MCP servers › com.opentext › sdp-remote-mcp
MCP server · registry snapshot 2026-10-23 · last tested 2026-10-23
com.opentext/sdp-remote-mcp
Model Context Protocol server for OpenText Software Delivery Platform. — the publisher's description
Summary
com.opentext/sdp-remote-mcp is a remote MCP server listed in the official MCP registry at version 1.0.0.
Record checks
4 of 5 record checks met · 4 do not apply
- met: Registry entry is active and says how to run it
- met: Source repository link opens
- met: Repository is not archived
- met: Code pushed to the repository in the 90 days before our check
- not met: Repository publishes a security policy (SECURITY.md)
- not applicable: Package names its licence with a standard (SPDX) identifier
- not applicable: The version the registry lists can be installed and is not withdrawn
- not applicable: npm package carries build provenance (attestation)
- not applicable: No known critical or high advisory in the package or its dependencies
- Not ranked by downloads: a remote server publishes no download figure
- Not ranked by stars: 2 stars (ranked from 10)
From public records, not a safety rating. Each check with its reason · Is it safe to install?
Key facts
- Runs
- remote (hosted by the publisher)
- Transport
- streamable HTTP
- Sign-in
- required
- Repository
- public
- Topic
- developer-toolsAI-classified
- Last tested
- 2026-10-23
How fresh this is
- Live-tested
- attempted, see below
- Last tested
- 2026-10-23
- Latest version
- 1.0.0, published 2026-10-14 (registry, as of the 2026-10-23 snapshot)
- First listed version
- 2026-10-14 (earliest version still in the registry; older removed versions would be earlier)
- Registry data
- snapshot 2026-10-23
- Package and repository
- checked 2026-10-22
- Engine
- mcp-runtime-engine@0.1.0 · sdk@1.32.0
Changes since the last refresh
New in the registry: not in the list of 2026-10-04, listed on 2026-10-23 with version 1.0.0 (published 2026-10-14).
Source: the official MCP Registry list on 2026-10-04 and on 2026-10-23.
What it is
How do I add it to my client?
Config from the registry entry
From the remote endpoint (Streamable HTTP)
This entry needs values of your own (marked < > or { } in the config below), so there is no one-click link: paste the config and fill them in.
Claude Desktop or claude.ai
Settings → Connectors → Add custom connector, then paste:
https://almoctane-{region}.saas.microfocus.com/mcpCursor · .cursor/mcp.json in a project, or ~/.cursor/mcp.json
{
"mcpServers": {
"sdp-remote-mcp": {
"url": "https://almoctane-{region}.saas.microfocus.com/mcp"
}
}
}VS Code · .vscode/mcp.json
{
"servers": {
"sdp-remote-mcp": {
"type": "http",
"url": "https://almoctane-{region}.saas.microfocus.com/mcp"
}
}
}Claude Code
claude mcp add --transport http sdp-remote-mcp "https://almoctane-{region}.saas.microfocus.com/mcp"Try it in the MCP Inspector · runs on your machine, opens in your browser · Node 22.19+
npx @modelcontextprotocol/inspector@2.11.0 --server-url "https://almoctane-{region}.saas.microfocus.com/mcp" --transport http- The URL contains parts in { } that the entry marks as variables; replace them with your own values.
- The server runs on the operator's infrastructure; it may ask you to sign in when you first connect.
- The MCP Inspector lists the server's tools, resources and prompts; a tool you call there runs for real.
Built from the server's registry entry with each client's documented format (checked 2026-10-14; the Cursor link and the VS Code command 2026-10-19; the MCP Inspector command 2026-10-21). Values in < > are yours to fill in; this page never contains a key. Where the server needs a setting the entry does not declare, it can still fail to start.
Does the registry listing match what we found?
Feature #6The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.
| Registry says | We found | Result | Source · date |
|---|---|---|---|
| Remote endpoint almoctane-{region}.saas.microfocus.com/mcp | Endpoint answered and asked for sign-in | matches | our test · 2026-10-23 |
| No credential declared as required | Required sign-in | differs | our test · 2026-10-23 |
| Repository github.com/opentext/OpenText-Model-Context-Protocol-Server | Opens publicly | matches | api.github.com · 2026-10-22 |
Who made it?
Feature #7 · lineage
Facts about the publisher. We do not turn them into a trust score.
- Namespace
- com.opentext
- GitHub owner
- an organization (opentext)
- Repository
- github.com/opentext/OpenText-Model-Context-Protocol-Server
- Stars
- 2
- Repository age
- 0–30 days
- Last push
- 0–30 days ago
- Archived
- no
- Security policy
- none found (we looked for SECURITY.md in the repository and in its owner’s .github repository)
Source: the registry entry and api.github.com · 2026-10-22; security policy read from GitHub · 2026-10-23.
Publish this server? Run these checks against it yourself before release, from your own machine: a server the command starts, or your own server at its URL after a one-time proof that you control it: npx protocolprobe-selftest.
Choosing
Record checks
Public records · not a safety rating4 of 5 record checks met · 4 do not apply
- Not ranked by downloads: a remote server publishes no download figure
- Not ranked by stars: 2 stars (ranked from 10)
- MetRegistry entry is active and says how to run itActive, with a package or a remote address.
- MetSource repository link opensThe linked GitHub repository is public.
- MetRepository is not archivedNot archived.
- MetCode pushed to the repository in the 90 days before our checkLast push 0-30 days before our check.
- Not metRepository publishes a security policy (SECURITY.md)No SECURITY.md in the places GitHub reads it from.
- Does not applyPackage names its licence with a standard (SPDX) identifierRemote server: it ships no package.
- Does not applyThe version the registry lists can be installed and is not withdrawnRemote server: it ships no package.
- Does not applynpm package carries build provenance (attestation)Remote server: it ships no package.
- Does not applyNo known critical or high advisory in the package or its dependenciesRemote server: it ships no package.
Read from public records only: the registry entry, npm/PyPI, GitHub and advisory databases, checked 2026-10-22. No tool was called. Only “met” and “not met” are counted, so the total differs between servers; a check that does not apply or that we could not run is listed, never counted against it. It is not a safety rating. How each check works · Leaderboards
Common questions about com.opentext/sdp-remote-mcp
Answered from the data aboveIs com.opentext/sdp-remote-mcp safe to install?
We do not rate servers as safe or unsafe. 4 of its 5 applicable record checks are met (facts from public records, each listed on this page). What the records show: Its source repository opens publicly. Its repository had a push in the last 90 days. These are facts with their sources on this page, not a safety guarantee, and we did not run its tools.
Does com.opentext/sdp-remote-mcp need an API key or sign-in?
It required sign-in on 2026-10-23. The registry entry declares no required credential; no declaration is not a guarantee.
Has com.opentext/sdp-remote-mcp been security tested?
Partly. 1 of the 18 checks that apply to it was exercised. The server requires sign-in. We never use a credential its operator did not give us, so most checks could not run. No security verdict is published before verification.
Does com.opentext/sdp-remote-mcp publish a security policy?
We found no SECURITY.md in its repository (root, .github/ or docs/) or in its owner's .github repository.
Where is the source code of com.opentext/sdp-remote-mcp?
In github.com/opentext/OpenText-Model-Context-Protocol-Server, which opens publicly.
Found this page useful?
Anonymous · no sign-inA quick, anonymous reaction — no account, no email. One per kind from your browser. The tally updates when the page is next refreshed, and it is only a rough count, never a safety rating or a measured number of people.
Similar servers
Same topic · AI-read
- io.github.morluto/reaREAcompare with this one
- io.github.ruvnet/claude-flowcompare with this one
- io.github.thedaviddias/front-end-checklistFront-End Checklistcompare with this one
- io.github.ChromeDevTools/chrome-devtools-mcpChrome DevTools MCPcompare with this one
- io.github.secforge/chrome-devtools-mcpChrome DevTools MCPcompare with this one
- io.github.DeusData/codebase-memory-mcpCodebase Memorycompare with this one
Active servers whose topic is also “developer-tools”, most GitHub stars first. The topic and the tool kinds are an AI model's reading of the publishers' descriptions, not checked by hand. Similar is not a recommendation.
Compare with another server
Side by side: registry entry, our read-only session, the tools and the 18 classification fields. Same values as each page; no score.
Security testing
What did we test, and what did we leave out?
18 checks · features #1, #2
Needs the operator's credential
The server requires sign-in. We never use a credential its operator did not give us, so most checks could not run. No security score is given; a check we did not run is never counted as passed.
Why not security-tested: The server required a sign-in before it would list anything, and we never use a credential its operator did not give us. Its operator can test it with their own credential, on their own machine, with our self-test command (/docs/selftest). — the server's own choice
- Inventory: not run · needs the operator's credential
- Hidden instructions: not run · needs the operator's credential
- Real execution: not run · needs the operator's credential
- Secret leak: not run · needs the operator's credential
- Internal addresses: not run · needs the operator's credential
- Unconfirmed changes: not run · needs the operator's credential
- Bad input: not run · needs the operator's credential
- Model requests: not run · needs the operator's credential
- Sensitive questions: not run · needs the operator's credential
- Folder boundary: not run · needs the operator's credential
- Log leaks: not run · needs the operator's credential
- Hidden content: not run · needs the operator's credential
- Fake assistant turns: not run · needs the operator's credential
- Token passthrough: not run · needs the operator's credential
- Token audience: not run · needs the operator's credential
- Sign-in redirect: not run · our policy
- Consent handling: not testable from outside
- Sign-in metadata: exercised
1 exercised17 not run (reason given)0 not applicable
Each check ends in exactly one state: exercised, not run (with the reason), or not applicable (with the reason). 1 of the 18 checks that apply to it was exercised. We do not publish security-check outcomes for named servers.
- 18Sign-in metadata
oauth-url-schemeChecks the published sign-in metadata for unsafe URLs.exercised
- 1Inventory
tool-listReads the declared tools, resources and prompts.The server requires sign-in, and we never use a credential its operator did not give us.not run · needs the operator's credential - 2Hidden instructions
description-poisoningLooks for hidden instructions in tool descriptions.The server requires sign-in, and we never use a credential its operator did not give us.not run · needs the operator's credential - 3Real execution
real-executionCalls a tool and checks what really happens.The server requires sign-in, and we never use a credential its operator did not give us.not run · needs the operator's credential - 4Secret leak
canary-leakPlants a fake secret and checks whether it leaks.The server requires sign-in, and we never use a credential its operator did not give us.not run · needs the operator's credential - 5Internal addresses
ssrfChecks whether a tool can be steered to internal addresses.The server requires sign-in, and we never use a credential its operator did not give us.not run · needs the operator's credential - 6Unconfirmed changes
write-without-confirmationChecks whether tools that change data act without asking.The server requires sign-in, and we never use a credential its operator did not give us.not run · needs the operator's credential - 7Bad input
error-handlingSends bad input and watches how the server answers.The server requires sign-in, and we never use a credential its operator did not give us.not run · needs the operator's credential - 8Model requests
samplingChecks whether the server asks the client's model to act for it.The server requires sign-in, and we never use a credential its operator did not give us.not run · needs the operator's credential - 9Sensitive questions
elicitation-sensitive-dataChecks whether the server asks users for sensitive data.The server requires sign-in, and we never use a credential its operator did not give us.not run · needs the operator's credential - 10Folder boundary
root-boundaryChecks whether the server reaches outside the folders it was given.The server requires sign-in, and we never use a credential its operator did not give us.not run · needs the operator's credential - 11Log leaks
logging-side-channelChecks whether log messages carry data they should not.The server requires sign-in, and we never use a credential its operator did not give us.not run · needs the operator's credential - 12Hidden content
audience-hidingChecks resources that hide content from the user.The server requires sign-in, and we never use a credential its operator did not give us.not run · needs the operator's credential - 13Fake assistant turns
fake-assistant-turnChecks prompts that pose as the assistant's own words.The server requires sign-in, and we never use a credential its operator did not give us.not run · needs the operator's credential - 14Token passthrough
token-passthroughChecks whether the server forwards a user's token to other services.Needs a real token issued by the server's own sign-in service, which only its operator can give us.not run · needs the operator's credential - 15Token audience
token-audience-validationChecks whether tokens meant for another service are accepted.Needs a real token issued by the server's own sign-in service, which only its operator can give us.not run · needs the operator's credential - 16Sign-in redirect
open-redirectChecks the sign-in redirect for abuse.Testing the sign-in redirect means sending probes to the operator's sign-in service, which we do not do.not run · our policy - 17Consent handling
confused-deputyChecks consent handling when one service acts for another.Depends on the operator's own consent screen, which differs per server and cannot be tested from outside.not testable from outside
Source: our own test, 2026-10-23, mcp-runtime-engine@0.1.0. Which checks count and why follows our published scoring model.
What happened during the test?
Feature #8
The steps in order, as the test record holds them.
- 0 msStarted a session with the server's remote endpoint
- The server asked for sign-in before listing anything.
- 2,825 msFinished: 1 check exercised.
Reference
How is it classified?
18 fields
One value per field, each with its source. Fields written by AI models are marked. A field with no value says why.
“Not stated” means the source did not state it; “does not apply” means it does not apply to this kind of server; “our limit” means our own lookup failed. A linked value opens the directory filtered to the same value.
Cite or correct this page
Sources and corrections
Suggested citation
ProtocolProbe. “com.opentext/sdp-remote-mcp: MCP server record.” Data checked 2026-10-23. https://protocolprobe.com/mcp/servers/com.opentext/sdp-remote-mcp
Figures are valid for the date shown. Our facts on this page are CC BY 4.0: reuse them with a link and the check date. Quoted text (the publisher’s descriptions, website quotes, tool names) is not ours to license.
As JSON: this record in the API · API documentation.
Badge for your README
[](https://protocolprobe.com/mcp/servers/com.opentext/sdp-remote-mcp)
It shows this server's record-check count: facts from public records, no tool called. It is not a security rating or a pass. It links here and updates after each data reload.
Something wrong, or is this yours?
If a fact here is wrong, tell us and we will re-check it. If you operate this server, you can run our checks on it yourself with the free self-test command; we call no server’s tools ourselves for anything shown here.
Write to hello@protocolprobe.com · corrections log · methodology