What it does
Example gives an agent a research desk instead of a raw HTTP client. search_web returns ranked results with snippets and stable ids; fetch_page renders JavaScript, strips chrome and returns markdown with anchors preserved; extract_structured takes a JSON schema and fills it, returning a per-field confidence and the exact source span it came from.
Everything is designed so the model can cite: every result carries a source_id you can pass back into quote_span to prove a claim. Untrusted page text is returned wrapped and clearly labelled, so a prompt hidden inside a page cannot pose as an instruction from you.
Quickstart
First 500 calls each month are free, on every plan. Nothing is charged until you cross that line, and you can set the cap to $0 to keep it permanently free.
Six people in Lisbon and Kraków building retrieval infrastructure. They publish an incident log, answer reviews within a day, and have never shipped a breaking change without a deprecation window.
Where are you running it?
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Failed calls, timeouts and anything the gateway rejects are never billed. Cached repeats inside 15 minutes are free. You are billed by mcprush, once, for every server you use — not by each publisher separately.
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level below it is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
| Term | Level | What it prices | Points |
|---|---|---|---|
| threat findings | none scored | No injection, secret, Unicode, typosquat, CVE, drift or annotation-lie finding. A clean surface starts at 100. | −0 |
| capability-exposure | moderate | Blast radius if the model driving this server is manipulated. Minimal 0 · moderate 3 · high 6 · critical 10. | −3 |
| verification-discount | provenance | npm build attestation binds the artifact to the repo and CI that built it. Vendor 0 · provenance 0 · public repo 1 · unlocatable 5. | −0 |
| coverage-honesty | source | The published tarball was read, so the scan saw the implementation. Live/source 0 · manifest 4 · metadata 8 · empty 25. | −0 |
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Caveat recorded by the scan: the hosted HTTP transport was not reached, so anything the publisher's own service does after answering a call is outside this report. A statically inferred tool can never force the confirmed-critical gate; these tools were enumerated from a running server, so they are the real runtime surface.
Capability — what it could do if the model were manipulated
Tags derived from each tool's schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| fetch_page | untrusted-input | Returns third-party page text into the model's context. Ingest, not a sink. |
| crawl_site | untrusted-input | Same ingest across many pages; the origin is attached to each block. |
| save_bundle | file-write | Writes to a path taken from a tool argument — MTC-CAP-002. |
| search_web | external-sink | Outbound HTTP to the publisher's search API — MTC-SRC-003, a fixed endpoint in the code. |
| the other 10 | no tags | Pure transforms over text the caller already has: no read of local data, no egress, no write, no execution. |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
Findings
Every finding carries a rule id, a severity and a confidence, because a keyword that might be benign and a decoded payload must not weigh the same. Only confirmed findings can fire a hard grade gate.
| Rule | Severity | Confidence | Finding |
|---|---|---|---|
| MTC-CAP-002 | medium | strong | Filesystem mutation capability. save_bundle writes to a caller-supplied path. Capability axis — it does not lower the grade. |
| MTC-SRC-003 | medium | confirmed | Hardcoded egress to an external endpoint. api.example.dev in the implementation. Expected for this product; recorded so it is never a surprise. |
| MTC-CAP-005 | low | strong | Mutating tool without destructiveHint. save_bundle declares no destructive hint, so some clients will not prompt before it writes. |
| MTC-CAP-003 | not raised | — | Annotation-vs-behavior mismatch. The 11 tools that declare readOnlyHint were checked against their derived capabilities. None of them mutates or egresses, so no annotation on this server is contradicted by what the code does. |
Supply chain and provenance
The attestation is what binds these bytes to that commit. Without it a repository link is self-declared, which is why the score prices the difference rather than treating both as verified.
Integrity since the last pin
The rug-pull check: a canonical fingerprint of the tool surface is stored per release, and every scan compares against it. A tool description that changes quietly between releases is the attack this exists to catch.
| Release | Change | Detail | Status |
|---|---|---|---|
| 2.4.0 | tool-changed | extract_structured description gained “return null rather than guessing”. Reviewed, no capability change. | drift · benign |
| 2.2.0 | tool-changed | fetch_page gained parameter render_js, default false. Capability tags unchanged. | drift · benign |
| 2.0.0 | first-seen | First pin of the 2.x surface — the baseline every later fingerprint is compared against. | baseline |
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
Only accounts with at least 50 real tool calls against this server in the last 90 days can post. Ratings are weighted by how much the reviewer actually uses it, and publishers can reply once per review.