MCP servers › io.github.bck-stack › sitecheck-agent-intel-dev

MCP server · registry snapshot 2026-10-24 · last tested 2026-10-24

io.github.bck-stack/sitecheck-agent-intel-dev

135 pay-per-call agent tools: agent intelligence, token risk, developer and AI data tools. x402 — the publisher's description

1 of 2 record checks metRead-only · tools listed 2026-10-24version 1.0.0streamable HTTP135 tools

Summary

io.github.bck-stack/sitecheck-agent-intel-dev is a remote MCP server listed in the official MCP registry at version 1.0.0. On 2026-10-24 ProtocolProbe connected to it in read-only mode and read its inventory: 135 tools, 0 resources and 0 prompts.

Record checks

1 of 2 record checks met · 7 do not apply

met: Registry entry is active and says how to run it
not met: Source repository link opens
not applicable: Repository is not archived
not applicable: Code pushed to the repository in the 90 days before our check
not applicable: Repository publishes a security policy (SECURITY.md)
not applicable: Package names its licence with a standard (SPDX) identifier
not applicable: The version the registry lists can be installed and is not withdrawn
not applicable: npm package carries build provenance (attestation)
not applicable: No known critical or high advisory in the package or its dependencies

From public records, not a safety rating. Each check with its reason

Key facts

Runs: remote (hosted by the publisher)
Transport: streamable HTTP
Sign-in: none needed to open a session
Tools: 135
Last tested: 2026-10-24

Add to your client

How fresh this is

Live-tested: yes, a real session (not a text-only review)
Last tested: 2026-10-24
Mode: read-only (no tool calls)
Latest version: 1.0.0, published 2026-10-23 (registry, as of the 2026-10-24 snapshot)
First listed version: 2026-10-23 (earliest version still in the registry; older removed versions would be earlier)
Registry data: snapshot 2026-10-24
Package and repository: checked 2026-10-24
Engine: mcp-runtime-engine@0.1.0 · sdk@1.32.0

Changes since the last refresh

New in the registry: not in the list of 2026-10-23, listed on 2026-10-24 with version 1.0.0 (published 2026-10-23).

Source: the official MCP Registry list on 2026-10-23 and on 2026-10-24.

What it is

What does this server offer?

Observed inventory

135tools

0resources

0prompts

None of its 135 tools are described as changing anything. For 135 the reading was uncertain, so no mark is shown.

agent_intel_deep_research
“Research starter: searches English Wikipedia (not the open web) for a query and returns the top articles with their summary text, description and last edit time.”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- querystringrequired“Research question or keywords, 2 to 200 characters”
- limitnumber“How many articles, 1 to 5 (default 3)”
agent_intel_web_search_turbo
“Web search via DuckDuckGo's public HTML results page: ranked titles, direct result URLs and snippets, no ads.”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- qstringrequired“Search query, 2 to 200 characters”
- limitstring“How many results, 1 to 10 (default 5)”
agent_intel_news_radar
“Latest BBC News headlines from one section feed (world, business, technology, science_and_environment, health, politics) with summary, link and publication time, optionally filtered by a keyword.”
Publisher declares: read-only yes · open-world yes
3 inputs
- sectionstring“world, business, technology, science_and_environment, health or politics (default world)”
- qstring“Optional keyword, 2 to 80 characters, matched in title or summary”
- limitstring“How many items, 1 to 30 (default 10)”
agent_intel_social_signal_aggregator
“Keyword discussion velocity on Hacker News (Algolia HN Search, public): stories in the last 24 hours, stories in the last 7 days, velocity (24h count vs.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- keywordstringrequired“Keyword or short phrase, 2 to 80 characters”
agent_intel_reader_markdown_extract
“Reader view of one public https page: its <title> and the <main> or <article> content (else <body>) as Markdown, with links and images resolved.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- urlstringrequired“Public https:// (or http://) page address, up to 2048 characters”
agent_intel_viral_trending_radar
“Today's trending Google searches for one country (public Google Trends RSS): rank, query, approximate search volume (e.g.”
Publisher declares: read-only yes · open-world yes
1 input
- geostring“Two-letter country code, e.g.”
agent_intel_domain_authority_credibility
“Registration facts for a domain from the public RDAP directory: registration date, age in days, expiry, registrar, lock status.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- domainstringrequired“Domain name such as wikipedia.org (a full URL is accepted and reduced to its host)”
agent_intel_live_page_diff
“Compares a public page now with its earliest Internet Archive (Wayback) snapshot on or after a date: changed yes/no, word similarity, added and removed text lines, and the price-like amounts ($, €, £…”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- urlstringrequired“Public http(s) page address”
- sincestring“Baseline date YYYY-MM-DD (default: 30 days ago)”
agent_intel_fact_brief_synthesizer
“Entity brief for a statement: finds up to 3 capitalised names or phrases in it and looks each up in Wikidata (public knowledge graph), returning the Wikidata ID, label, short description and link.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- statementstringrequired“Sentence or short text, 10 to 1000 characters”
agent_intel_citation_verifier
“Checks up to 5 references against public registries: DOI through Crossref, arXiv ids through the arXiv API, ISBN-10/13 through Open Library (checksum first).”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- referencesarrayrequired“1 to 5 DOIs, arXiv ids (arXiv:1706.03762) or ISBNs”
agent_intel_token_verdict_engine
“PASS / CAUTION / AVOID verdict for an EVM token (Base, Ethereum, BSC, Arbitrum, Polygon) from GoPlus token security (honeypot flag, buy/sell tax, open source, proxy, top holder share) and DexScreener…”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- chainstring“base, ethereum, bsc, arbitrum or polygon (default base)”
- addressstringrequired“Token contract address 0x...”
agent_intel_honeypot_trap_detector
“Trap flags for an EVM token (Ethereum, BSC, Base, Arbitrum, Polygon) from GoPlus token security, which simulates buy and sell: honeypot result, buy/sell/transfer tax, blacklist, pausable transfers, h…”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- chainstring“ethereum, bsc, base, arbitrum or polygon (default ethereum)”
- addressstringrequired“Token contract address 0x...”

Show 88 more tools

agent_intel_liquidity_lock_inspector
“Share of a token's LP tokens that are burned (dead or zero address) or locked, from GoPlus lp_holders on Ethereum, BSC, Base, Arbitrum or Polygon.”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- chainstring“ethereum, bsc, base, arbitrum or polygon (default ethereum)”
- addressstringrequired“Token contract address 0x...”
agent_intel_bundle_sniper_detector
“Looks at the first Solana slot where a token mint appears (public RPC): if its history fits in 8 pages of signatures, it counts the distinct fee payers of the transactions in that slot.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- mintstringrequired“Solana token mint address (base58, 32 to 44 characters)”
agent_intel_deployer_rug_forensics
“Contracts created by a deployer wallet on Ethereum, from its most recent 50 transactions (Blockscout public API): creation hash, time and new contract address.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- addressstringrequired“Deployer wallet address 0x...”
agent_intel_holder_cluster_analyzer
“Holder concentration for an EVM token (Ethereum, BSC, Base, Arbitrum, Polygon): share of supply held by the top 1, top 3 and top 10 holders, total holder count, and how much of the top 10 are contrac…”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- chainstring“ethereum, bsc, base, arbitrum or polygon (default ethereum)”
- addressstringrequired“Token contract address 0x...”
agent_intel_solana_authority_audit
“Solana SPL token mint audit from the public Solana RPC: is the mint authority revoked (no more minting), is the freeze authority revoked, supply and decimals.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- mintstringrequired“Solana token mint address (base58, 32 to 44 characters)”
agent_intel_wallet_forensic_profiler
“Ethereum wallet profile from Blockscout: ETH balance, contract or EOA, ENS name, Blockscout scam flag and reputation, public tags, and activity over its most recent 50 transactions.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- addressstringrequired“Ethereum wallet or contract address 0x...”
agent_intel_token_composite_safety_score
“Fixed-weight 0-100 safety score for an EVM token (Base, Ethereum, BSC, Arbitrum, Polygon): contract (40 pts: honeypot, taxes, verified source, proxy), liquidity (30 pts: deepest DEX pair) and holder …”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- chainstring“base, ethereum, bsc, arbitrum or polygon (default base)”
- addressstringrequired“Token contract address 0x...”
agent_intel_bytecode_similarity_radar
“Compares the runtime bytecode of two Ethereum contracts you name: the share of shared PUSH4 function selectors (Jaccard) and the cosine similarity of their opcode frequencies, combined into one 0 to …”
Publisher declares: read-only yes · open-world yes
2 inputs, 2 required
- astringrequired“First contract address 0x...”
- bstringrequired“Second contract address 0x...”
agent_intel_anti_whale_limit_detector
“Static search of a VERIFIED Ethereum contract's Solidity source (Blockscout) for max-wallet, max-transaction and cooldown rules, with the matching lines.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- addressstringrequired“Ethereum contract address 0x...”
agent_intel_wash_trading_volume_filter
“Volume plausibility check for an EVM token's DEX pairs (DexScreener): 24h volume against liquidity, average trade size from 24h trade counts, and buy/sell balance, for the 3 deepest pairs.”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- chainstring“Chain name as DexScreener uses it, e.g.”
- addressstringrequired“Token contract or mint address”
agent_intel_sybil_airdrop_farmer_check
“Checks 2 to 10 Ethereum wallets for shared counterparties: addresses that several of them sent to or received from in their most recent 50 transactions (Blockscout).”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- walletsstringrequired“2 to 10 Ethereum addresses separated by commas”
agent_intel_known_scams_blacklist_db
“Is this address or domain on the ScamSniffer community blacklist (public GitHub scam-database: wallet addresses, or phishing domains with their linked addresses)?”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- querystringrequired“An Ethereum address (0x...) or a domain name such as degenalgo.art”
agent_intel_token_liquidity_migration_watch
“Snapshot of a token's DEX pool liquidity now (DexScreener, deepest pair and every pair's USD liquidity).”
Publisher declares: read-only yes · open-world yes
3 inputs, 1 required
- chainstring“base, ethereum, bsc, arbitrum, polygon or solana (default base)”
- addressstringrequired“Token contract or mint address”
- previousLiquidityUsdstring“Optional: the deepest-pool liquidityUsd from your previous call”
agent_intel_whale_transaction_monitor
“Large transfers on Ethereum in the latest 1 to 10 blocks (default 5, about one minute of chain time): native ETH transfers valued at the current ETH price, and USDT and USDC token transfers, each at …”
Publisher declares: read-only yes · open-world yes
3 inputs
- minUsdstring“Minimum USD value, 1000 to 100000000 (default 100000)”
- blocksstring“Latest blocks to scan, 1 to 10 (default 5)”
- assetsstring“Comma list of eth, usdt, usdc (default all three)”
agent_intel_smart_money_inflow_tracker
“Finds the top-ROI accounts on Hyperliquid's public perp leaderboard (week, month or all-time window, with a minimum account size) and reads their live open positions from Hyperliquid's public info AP…”
Publisher declares: read-only yes · open-world yes
4 inputs
- windowstring“Ranking window: day, week, month or allTime (default month)”
- topstring“How many top-ROI accounts to read, 3 to 25 (default 15)”
- minAccountUsdstring“Minimum account value in USD for an account to count, 10000 to 100000000 (default 100000)”
- coinstring“Optional coin symbol to focus on, e.g.”
agent_intel_dex_depth_slippage_calculator
“Estimated output, price impact and minimum output for a swap in one DEX pair, using the pair's reserves from DexScreener and a constant-product (x*y=k) model with a fee.”
Publisher declares: read-only yes · open-world yes
6 inputs, 2 required
- chainstring“DexScreener chain name, e.g.”
- pairstringrequired“Pair (pool) address”
- sidestring“sell = you give the base token; buy = you give the quote token (default sell)”
- amountstringrequired“Amount you give, in that token's units (positive number)”
- feePctstring“Pool fee in percent, 0 to 5 (default 0.3)”
- slippagePctstring“Your tolerance in percent, 0 to 50 (default 0.5)”
agent_intel_perp_funding_rate_heatmap
“Current perpetual-futures funding rate for one coin (USDT-margined) on Binance, OKX and Bybit, with each rate annualised (3 payments a day), mark price, and from Bybit: open interest value and the lo…”
Publisher declares: read-only yes · open-world yes
1 input
- symbolstring“Coin ticker, 2 to 10 letters, e.g.”
agent_intel_options_implied_volatility
“Deribit option market summary for BTC, ETH or SOL: put/call open-interest and volume ratios, max-pain strike and ATM mark implied volatility for the nearest expiries.”
Publisher declares: read-only yes · open-world yes
1 input
- currencystring“BTC, ETH or SOL (default BTC)”
agent_intel_leverage_liquidation_levels
“For one perpetual on Hyperliquid (public info API): mark price, open interest (in coins and USD), funding rate, and estimated liquidation prices for longs and shorts at 5x, 10x, 20x and 50x.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- coinstringrequired“Perp coin name as Hyperliquid lists it, e.g.”
agent_intel_cex_exchange_reserve_flows
“Ethereum native-ETH balance snapshot of up to 10 wallets that a community label dataset (brianleect/etherscan-labels, GitHub) tags as Binance, Coinbase or OKX.”
Publisher declares: read-only yes · open-world yes
1 input
- exchangestring“binance, coinbase or okx (default binance)”
agent_intel_onchain_mvrv_valuation
“Daily MVRV ratio (market cap / realized cap) for BTC or ETH from CoinMetrics' free community data, with the latest value, the window mean and standard deviation, and its z-score.”
Publisher declares: read-only yes · open-world yes
2 inputs
- assetstring“btc or eth (default btc)”
- daysstring“Window in days, 30 to 365 (default 365)”
agent_intel_sopr_profit_taking_ratio
“Bitcoin Spent Output Profit Ratio (SOPR) daily series for all holders, short-term holders (sth) or long-term holders (lth) from the free bitcoin-data.com (BGeometrics) API, with the latest value, 7/3…”
Publisher declares: read-only yes · open-world yes
2 inputs
- cohortstring“all, sth (short-term holders) or lth (long-term holders); default all”
- daysstring“Window in days, 14 to 365 (default 90)”
agent_intel_crosschain_gas_priority_fee
“Current base fee and priority-fee percentiles (10th, 50th, 99th) for Ethereum, Base or Arbitrum from public RPC nodes, with the next block's base fee projected from the last block's fullness (EIP-155…”
Publisher declares: read-only yes · open-world yes
1 input
- chainstring“ethereum, base or arbitrum (default ethereum)”
agent_intel_mev_sandwich_risk_analyzer
“Theoretical sandwich-attack profit for a swap of a given size in one DEX pool, at the pool's current reserves (DexScreener) and the swap's slippage tolerance: the largest front-run that still lets th…”
Publisher declares: read-only yes · open-world yes
6 inputs, 2 required
- chainstring“DexScreener chain name, e.g.”
- pairstringrequired“Pool (pair) address”
- sidestring“sell = victim gives base token; buy = victim gives quote token (default sell)”
- amountstringrequired“Victim's input amount in that token's units”
- slippagePctstring“Victim's slippage tolerance in percent, 0 to 50 (default 1)”
- feePctstring“Pool fee in percent, 0 to 5 (default 0.3)”
agent_intel_wallet_pnl_performance_audit
“Estimated current value of the token amounts a wallet received minus sent in its most recent 50 ERC-20 transfers (Blockscout), priced at current DefiLlama prices.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- addressstringrequired“Ethereum wallet address 0x...”
agent_intel_cross_chain_bridge_liquidity
“Across bridge limits for USDC between two chains: the largest instant-fill amount the bridge can take right now, the largest deposit it accepts, and the smallest deposit.”
Publisher declares: read-only yes · open-world yes
2 inputs, 2 required
- fromstringrequired“Origin chain id: 1 (Ethereum), 10 (Optimism), 137 (Polygon), 8453 (Base) or 42161 (Arbitrum)”
- tostringrequired“Destination chain id, same list as from”
agent_intel_stablecoin_peg_integrity_radar
“Current USD price and deviation from the $1 peg for USDT, USDC, DAI, FDUSD and PYUSD (CoinGecko public price data).”
Publisher declares: read-only yes · open-world yes
1 input
- coinsstring“Comma list of: tether, usd-coin, dai, first-digital-usd, paypal-usd (default tether,usd-coin,dai)”
agent_intel_defi_yield_risk_optimizer
“Ranks DeFi pools by total APY from DefiLlama's public yields data, filtered by chain, minimum TVL and optional stablecoin-only, with each pool's TVL, 7-day impermanent loss, reward share of APY and I…”
Publisher declares: read-only yes · open-world yes
5 inputs
- chainstring“Chain name as DefiLlama spells it, e.g.”
- minTvlUsdstring“Minimum pool TVL in USD (default 1000000)”
- limitstring“How many pools, 1 to 20 (default 5)”
- stablecoinOnlystring“true to list only stablecoin pools”
- maxApyPctstring“Hide pools above this APY percent (default 1000); extreme APYs are usually reward-token artefacts”
agent_intel_prompt_injection_firewall
“Screens one text for prompt-injection patterns in English (instruction override, role or system-prompt extraction, jailbreak personas, hidden or encoded instructions) using a fixed rule list based on…”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- textstringrequired“The text to screen, 1 to 20000 characters”
agent_intel_scam_phishing_message_filter
“Screens one message (DM, email or chat text) for common crypto and phishing scam signals in English: urgency, fake support or giveaway, wallet-connect or seed-phrase requests, guaranteed returns, and…”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- textstringrequired“The message to screen, 1 to 10000 characters”
agent_intel_x402_endpoint_health_vetting
“Checks an x402 (HTTP 402 payment) endpoint before you pay: one unpaid GET, then the HTTP status, whether a 402 challenge with an accepts list is present, the payment networks, asset, price and pay-to…”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- urlstringrequired“Public https:// endpoint address”
agent_intel_ofac_sanctions_preflight
“Name screening against the US OFAC SDN list (with aliases, sanctions programs, type and addresses, via the US Consolidated Screening List API) and the UN Security Council consolidated list, returning…”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- namestringrequired“Person or company name, 3 to 100 characters”
- fuzzystring“true for fuzzy SDN name matching (default false)”
agent_intel_agent_json_schema_guard
“Checks an agent's JSON output against a JSON Schema (draft 2020-12 keywords: type, properties, required, additionalProperties, items, enum, const, length, pattern, minimum/maximum, item counts).”
Publisher declares: read-only yes · open-world yes
2 inputs, 2 required
- schemaobjectrequired“The JSON Schema”
- valuerequired“The JSON value to check (any JSON)”
agent_intel_pii_credentials_redaction
“Masks likely secrets and personal data in agent logs or chat text: 0x private keys (64 hex), labelled base58 private keys, JWTs, AWS access key ids, common API token prefixes (sk-, ghp_, xoxb-), paym…”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- textstringrequired“Text to redact, 1 to 50000 characters”
agent_intel_smart_contract_linter_audit
“Heuristic Solidity linter for a snippet or file (up to 60000 characters): unchecked low-level call/send/delegatecall, value-sending external calls before a storage write (possible reentrancy), arithm…”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- sourcestringrequired“Solidity source text, 10 to 60000 characters”
agent_intel_ssl_certificate_transparency
“Recent TLS certificates logged for a domain (Certificate Transparency via Cert Spotter's public index): issuer, validity dates, names on the certificate, and any name outside the domain.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- domainstringrequired“Domain such as example.org (a URL is reduced to its host)”
agent_intel_typosquat_phishing_domain_radar
“For a brand domain (e.g.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- brandstringrequired“Brand domain such as paypal.com (a URL is reduced to its host)”
agent_intel_ip_fraud_reputation_score
“IP type check: country, ISP and ASN, whether the address is a known Tor exit (Tor Project's public list), a proxy or VPN and a hosting/datacenter address (ip-api.com flags), and a LOW/MEDIUM/HIGH lev…”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- ipstringrequired“IPv4 address such as 8.8.8.8”
agent_intel_hallucination_claim_checker
“Checks the named entities in an AI answer (up to 5 capitalised names) against Wikidata: each name is marked found or not found, with its Wikidata ID and description, and sentences containing a year a…”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- textstringrequired“The model answer to check, 10 to 5000 characters”
agent_intel_api_sla_liveness_benchmark
“Liveness and latency of one public HTTPS endpoint, measured from this server: three GET requests, returning each HTTP status and the time to the response headers, the median and the worst time, and a…”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- urlstringrequired“Public https:// endpoint address”
agent_intel_cors_security_misconfig_audit
“CORS check for a public HTTPS endpoint: three GET requests with a made-up origin, the null origin and no origin, reporting whether the server echoes the origin, allows null, returns a wildcard, and a…”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- urlstringrequired“Public https:// endpoint address”
agent_intel_subdomain_takeover_monitor
“Subdomain takeover check: lists up to 10 subdomains seen in certificate transparency logs for a domain (Cert Spotter), fetches each over HTTPS, and flags pages that show a known 'unclaimed service' m…”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- domainstringrequired“Domain such as example.org (a URL is reduced to its host)”
agent_intel_dnssec_trust_chain_validator
“DNSSEC status for a domain using Cloudflare's public resolver (1.1.1.1 DNS-over-HTTPS): whether the resolver validated the answer (AD flag), the DS records in the parent zone, and the DNSKEY records …”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- domainstringrequired“Domain such as ietf.org (a URL is reduced to its host)”
agent_intel_invoice_document_ocr
“Extracts vendor name, tax ID, line items, net subtotal, VAT rates and payment details (IBAN, BIC) from an invoice image (PNG or JPEG, a public https URL or base64, up to 4 MB) sent straight to a Clou…”
Publisher declares: read-only yes · open-world yes
3 inputs
- imageUrlstring“Public https URL of the invoice image (PNG or JPEG), up to 4 MB”
- imageBase64string“Or the image itself: base64 data (no data: prefix), up to 4 MB decoded”
- mimestring“With imageBase64: image/png or image/jpeg (default image/png)”
agent_intel_gleif_corporate_lei_registry
“Legal entity identifier (LEI) records from GLEIF's public database: search by legal name (up to 5 matches) or look up one 20-character LEI.”
Publisher declares: read-only yes · open-world yes
2 inputs
- namestring“Legal name to search, 3 to 100 characters (or leave out and use lei)”
- leistring“20-character LEI for an exact lookup”
agent_intel_eu_vies_vat_batch_validator
“Checks up to 5 EU VAT numbers (country code + number, e.g.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- vatstringrequired“1 to 5 VAT numbers separated by commas, each with a 2-letter EU country code”
agent_intel_iban_routing_swift_resolver
“Validates an IBAN (MOD-97 checksum and country length, computed here) and, if it passes, looks up the bank name, city and BIC (SWIFT) through OpenIBAN's public validation.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- ibanstringrequired“IBAN, spaces allowed, e.g.”
agent_intel_phone_carrier_hlr_lookup
“Parses an international phone number (E.164), checks it against Google's open libphonenumber metadata, and returns the country, line type (mobile, fixed line, fixed-or-mobile, VoIP, toll free, premiu…”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- numberstringrequired“Phone number in international form with country code, e.g.”
agent_intel_global_postal_geocode_resolver
“Resolves a postal code in one country (ISO 2-letter code, e.g.”
Publisher declares: read-only yes · open-world yes
2 inputs, 2 required
- countrystringrequired“Two-letter ISO country code, e.g.”
- postalCodestringrequired“Postal code as written for that country, 2 to 12 characters”
agent_intel_ecb_institutional_fx_rates
“European Central Bank euro reference rates (published once per working day around 16:00 CET): the rate for one currency against the euro, and an optional conversion of an amount between two of the li…”
Publisher declares: read-only yes · open-world yes
3 inputs
- fromstring“Currency code (EUR or one of the ECB list)”
- tostring“Currency code (EUR or one of the ECB list); default USD”
- amountstring“Amount to convert, default 1”
agent_intel_sec_edgar_filings_search
“Full-text search of US SEC EDGAR filings (SEC public index): matching filings with company name, CIK, form type (10-K, 10-Q, 8-K, 4 and others), filing date and a link to the filing index.”
Publisher declares: read-only yes · open-world yes
4 inputs, 1 required
- qstringrequired“Phrase or keywords, 2 to 100 characters”
- formstring“Optional form type such as 8-K, 10-K, 10-Q, 4”
- daysstring“Look back this many days, 1 to 365 (default 30)”
- limitstring“How many results, 1 to 10 (default 5)”
agent_intel_consumer_product_recalls
“Recent US recalls matching a keyword: CPSC consumer-product recalls (saferproducts.gov, by recall date and description text) and FDA food enforcement reports (openFDA, reason for recall).”
Publisher declares: read-only yes · open-world yes
3 inputs, 1 required
- qstringrequired“Keyword, 3 to 60 characters, e.g.”
- daysstring“CPSC look-back window in days, 1 to 365 (default 60)”
- limitstring“Results per source, 1 to 10 (default 5)”
agent_intel_marine_weather_tide_forecast
“Current wave height and period at a coordinate (Open-Meteo Marine), and, when a US NOAA tide station id is given, the next high and low tide predictions for the next 24 hours.”
Publisher declares: read-only yes · open-world yes
3 inputs, 2 required
- latitudestringrequired“Latitude, -90 to 90”
- longitudestringrequired“Longitude, -180 to 180”
- stationstring“Optional NOAA tide station id (7 digits), e.g.”
agent_intel_highres_qr_code_generator
“Makes a QR code as scalable SVG (21x21 modules, version 1) for up to 17 bytes at level L, 14 at M, 11 at Q or 7 at H, with the mask chosen by the standard penalty rules.”
Publisher declares: read-only yes · open-world yes
3 inputs, 1 required
- textstringrequired“Text to encode as UTF-8 bytes; the byte limit depends on the level”
- ecstring“Error correction level: L, M, Q or H (default M)”
- scalestring“Pixels per module in the SVG, 1 to 20 (default 8)”
agent_intel_multilingual_voice_tts
“Turns text (up to 1000 characters) into speech with a Cloudflare Workers AI TTS model, in English, Spanish, French or Japanese.”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- textstringrequired“Text to speak, 1 to 1000 characters”
- langstring“en, es, fr or ja (default en)”
agent_intel_speech_to_text_transcribe_turbo
“Transcribes an audio file (a public https URL or base64, up to 6 MB; WAV, MP3, M4A or OGG as the model accepts them) to text with a Cloudflare Workers AI Whisper model, returning the text and any tim…”
Publisher declares: read-only yes · open-world yes
2 inputs
- audioUrlstring“Public https URL of the audio file (WAV, MP3, M4A or OGG), up to 6 MB”
- audioBase64string“Or the audio itself: base64 data (no data: prefix), up to 6 MB decoded”
agent_intel_html_dom_to_clean_markdown
“Converts raw HTML you send (up to 500 KB) to GitHub-flavoured Markdown: headings, paragraphs, links, images, lists, code blocks, quotes, bold and italic.”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- htmlstringrequired“HTML text, 1 to 500000 characters”
- baseUrlstring“Optional page address used to resolve relative links”
dev_tennisexplorer
“TennisExplorer ATP/WTA match results for one day from the public results page: tournament, start time, both players with seed, sets won, set scores and pre-match home/away odds as the site lists them.”
Publisher declares: read-only yes · open-world yes
2 inputs
- datestring“Day as YYYY-MM-DD (default: yesterday UTC)”
- tourstring“atp-single (default), atp-double, wta-single, wta-double or all”
dev_mlb_stats
“MLB player season stats (hitting or pitching) and bio from the official MLB Stats API (statsapi.mlb.com).”
Publisher declares: read-only yes · open-world yes
3 inputs, 1 required
- playerIdstringrequired“MLB person id, e.g.”
- seasonstring“Season year YYYY (default: 2025)”
- groupstring“hitting (default) or pitching”
dev_ufcstats
“UFC fighter career profile from the official UFC.com athlete page: name, division, ranking/status tags, W-L-D record, win streak, significant strikes and takedowns landed/attempted, per-minute and pe…”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- fighterstringrequired“Fighter name or UFC.com athlete slug, e.g.”
dev_sofascore_live
“Live sports from SofaScore.”
Publisher declares: read-only yes · open-world yes
4 inputs
- sportstring“football, basketball, tennis, ice-hockey, baseball, american-football, volleyball, handball, cricket, rugby, esports, table-tennis, futsal, mma (default footba…”
- eventstring“SofaScore event ID for one match's incidents, odds and statistics”
- competitionstring“Live list only: competition or country contains this text”
- limitstring“Live list only: matches, 1 to 200 (default 50)”
dev_producthunt
“Product Hunt launches featured on the homepage feed for one day, ranked by Product Hunt's daily rank: name, tagline, product link and Product Hunt's score (latestScore, the points the site shows; not…”
Publisher declares: read-only yes · open-world yes
2 inputs
- limitstring“How many launches, 1 to 50 (default 10)”
- datestring“Featured day YYYY-MM-DD; default = the newest day on the homepage”
dev_fbref
“Soccer competition stats for 16 leagues (Premier League, LaLiga, Bundesliga, Serie A, Ligue 1, Süper Lig, MLS, Champions League …): league table (rank, team, played, W/D/L, goals for/against, goal di…”
Publisher declares: read-only yes · open-world yes
4 inputs, 1 required
- leaguestringrequired“premier-league, championship, laliga, bundesliga, serie-a, ligue-1, eredivisie, primeira-liga, super-lig, mls, liga-mx, scottish-premiership, brasileirao, arge…”
- viewstring“table (default), scorers or assists”
- seasonstring“Table only: season start year, e.g.”
- limitstring“Rows, 1 to 50 (default 20)”
dev_screenshot_url
“Screenshot of a public web page as a PNG, rendered by the thum.io screenshot service.”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- urlstringrequired“Public http or https page URL”
- widthstring“Viewport width in pixels, 320 to 1920 (default 800)”
dev_mlb_statsapi
“MLB games for one date from the official MLB Stats API: teams, scores, status, venue and current inning.”
Publisher declares: read-only yes · open-world yes
1 input
- datestring“Schedule date YYYY-MM-DD (default: yesterday UTC)”
dev_wta_tennis_rankings
“WTA official singles or doubles rankings from the JSON API behind wtatennis.com: rank, player name, country, ranking points, tournaments played and rank movement.”
Publisher declares: read-only yes · open-world yes
2 inputs
- typestring“singles (default) or doubles”
- limitstring“How many players, 1 to 100 (default 10)”
dev_loom_video_downloader
“Public metadata for a Loom video from Loom's oEmbed API: title, description, duration in seconds, size, thumbnail and embed URL.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- urlstringrequired“Loom share or embed link: https://www.loom.com/share/<32-character id>”
dev_openverse_media
“Openverse openly licensed image search (Creative Commons and public domain): title, creator, license, ready-made attribution, source page, direct image URL and size.”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- qstringrequired“Search words, 1 to 100 characters”
- limitstring“How many results, 1 to 20 (default 5)”
dev_action_network
“US sports betting lines from Action Network's scoreboard: games for a league and date (NFL, NBA, MLB, NHL, college, WNBA, soccer) with teams, start time, status, broadcast, total bets tracked and ful…”
Publisher declares: read-only yes · open-world yes
4 inputs, 1 required
- leaguestringrequired“nfl, ncaaf, nba, ncaab, wnba, mlb, nhl, soccer”
- datestring“YYYY-MM-DD (default: today's slate)”
- teamstring“Only games of this team (name or abbreviation, e.g.”
- limitstring“Games, 1 to 50 (default 20)”
dev_flashscore
“Flashscore match list for one sport and day (7 days back to 7 ahead): every match with Flashscore ID, competition (country: league), start time, home/away team, current or final score and state (sche…”
Publisher declares: read-only yes · open-world yes
6 inputs, 1 required
- sportstringrequired“football, tennis, basketball, hockey, american-football, baseball, handball, volleyball”
- daystring“Day offset from today (UTC): -7 to 7 (default 0)”
- statusstring“all (default), live, finished or scheduled”
- leaguestring“Only competitions whose name contains this text, e.g.”
- teamstring“Only matches with a team name containing this text”
- limitstring“Matches, 1 to 200 (default 50)”
dev_podchaser
“Podcast search across the Apple Podcasts directory (iTunes Search API): podcast title, publisher, episode count, genres, latest episode date, explicit flag, RSS feed URL, artwork and Apple Podcasts l…”
Publisher declares: read-only yes · open-world yes
3 inputs, 1 required
- qstringrequired“Podcast search term, 1 to 100 characters”
- countrystring“2-letter Apple store country, e.g.”
- limitstring“How many podcasts, 1 to 20 (default 5)”
dev_sherdog
“Sherdog MMA fighter profile by Sherdog fighter id: name, nationality, height, weight, win/loss record and the fight history (result, opponent, event, date, method, round).”
Publisher declares: read-only yes · open-world yes
2 inputs, 1 required
- idstringrequired“Sherdog fighter id, the number at the end of the fighter URL (e.g.”
- fightsstring“How many recent fights to return, 1 to 50 (default 10)”
dev_espn_sports
“ESPN latest news headlines for one league (NFL, NBA, MLB, NHL, WNBA, college football, men's college basketball) from ESPN's public site JSON: headline, description, published time and ESPN link.”
Publisher declares: read-only yes · open-world yes
2 inputs
- leaguestring“nfl, nba, mlb, nhl, wnba, college-football or mens-college-basketball (default nfl)”
- limitstring“How many headlines, 1 to 25 (default 10)”
dev_espn_mlb_scoreboard
“ESPN MLB scoreboard for one date: every game with away and home team, score, status (scheduled, live, final), and venue, from ESPN's public site JSON.”
Publisher declares: read-only yes · open-world yes
1 input
- datestring“Date YYYY-MM-DD (default: yesterday UTC)”
dev_ufc_stats
“Official UFC.com athlete rankings by division: champion (if listed) and ranked athletes with rank number and athlete page link.”
Publisher declares: read-only yes · open-world yes
2 inputs
- divisionstring“Part of a division name, e.g.”
- limitstring“Ranked athletes per division, 1 to 15 (default 15)”
dev_liquipedia_esports_wiki
“Liquipedia Dota 2 wiki: plain-text introduction of one wiki page (tournament, team or player) from Liquipedia's public MediaWiki API.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- pagestringrequired“Wiki page title, e.g.”
dev_gmx_arbitrum_stats
“GMX total value locked on Arbitrum in USD from DefiLlama's public API: current value and daily history for the last 1 to 30 days.”
Publisher declares: read-only yes · open-world yes
1 input
- daysstring“Days of history, 1 to 30 (default 7)”
dev_espn_soccer_scoreboard
“ESPN soccer scoreboard for one league and date: each match with home and away team, score, status (scheduled, live, full time) and stadium, from ESPN's public site JSON.”
Publisher declares: read-only yes · open-world yes
2 inputs
- leaguestring“ESPN league code, e.g.”
- datestring“Date YYYY-MM-DD (default: yesterday UTC)”
dev_pinnacle_odds
“Pinnacle sportsbook prices (the sharpest market-making book) from its public guest API: upcoming matchups of a league with start time, home/away participants and the main full-game lines — moneyline …”
Publisher declares: read-only yes · open-world yes
5 inputs
- sportstring“soccer, basketball, football, hockey, baseball, tennis, mma”
- leaguestring“League name as Pinnacle shows it, e.g.”
- leagueIdstring“Pinnacle league ID, e.g.”
- teamstring“Only matchups with this participant name”
- limitstring“Matchups, 1 to 100 (default 20)”
dev_football_data_couk
“European football match results with statistics and betting odds from Football-Data.co.uk (free CSV data): for a league and season — date, kick-off, teams, full-time and half-time score, result, refe…”
Publisher declares: read-only yes · open-world yes
4 inputs, 1 required
- leaguestringrequired“League code: E0, E1, E2, E3, EC, SC0, SC1, D1, D2, I1, I2, SP1, SP2, F1, F2, N1, B1, P1, T1, G1 (E0 = Premier League)”
- seasonstring“Season start year, e.g.”
- teamstring“Only matches of this team (as spelled by the source, e.g.”
- limitstring“Matches, 1 to 400 (default 50), newest first”
dev_google_play_store
“Google Play app details from the public app page's JSON-LD: name, developer, category, content rating, average rating and number of ratings, description.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- idstringrequired“Android package name, e.g.”
dev_youtube_channel
“YouTube channel public details by @handle from the channel page: channel id, name, description (YouTube truncates it), subscriber count as YouTube rounds it (e.g.”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- handlestringrequired“Channel handle without @, e.g.”
dev_wnba_stats
“WNBA player season statistics, sorted leaderboard: per player team, position, age, games, minutes, points, rebounds, assists, steals, blocks, turnovers, FG/3P/FT made-attempted-percentage, double-dou…”
Publisher declares: read-only yes · open-world yes
6 inputs
- seasonstring“Season year, e.g.”
- seasonTypestring“regular (default) or playoffs”
- sortstring“points, rebounds, assists, steals, blocks, threes, fgpct, minutes”
- qualifiedOnlystring“true (default) = only players meeting ESPN's minimums”
- limitstring“Players per page, 1 to 50 (default 25)”
- pagestring“Page, 1 to 40”
dev_espn_nfl_scoreboard
“ESPN NFL scoreboard for one date: every game with home and away team, score, status (scheduled, live, final) and stadium, from ESPN's public site JSON.”
Publisher declares: read-only yes · open-world yes
1 input
- datestring“Date YYYY-MM-DD (default: yesterday UTC)”
dev_baseball_reference
“MLB player season statistics, sorted leaderboard (default home runs): per player team, position, batting (G, AB, R, H, 2B, 3B, HR, RBI, BB, SO, SB, AVG, OBP, SLG, OPS, WAR), pitching (GS, W, L, SV, H…”
Publisher declares: read-only yes · open-world yes
6 inputs
- seasonstring“Season year (default current)”
- seasonTypestring“regular (default) or playoffs”
- sortstring“homeruns, avg, rbi, hits, ops, stolenbases, war, era, strikeouts, wins, saves, whip”
- qualifiedOnlystring“true (default) = only players meeting ESPN's minimums”
- limitstring“Players per page, 1 to 50 (default 25)”
- pagestring“Page, 1 to 40”
dev_sporting_life_racing
“Horse racing racecards from Sporting Life (UK & Ireland, plus international meetings): today's meetings with course, country, going, surface and weather, and each race's time, name, class, age band, …”
Publisher declares: read-only yes · open-world yes
2 inputs
- coursestring“Only this course, e.g.”
- countrystring“Only this country as Sporting Life codes it: ENG, SCO, WAL, Eire, FR, USA…”
dev_trustradius
“TrustRadius software product summary: product name, vendor, category, TrustRadius score (out of 10) and rating count, product description, TrustRadius' review digest (overview, top pros and cons, num…”
Publisher declares: read-only yes · open-world yes
1 input, 1 required
- productstringrequired“Product slug as in trustradius.com/products/<slug>/reviews, e.g.”
dev_covers
“Sportsbook odds from Covers.com odds screens (NFL, NBA, MLB, NHL, college, WNBA): every listed game with Covers game ID, away/home team, kick-off text and, for each sportsbook shown (e.g.”
Publisher declares: read-only yes · open-world yes
3 inputs, 1 required
- leaguestringrequired“nfl, ncaaf, nba, ncaab, mlb, nhl, wnba”
- teamstring“Only games with this team abbreviation, e.g.”
- limitstring“Games, 1 to 50 (default 20)”

Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. The first 100 of 135 tools are listed. Read 2026-10-24.

How well are its tools described?

Features #4 and #5

How clearly this server's own tool descriptions say what a tool does, and how consistent its tool list is. The first part is an AI model's yes/no reading of each description; the second part is counted. We do not turn it into a grade.

Descriptions

AI reading of each description

No AI reading was available for this server's tools (the two runs did not agree, or the listing was not reviewed).

Counted from the listing

Parameters with a description: 100% of 277
Tools with a description: 100% of 135
Typical description length: 413 characters

The tool set

Counted from the listing

Tools: 135
Size of the list: about 35,138 tokens for an agent to load (characters ÷ 4)
Naming: 135 of 135 names use snake_case

AI reading: easy to mix up

No pair found.

The AI items cover 0 of 135 tools: for a tool where two differently worded runs disagreed, that item is left out. They were not checked by hand, and no tool was called. “Easy to mix up” means two tools whose names or descriptions overlap without saying how they differ; the AI found none, comparing tools within groups of 40. We do not rate whether the tool set is complete or whether side effects are spelled out, because our AI reading of those was not reliable enough.

How do I add it to my client?

Config from the registry entry

From the remote endpoint (Streamable HTTP)

We connected to this URL on 2026-10-24 (a read-only session: no tool was called).

Add to CursorAn install link in the format Cursor documents, holding the Cursor config below.

Claude Desktop or claude.ai

Settings → Connectors → Add custom connector, then paste:
https://api.fadeandco.workers.dev/mcp

Cursor · .cursor/mcp.json in a project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "sitecheck-agent-intel-dev": {
      "url": "https://api.fadeandco.workers.dev/mcp"
    }
  }
}

VS Code · .vscode/mcp.json

{
  "servers": {
    "sitecheck-agent-intel-dev": {
      "type": "http",
      "url": "https://api.fadeandco.workers.dev/mcp"
    }
  }
}

VS Code (command line) · Bash or zsh terminal (macOS, Linux)

code --add-mcp '{"name":"sitecheck-agent-intel-dev","type":"http","url":"https://api.fadeandco.workers.dev/mcp"}'

Claude Code

claude mcp add --transport http sitecheck-agent-intel-dev https://api.fadeandco.workers.dev/mcp

Try it in the MCP Inspector · runs on your machine, opens in your browser · Node 22.19+

npx @modelcontextprotocol/inspector@2.11.0 --server-url https://api.fadeandco.workers.dev/mcp --transport http

The server runs on the operator's infrastructure; it may ask you to sign in when you first connect.
The MCP Inspector lists the server's tools, resources and prompts; a tool you call there runs for real.

Built from the server's registry entry with each client's documented format (checked 2026-10-14; the Cursor link and the VS Code command 2026-10-19; the MCP Inspector command 2026-10-21). Values in < > are yours to fill in; this page never contains a key. Where the server needs a setting the entry does not declare, it can still fail to start.

Does the registry listing match what we found?

Feature #6

The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.

Registry says	We found	Result	Source · date
Remote endpoint api.fadeandco.workers.dev/mcp	Session opened	matches	our test · 2026-10-24
No credential declared as required	Opened a session without any credential	matches	our test · 2026-10-24

Choosing

Record checks

Public records · not a safety rating

1 of 2 record checks met · 7 do not apply

MetRegistry entry is active and says how to run itActive, with a package or a remote address.
Not metSource repository link opensThe registry entry gives no repository link.
Does not applyRepository is not archivedNo public GitHub repository to read.
Does not applyCode pushed to the repository in the 90 days before our checkNo public GitHub repository to read.
Does not applyRepository publishes a security policy (SECURITY.md)No public GitHub repository to read.
Does not applyPackage names its licence with a standard (SPDX) identifierRemote server: it ships no package.
Does not applyThe version the registry lists can be installed and is not withdrawnRemote server: it ships no package.
Does not applynpm package carries build provenance (attestation)Remote server: it ships no package.
Does not applyNo known critical or high advisory in the package or its dependenciesRemote server: it ships no package.

Read from public records only: the registry entry, npm/PyPI, GitHub and advisory databases, checked 2026-10-24. No tool was called. Only “met” and “not met” are counted, so the total differs between servers; a check that does not apply or that we could not run is listed, never counted against it. It is not a safety rating. How each check works · Leaderboards

Common questions about io.github.bck-stack/sitecheck-agent-intel-dev

Answered from the data above

Does io.github.bck-stack/sitecheck-agent-intel-dev need an API key or sign-in?

It opened a session without any credential on 2026-10-24. The registry entry declares no required credential; no declaration is not a guarantee.

Has io.github.bck-stack/sitecheck-agent-intel-dev been security tested?

Partly. 2 of the 14 checks that apply to it were exercised. We connected and read what the server declares, but did not call its tools: ProtocolProbe calls no server's tools for anything it publishes. This is our choice, not a block by the server. No security verdict is published before verification.

Found this page useful?

Anonymous · no sign-in

A quick, anonymous reaction — no account, no email. One per kind from your browser. The tally updates when the page is next refreshed, and it is only a rough count, never a safety rating or a measured number of people.

Compare with another server

Side by side: registry entry, our read-only session, the tools and the 18 classification fields. Same values as each page; no score.

Security testing

What did we test, and what did we leave out?

18 checks · features #1, #2

Not probed (we call no server's tools)

We connected and read what the server declares, but did not call its tools: ProtocolProbe calls no server's tools for anything it publishes. This is our choice, not a block by the server. No security score is given; a check we did not run is never counted as passed.

The 18 checks at a glanceour test · 2026-10-24

Inventory: exercised
Hidden instructions: exercised
Real execution: not run · our policy
Secret leak: not run · nothing to check it against
Internal addresses: not run · our policy
Unconfirmed changes: not run · our policy
Bad input: not run · our policy
Model requests: not run · nothing to check it against
Sensitive questions: not run · nothing to check it against
Folder boundary: not run · our policy
Log leaks: not run · nothing to check it against
Hidden content: not run · nothing to check it against
Fake assistant turns: not applicable
Token passthrough: not applicable
Token audience: not applicable
Sign-in redirect: not run · our policy
Consent handling: not testable from outside
Sign-in metadata: not applicable

2 exercised12 not run (reason given)4 not applicable

Each check ends in exactly one state: exercised, not run (with the reason), or not applicable (with the reason). 2 of the 14 checks that apply to it were exercised. We do not publish security-check outcomes for named servers.

Exercised · 2

1Inventory
tool-listReads the declared tools, resources and prompts.exercised
2Hidden instructions
description-poisoningLooks for hidden instructions in tool descriptions.exercised

Not run, with the reason · 12

3Real execution
real-executionCalls a tool and checks what really happens.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
4Secret leak
canary-leakPlants a fake secret and checks whether it leaks.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
5Internal addresses
ssrfChecks whether a tool can be steered to internal addresses.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
6Unconfirmed changes
write-without-confirmationChecks whether tools that change data act without asking.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
7Bad input
error-handlingSends bad input and watches how the server answers.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
8Model requests
samplingChecks whether the server asks the client's model to act for it.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
9Sensitive questions
elicitation-sensitive-dataChecks whether the server asks users for sensitive data.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
10Folder boundary
root-boundaryChecks whether the server reaches outside the folders it was given.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
11Log leaks
logging-side-channelChecks whether log messages carry data they should not.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
12Hidden content
audience-hidingChecks resources that hide content from the user.This check needs content the server returns, and nothing was read or called.not run · nothing to check it against
16Sign-in redirect
open-redirectChecks the sign-in redirect for abuse.Testing the sign-in redirect means sending probes to the operator's sign-in service, which we do not do.not run · our policy
17Consent handling
confused-deputyChecks consent handling when one service acts for another.Depends on the operator's own consent screen, which differs per server and cannot be tested from outside.not testable from outside

Does not apply to this server · 4

13Fake assistant turns
fake-assistant-turnChecks prompts that pose as the assistant's own words.The server exposes no prompts.not applicable
14Token passthrough
token-passthroughChecks whether the server forwards a user's token to other services.The server opened a session without sign-in, so there is no token flow to check.not applicable
15Token audience
token-audience-validationChecks whether tokens meant for another service are accepted.The server opened a session without sign-in, so there is no token flow to check.not applicable
18Sign-in metadata
oauth-url-schemeChecks the published sign-in metadata for unsafe URLs.No sign-in (OAuth) metadata is published, so there are no sign-in addresses to check.not applicable

Source: our own test, 2026-10-24, mcp-runtime-engine@0.1.0. Which checks count and why follows our published scoring model.

What happened during the test?

Feature #8

The steps in order, as the test record holds them.

0 msStarted a read-only session with the server's remote endpoint
430 msConnected after 0 redirects. No credential was sent or needed.
Read the inventory: 135 tools, 0 resources, 0 prompts.
1,271 msFinished: 2 checks exercised.

Reference

How is it classified?

18 fields

One value per field, each with its source. Fields written by AI models are marked. A field with no value says why.

TopicAI-classified

pending: added in the weekly update

listed 2026-10-24; not classified yet

Pricing modelAI-classified

pending: added in the weekly update

the website is not read yet

Programming language

does not apply

no existing GitHub repository (server declares no repository link, so there is nothing to fetch)

Hosting type

remote (hosted by the publisher)

registry · 2026-10-24

MCP capability

tools

our test · 2026-10-24

Transport

streamable HTTP

registry · 2026-10-24

Required credentials

none declared

registry · no declaration is not a guarantee

Package registry

does not apply

remote-only server: no package is shipped, so there is no package registry

Freshness

0–30 days

registry updatedAt · 2026-10-24

Lifecycle status

active

registry · 2026-10-24

License class

does not apply

remote-only server: ships no package, so there is nothing to look up in a package registry

Integrity hash

does not apply

remote-only server: ships no package, so there is nothing to look up in a package registry

Signature / provenance

does not apply

remote-only server: ships no package, so there is nothing to look up in a package registry

Dependency advisories

does not apply

ships no package, so there are no dependencies to audit

Popularity

does not apply

remote-only server: ships no package, so there is nothing to look up in a package registry

Publisher signals

not stated

no readable GitHub owner to describe

Maintenance

does not apply

server declares no repository link, so there is nothing to fetch

Environment

the publisher's infrastructure

where it runs, from the hosting type

“Not stated” means the source did not state it; “does not apply” means it does not apply to this kind of server; “our limit” means our own lookup failed. A linked value opens the directory filtered to the same value.

Cite or correct this page

Sources and corrections

Suggested citation

ProtocolProbe. “io.github.bck-stack/sitecheck-agent-intel-dev: MCP server record.” Data checked 2026-10-24. https://protocolprobe.com/mcp/servers/io.github.bck-stack/sitecheck-agent-intel-dev

Figures are valid for the date shown. Our facts on this page are CC BY 4.0: reuse them with a link and the check date. Quoted text (the publisher’s descriptions, website quotes, tool names) is not ours to license.

As JSON: this record in the API · API documentation.

Badge for your README

[![ProtocolProbe](https://protocolprobe.com/api/v1/badge/io.github.bck-stack/sitecheck-agent-intel-dev)](https://protocolprobe.com/mcp/servers/io.github.bck-stack/sitecheck-agent-intel-dev)

It shows this server's record-check count: facts from public records, no tool called. It is not a security rating or a pass. It links here and updates after each data reload.

Something wrong, or is this yours?

If a fact here is wrong, tell us and we will re-check it. If you operate this server, you can run our checks on it yourself with the free self-test command; we call no server’s tools ourselves for anything shown here.

Write to hello@protocolprobe.com · corrections log · methodology