefdescribed as changing data
“Make the SEO content brief for one search: it reads the live top results, crawls the top pages and writes suggestions.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
8 inputs, 1 required
keywordstringrequired“The search, as typed.”marketinteger“Market as a location code (e.g.”location_codeinteger“Older name for market, still accepted.”forceboolean“Make it again even when a brief from the last 7 days exists.”freshboolean“With force: forget the stored evidence, buy the results and read every page again.”dry_runboolean“true: buy nothing; answer the estimate (at most) and what is left of today’s limit.”confirm_costinteger“Run only if the estimate is at most this number; otherwise refuse and buy nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_add_marketdescribed as changing data
“Start tracking this site in another market (country, language and device).”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
5 inputs, 3 required
location_codeintegerrequired“The country as a location code (e.g.”language_codestringrequired“The search language, e.g.”devicestringrequireddry_runboolean“Answer what would be added and the first check date; add nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_public_seo_scandescribed as changing data
“Scan a public website for SEO problems with the Convertlyft crawler: up to 16 pages, robots.txt obeyed, no JavaScript run, nothing changed on the site.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
2 inputs, 1 required
urlstringrequired“The site to scan, like https://example.com or example.com.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_public_seo_scan_resultreads or searches
“The result of a scan cvl_public_seo_scan started, by its scan_id.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
2 inputs, 1 required
scan_idstringrequired“The scan_id cvl_public_seo_scan returned.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_public_agent_readinessreads or searches
“What the scan found about AI agents on a public site: its agent-readiness level (L0 unreachable to L4 agent-native) with what holds it there, each AI crawler or assistant robots.txt lets in or not an…”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
3 inputs
urlstring“The site, like https://example.com.”scan_idstring“A scan_id from cvl_public_seo_scan.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_docs_searchreads or searches
“Search Convertlyft’s public documentation for agents — https://convertlyft.com/llms.txt and https://convertlyft.com/llms-full.txt (the API, the MCP door, dates, limits, worked examples).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
2 inputs, 1 required
querystringrequired“What to look for, like "rate limit" or "connect Claude".”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_serp
“The live first page of Google results for one search in one country: position, address, domain and title of each organic result, the "People also ask" questions, and every other block the page held —…”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
8 inputs, 1 required
keywordstringrequired“One search, as typed.”location_codeinteger“Country as a location code (e.g.”language_codestring“Language, like en.”devicestring“Default: the device this site’s rank tracking uses, else desktop.”refreshboolean“Buy a fresh answer instead of reading the stored one.”dry_runboolean“true: buy nothing; answer the estimate (at most) and what is left of today’s limit.”confirm_costinteger“Run only if the estimate is at most this number; otherwise refuse and buy nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_keyword_ideas
“Searches around one seed: searches that contain the seed (mode suggestions, the default: stays on the seed), what Google lists beside it (related), or the provider’s ideas in the same topic (ideas: w…”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
9 inputs, 1 required
keywordstringrequired“One search, as typed.”modestringlimitinteger“Rows at most.”location_codeinteger“Country as a location code (e.g.”language_codestring“Language, like en.”refreshboolean“Buy a fresh answer instead of reading the stored one.”dry_runboolean“true: buy nothing; answer the estimate (at most) and what is left of today’s limit.”confirm_costinteger“Run only if the estimate is at most this number; otherwise refuse and buy nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_keyword_metrics
“For searches you name: monthly volume, difficulty, intent and the last 12 months of volume, as the provider estimates them.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
9 inputs, 1 required
keywordsarrayrequired“One or more searches, at most 1000, each at most 120 characters.”limitinteger“Searches answered in this call, at most.”historyboolean“false leaves out the 12 months of volume.”location_codeinteger“Country as a location code (e.g.”language_codestring“Language, like en.”refreshboolean“Buy a fresh answer instead of reading the stored one.”dry_runboolean“true: buy nothing; answer the estimate (at most) and what is left of today’s limit.”confirm_costinteger“Run only if the estimate is at most this number; otherwise refuse and buy nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_domain_overview
“Any site’s organic footprint in one country: how many searches it ranks for, how many of those in the top 3, and the provider’s estimate of its monthly search traffic.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
7 inputs, 1 required
domainstringrequired“A site’s bare hostname, like example.com.”location_codeinteger“Country as a location code (e.g.”language_codestring“Language, like en.”refreshboolean“Buy a fresh answer instead of reading the stored one.”dry_runboolean“true: buy nothing; answer the estimate (at most) and what is left of today’s limit.”confirm_costinteger“Run only if the estimate is at most this number; otherwise refuse and buy nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_competitor_gapreads or searches
“The searches one competitor ranks for that the site does not, best competitor positions first, with monthly volume and the competitor’s ranking page.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
9 inputs, 2 required
domainstringrequired“A site’s bare hostname, like example.com.”competitorstringrequired“The competitor’s bare hostname.”limitinteger“Rows at most.”location_codeinteger“Country as a location code (e.g.”language_codestring“Language, like en.”refreshboolean“Buy a fresh answer instead of reading the stored one.”dry_runboolean“true: buy nothing; answer the estimate (at most) and what is left of today’s limit.”confirm_costinteger“Run only if the estimate is at most this number; otherwise refuse and buy nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_backlink_profilereads or searches
“Any site’s backlink headline counts from the provider’s link index: referring domains, backlinks, broken backlinks, referring pages and when it was first seen.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
5 inputs, 1 required
domainstringrequired“A site’s bare hostname, like example.com.”refreshboolean“Buy a fresh answer instead of reading the stored one.”dry_runboolean“true: buy nothing; answer the estimate (at most) and what is left of today’s limit.”confirm_costinteger“Run only if the estimate is at most this number; otherwise refuse and buy nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_link_gapreads or searches
“Referring domains that link to one or more of the named competitors and not to the site, with which competitors each links to, its spam score and rank.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
7 inputs, 2 required
domainstringrequired“A site’s bare hostname, like example.com.”competitorsarrayrequired“Up to 20 competitor hostnames.”limitinteger“Rows at most.”refreshboolean“Buy a fresh answer instead of reading the stored one.”dry_runboolean“true: buy nothing; answer the estimate (at most) and what is left of today’s limit.”confirm_costinteger“Run only if the estimate is at most this number; otherwise refuse and buy nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_ai_mentionsreads or searches
“Whether AI assistants name a site: answers from the provider’s tracked panel of prompts, each with the platform, the question, whether the site was mentioned and an excerpt.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
6 inputs, 1 required
domainstringrequired“A site’s bare hostname, like example.com.”limitinteger“Answers at most.”refreshboolean“Buy a fresh answer instead of reading the stored one.”dry_runboolean“true: buy nothing; answer the estimate (at most) and what is left of today’s limit.”confirm_costinteger“Run only if the estimate is at most this number; otherwise refuse and buy nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_submit_sitemapcreates or changes datadescribed as changing data
“Submit one sitemap to Google Search Console for this site.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
3 inputs
feedpathstring“The sitemap’s full address on this site, e.g.”confirmboolean“true submits.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_set_page_typecreates or changes datadescribed as changing data
“Set the page type of pages of this site: up to 100 pages by address, or every page under a folder or built like one page (a page type rule of the owner’s).”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
8 inputs
pagesarray“The pages, by address or path (like /contact-us), at most 100.”patternobject“Instead of pages: {under: "/services/"} or {like: "/services/notary"}.”typestring“The page type to set.”custom_typestring“Instead of type, or with it: one of the owner’s own page types (its id or its exact name, as cvl_page_types names it in custom_type).”include_futureboolean“With pattern only: pages found later that match get this type too.”dry_runboolean“true (the default): only say what would change.”undo_batchstring“Instead of pages or pattern: the undo_batch an applied change answered, to put its pages back.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_remove_page_type_ruledeletesdescribed as changing data
“Remove one of the owner’s page type rules (its id from cvl_page_type_rules).”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
3 inputs, 1 required
idstringrequired“The id cvl_page_type_rules lists.”dry_runboolean“true (the default): only say what would go back.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_set_recording_pathscreates or changes datadescribed as changing data
“Set which pages of this site the tag masks or skips.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
4 inputs
mask_pathsarray“Pages whose address is reported as the pattern instead.”skip_pathsarray“Pages where the tag sends nothing.”confirmboolean“true saves.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_set_site_typecreates or changes datadescribed as changing data
“Set what kind of site this is: shop (sells products), service (a business offering services), lead_gen (a business whose site is there to get enquiries), saas (software people sign up for) or content…”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
3 inputs, 1 required
typestringrequired“The kind of site.”dry_runboolean“true (the default): only say what would change.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_set_form_purposecreates or changes datadescribed as changing data
“Set the purpose of forms of this site (their ids from cvl_forms, at most 50), or put them back to the estimate with back_to_estimate:true.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
5 inputs, 1 required
formsarrayrequired“The forms, by the id cvl_forms gives, at most 50.”purposestring“What the forms are for.”back_to_estimateboolean“true: put the forms back to the estimate instead of setting a purpose.”dry_runboolean“true (the default): only say what would change.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_set_event_meaningcreates or changes datadescribed as changing data
“Set the meaning of events this site sends (their names from cvl_event_meanings, at most 50), or put them back to the estimate with back_to_estimate:true.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
5 inputs, 1 required
eventsarrayrequired“The events, by the name cvl_event_meanings gives, at most 50.”meaningstring“What the events mean.”back_to_estimateboolean“true: put the events back to the estimate instead of setting a meaning.”dry_runboolean“true (the default): only say what would change.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_attributionreads or searches
“Each sale, enquiry or sign-up shared out across the visits the buyer made before it, by where each visit came from and the platform (Paid search ads · Google, Social · Instagram).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
8 inputs
modelsarray“The models to compare, each once (all six allowed).”fromstring“First day of sales, enquiries or sign-ups to count, as YYYY-MM-DD.”tostring“Last day of sales, enquiries or sign-ups to count, as YYYY-MM-DD.”lookbackinteger“How many days before each sale, enquiry or sign-up a visit still counts toward it.”goalstring“What counts: purchase (the default, the purchase stage) or any event key, e.g.”first_purchaseboolean“Count only each person's first sale, enquiry or sign-up.”groupstring“platform (default): Paid Search · Google.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_conversion_pathsreads or searches
“The top 20 sequences of sources buyers came through before buying or getting in touch (e.g.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
8 inputs
fromstring“First day of sales, enquiries or sign-ups to count, as YYYY-MM-DD.”tostring“Last day of sales, enquiries or sign-ups to count, as YYYY-MM-DD.”lookbackinteger“How many days before each sale, enquiry or sign-up a visit still counts toward it.”goalstring“What counts: purchase (the default, the purchase stage) or any event key, e.g.”first_purchaseboolean“Count only each person's first sale, enquiry or sign-up.”groupstring“platform (default): Paid Search · Google.”collapseboolean“Merge repeats of the same channel into one step with a count.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_todos_listreads or searches
“The site's to-dos: one row per problem or chance this site's checks found, kept across runs with the owner's answer.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs
tabstring“Which tab: to_do, good_news, fixed, hidden (To do, Good news, Fixed: Fixed — checking and Confirmed fixed, Hidden: Later and Not a problem).”areastring“Only to-dos in this area, like "urgent" or "errors".”fieldsarray“Top-level keys to keep, e.g.”
- cvl_todo_markcreates or changes datadescribed as changing data
“The owner's answer to one to-do: later (Later: hidden for snooze_days, 7 by default, at most 90, then back in To do), not_a_problem (Not a problem: hidden, and the check that found it stops raising i…”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
6 inputs, 2 required
todo_idstringrequired“The to-do’s id, as cvl_todos_list gives it.”markstringrequired“later, not_a_problem, fix_claimed or to_do.”notestring“With fix_claimed: what was changed, in a sentence.”snooze_daysinteger“With later: how many days to hide it.”dry_runboolean“true (the default): only say what would change.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_check_nowcreates or changes datadescribed as changing data
“Check where this site ranks in the top 10 right now for one tracked search (keyword), or for every search a market tracks.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
5 inputs
keywordstring“One tracked search, as typed.”marketinteger“Market as a location code (e.g.”location_codeinteger“Older name for market, still accepted.”devicestring“The device the market is tracked on.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_todo_addcreates or changes datadescribed as changing data
“Add a to-do: the owner's own to-do, in What to do beside the ones the checks found (area tasks, To do).”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
3 inputs, 1 required
titlestringrequired“What needs doing, in a sentence.”dry_runboolean“true (the default): only say what would be added.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_issue_not_a_problemcreates or changes datadescribed as changing data
“Say a Site audit issue is not a problem on this site (a redirect you put there, a page kept out of Google on purpose): it stops counting and is listed under Not a problem.”
Publisher declares: read-only no · destructive yes · idempotent yes · open-world no
4 inputs, 1 required
issuestringrequired“The issue id, as cvl_seo_audit lists it.”not_a_problemboolean“false counts it again (the default is true).”dry_runboolean“A preview unless false (the default is true): nothing changes until the owner says yes.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_seo_draftgenerates contentdescribed as changing data
“Draft a page for one search with Convertlyft’s own writer: the same path as Generate brief then Send to Drafts in the SEO room.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
8 inputs, 1 required
keywordstringrequired“The search the page should rank for, as typed.”page_urlstring“The page on this site the draft is for (full address on the site’s own domain).”marketinteger“Market as a location code (e.g.”forceboolean“Make the brief again even when one from the last 7 days exists.”freshboolean“With force: forget the stored evidence and read the top results again.”dry_runboolean“Buy nothing: answer reuse, the briefs left, and what is missing for a good draft.”confirm_costinteger“Run only if the estimate is at most this; otherwise refuse and buy nothing.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_set_capturecreates or changes datadescribed as changing data
“Choose which visits this site records.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
3 inputs
capturestring“every_visit records every visit; problems_only only the ones that matter.”confirmboolean“true saves.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_search_toolsreads or searches
“Find a Convertlyft tool that is not in your tool list, and the skills (step-by-step playbooks) that fit.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 1 required
querystringrequired“Words for what you want to know, like "rage clicks on a page" or "keyword rankings".”limitinteger“How many tools to return, at most 10.”schemaboolean“true adds each tool’s full inputSchema, scopes and labels.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_call_readruns code or commands
“Run a Convertlyft READ tool that is not in your tool list, by name, with its arguments.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs, 1 required
namestringrequired“The read tool to run, as cvl_search_tools named it.”argumentsobject“Its arguments, as its inputSchema describes them.”fieldsarray“Top-level keys to keep, e.g.”
- cvl_skills_listreads or searches
“The Convertlyft skills: step-by-step playbooks for jobs like spotting where people get stuck, fixing errors, auditing SEO or diagnosing a drop.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
1 input
fieldsarray“Top-level keys to keep, e.g.”
- cvl_skill_readreads or searches
“One Convertlyft skill, in full: its SKILL.md, or one of its reference files when the skill points to one, or one playbook section by its id (a to-do names its section as skill#PB-…).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 1 required
namestringrequired“The skill, as cvl_skills_list names it, like "finding-ux-friction".”filestring“A reference file the skill names, like "references/page-analysis.md".”sectionstring“One playbook section, like "PB-ERR-YOURS".”fieldsarray“Top-level keys to keep, e.g.”
Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. Read 2026-10-23.
How well are its tools described?
Features #4 and #5
How clearly this server's own tool descriptions say what a tool does, and how consistent its tool list is. The first part is an AI model's yes/no reading of each description; the second part is counted. We do not turn it into a grade.
Descriptions
AI reading of each description
- Says what the tool does
- 100% of 64 tools
- Says what it returns
- 100% of 64 tools
- States limits, defaults or errors
- 71% of 63 tools
- Says when to use it
- 100% of 64 tools
- Items covered per tool
- 3.7 of 4 on average
Counted from the listing
- Parameters with a description
- 98% of 309
- Tools with a description
- 100% of 64
- Typical description length
- 531 characters
The tool set
Counted from the listing
- Tools
- 64
- Size of the list
- about 58,963 tokens for an agent to load (characters ÷ 4)
- Naming
- 64 of 64 names use snake_case
AI reading: easy to mix up
No pair found.
The AI items cover 64 of 64 tools: for a tool where two differently worded runs disagreed, that item is left out. They were not checked by hand, and no tool was called. “Easy to mix up” means two tools whose names or descriptions overlap without saying how they differ; the AI found none, comparing tools within groups of 40. We do not rate whether the tool set is complete or whether side effects are spelled out, because our AI reading of those was not reliable enough.
How do I add it to my client?
Config from the registry entry
From the remote endpoint (Streamable HTTP)
We connected to this URL on 2026-10-23 (a read-only session: no tool was called).
Add to CursorAn install link in the format Cursor documents, holding the Cursor config below.
Claude Desktop or claude.ai
Settings → Connectors → Add custom connector, then paste: https://mcp.convertlyft.com/mcp
Cursor · .cursor/mcp.json in a project, or ~/.cursor/mcp.json
{
"mcpServers": {
"convertlyft": {
"url": "https://mcp.convertlyft.com/mcp"
}
}
}VS Code · .vscode/mcp.json
{
"servers": {
"convertlyft": {
"type": "http",
"url": "https://mcp.convertlyft.com/mcp"
}
}
}VS Code (command line) · Bash or zsh terminal (macOS, Linux)
code --add-mcp '{"name":"convertlyft","type":"http","url":"https://mcp.convertlyft.com/mcp"}'Claude Code
claude mcp add --transport http convertlyft https://mcp.convertlyft.com/mcp
Try it in the MCP Inspector · runs on your machine, opens in your browser · Node 22.19+
npx @modelcontextprotocol/inspector@2.11.0 --server-url https://mcp.convertlyft.com/mcp --transport http
- The server runs on the operator's infrastructure; it may ask you to sign in when you first connect.
- The MCP Inspector lists the server's tools, resources and prompts; a tool you call there runs for real.
Built from the server's registry entry with each client's documented format (checked 2026-10-14; the Cursor link and the VS Code command 2026-10-19; the MCP Inspector command 2026-10-21). Values in < > are yours to fill in; this page never contains a key. Where the server needs a setting the entry does not declare, it can still fail to start.
Does the registry listing match what we found?
Feature #6The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.
| Registry says | We found | Result | Source · date |
|---|---|---|---|
| Remote endpoint mcp.convertlyft.com/mcp | Session opened | matches | our test · 2026-10-23 |
| No credential declared as required | Opened a session without any credential | matches | our test · 2026-10-23 |
Choosing
Record checks
Public records · not a safety rating1 of 2 record checks met · 7 do not apply
- Not ranked by downloads: a remote server publishes no download figure
- Not ranked by stars: no public GitHub repository
- MetRegistry entry is active and says how to run itActive, with a package or a remote address.
- Not metSource repository link opensThe registry entry gives no repository link.
- Does not applyRepository is not archivedNo public GitHub repository to read.
- Does not applyCode pushed to the repository in the 90 days before our checkNo public GitHub repository to read.
- Does not applyRepository publishes a security policy (SECURITY.md)No public GitHub repository to read.
- Does not applyPackage names its licence with a standard (SPDX) identifierRemote server: it ships no package.
- Does not applyThe version the registry lists can be installed and is not withdrawnRemote server: it ships no package.
- Does not applynpm package carries build provenance (attestation)Remote server: it ships no package.
- Does not applyNo known critical or high advisory in the package or its dependenciesRemote server: it ships no package.
Read from public records only: the registry entry, npm/PyPI, GitHub and advisory databases, checked 2026-10-22. No tool was called. Only “met” and “not met” are counted, so the total differs between servers; a check that does not apply or that we could not run is listed, never counted against it. It is not a safety rating. How each check works · Leaderboards
Common questions about com.convertlyft/convertlyft
Answered from the data aboveIs com.convertlyft/convertlyft safe to install?
We do not rate servers as safe or unsafe. 1 of its 2 applicable record checks are met (facts from public records, each listed on this page). What the records show: 35 of its tools describe changing data (our AI model's reading of the descriptions). These are facts with their sources on this page, not a safety guarantee, and we did not run its tools.
Does com.convertlyft/convertlyft need an API key or sign-in?
It opened a session without any credential on 2026-10-23. The registry entry declares no required credential; no declaration is not a guarantee.
Has com.convertlyft/convertlyft been security tested?
Partly. 4 of the 16 checks that apply to it were exercised. It accepted a session without any credential and lists tools whose names suggest they change data. We did not call them. No security verdict is published before verification.
What can com.convertlyft/convertlyft do?
It lists 64 tools. In our AI model's reading of their descriptions (two runs had to agree, nobody checked it by hand), they include tools that read or search, create or change data, delete, run code or commands and generate content. We did not call any tool, so this describes the text, not the behaviour.
Can com.convertlyft/convertlyft change or delete data?
35 of its tools say in their description that they create, edit, delete, send or run something (our AI model's reading). We did not call any tool, so we cannot say what actually happens.
Found this page useful?
Anonymous · no sign-inA quick, anonymous reaction — no account, no email. One per kind from your browser. The tally updates when the page is next refreshed, and it is only a rough count, never a safety rating or a measured number of people.
Similar servers
Same topic · AI-read
- io.github.hermoso-ai/hermosoHermosoalso has tools that creates or changes data, deletes, runs code or commands, generates content, reads or searchescompare with this one
- io.github.Misar-AI/misarreach-mcpMisarReach MCP Serveralso has tools that creates or changes data, deletes, runs code or commands, generates content, reads or searchescompare with this one
- io.github.bitsandtea/postking-mcpalso has tools that creates or changes data, deletes, runs code or commands, generates content, reads or searchescompare with this one
- ad.getle/leadsGetleadalso has tools that creates or changes data, deletes, runs code or commands, generates content, reads or searchescompare with this one
- com.socialseal/mcpSocialSealalso has tools that creates or changes data, deletes, runs code or commands, generates content, reads or searchescompare with this one
- ai.userintuition/researchUser Intuitionalso has tools that creates or changes data, deletes, runs code or commands, generates content, reads or searchescompare with this one
Active servers whose topic is also “commerce-and-marketing” and that have at least one tool of the same kind; most kinds in common first, then most GitHub stars. The topic and the tool kinds are an AI model's reading of the publishers' descriptions, not checked by hand. Similar is not a recommendation.
Compare with another server
Side by side: registry entry, our read-only session, the tools and the 18 classification fields. Same values as each page; no score.
Security testing
What did we test, and what did we leave out?
18 checks · features #1, #2
Open without sign-in
It accepted a session without any credential and lists tools whose names suggest they change data. We did not call them. No security score is given; a check we did not run is never counted as passed.
- Inventory: exercised
- Hidden instructions: exercised
- Real execution: not run · our policy
- Secret leak: not run · nothing to check it against
- Internal addresses: not run · our policy
- Unconfirmed changes: not run · our policy
- Bad input: not run · our policy
- Model requests: not run · nothing to check it against
- Sensitive questions: not run · nothing to check it against
- Folder boundary: not run · our policy
- Log leaks: not run · nothing to check it against
- Hidden content: exercised
- Fake assistant turns: not run · an error was returned
- Token passthrough: not applicable
- Token audience: not applicable
- Sign-in redirect: not run · our policy
- Consent handling: not testable from outside
- Sign-in metadata: exercised
4 exercised12 not run (reason given)2 not applicable
Each check ends in exactly one state: exercised, not run (with the reason), or not applicable (with the reason). 4 of the 16 checks that apply to it were exercised. We do not publish security-check outcomes for named servers.
- 1Inventory
tool-listReads the declared tools, resources and prompts.exercised - 2Hidden instructions
description-poisoningLooks for hidden instructions in tool descriptions.exercised - 12Hidden content
audience-hidingChecks resources that hide content from the user.exercised - 18Sign-in metadata
oauth-url-schemeChecks the published sign-in metadata for unsafe URLs.exercised
- 3Real execution
real-executionCalls a tool and checks what really happens.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy - 4Secret leak
canary-leakPlants a fake secret and checks whether it leaks.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against - 5Internal addresses
ssrfChecks whether a tool can be steered to internal addresses.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy - 6Unconfirmed changes
write-without-confirmationChecks whether tools that change data act without asking.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy - 7Bad input
error-handlingSends bad input and watches how the server answers.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy - 8Model requests
samplingChecks whether the server asks the client's model to act for it.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against - 9Sensitive questions
elicitation-sensitive-dataChecks whether the server asks users for sensitive data.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against - 10Folder boundary
root-boundaryChecks whether the server reaches outside the folders it was given.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy - 11Log leaks
logging-side-channelChecks whether log messages carry data they should not.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against - 13Fake assistant turns
fake-assistant-turnChecks prompts that pose as the assistant's own words.The server returned an error when its prompts were read.not run · an error was returned - 16Sign-in redirect
open-redirectChecks the sign-in redirect for abuse.Testing the sign-in redirect means sending probes to the operator's sign-in service, which we do not do.not run · our policy - 17Consent handling
confused-deputyChecks consent handling when one service acts for another.Depends on the operator's own consent screen, which differs per server and cannot be tested from outside.not testable from outside
- 14Token passthrough
token-passthroughChecks whether the server forwards a user's token to other services.The server opened a session without sign-in, so there is no token flow to check.not applicable - 15Token audience
token-audience-validationChecks whether tokens meant for another service are accepted.The server opened a session without sign-in, so there is no token flow to check.not applicable
Source: our own test, 2026-10-23, mcp-runtime-engine@0.1.0. Which checks count and why follows our published scoring model.
What happened during the test?
Feature #8
The steps in order, as the test record holds them.
- 0 msStarted a read-only session with the server's remote endpoint
- 835 msConnected after 0 redirects. No credential was sent or needed.
- Read the inventory: 64 tools, 52 resources, 26 prompts.
- 14,891 msFinished: 4 checks exercised.
Reference
How is it classified?
18 fields
One value per field, each with its source. Fields written by AI models are marked. A field with no value says why.
“Not stated” means the source did not state it; “does not apply” means it does not apply to this kind of server; “our limit” means our own lookup failed. A linked value opens the directory filtered to the same value.
Cite or correct this page
Sources and corrections
Suggested citation
ProtocolProbe. “com.convertlyft/convertlyft: MCP server record.” Data checked 2026-10-23. https://protocolprobe.com/mcp/servers/com.convertlyft/convertlyft
Figures are valid for the date shown. Our facts on this page are CC BY 4.0: reuse them with a link and the check date. Quoted text (the publisher’s descriptions, website quotes, tool names) is not ours to license.
As JSON: this record in the API · API documentation.
Badge for your README
[](https://protocolprobe.com/mcp/servers/com.convertlyft/convertlyft)
It shows this server's record-check count: facts from public records, no tool called. It is not a security rating or a pass. It links here and updates after each data reload.
Something wrong, or is this yours?
If a fact here is wrong, tell us and we will re-check it. If you operate this server, you can run our checks on it yourself with the free self-test command; we call no server’s tools ourselves for anything shown here.
Write to hello@protocolprobe.com · corrections log · methodology