Name: AttriKit
Author: attrikit

AttriKit MCP

Run AttriKit web-to-app attribution from an agent: apps, campaign links, spend, decisions, exports

Grade A Local · stdio API key 39 tools v2.0.1 MIT

No reviews yet by attrikitnpm 3,571 Runs on your machine, nothing hosted

93/100

trust score

100

downloads a day

local

runs on your machine

800

downloads in 30d

What it does

Run AttriKit web-to-app attribution from an agent: apps, campaign links, spend, decisions, exports

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --env 'ATTRKIT_API_KEY=${ATTRKIT_API_KEY}' --transport stdio attrikit-mcp '--' npx -y @attrkit/mcp

# 2 — ask your agent for something these tools do
#   whoami, get_usage_cap, set_usage_cap and 36 more

It needs ATTRKIT_API_KEY: this reads it from your environment, so export it first.

AttriKit costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

attrikit1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts AttriKit as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.

Claude Codedeclared by this listing

This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. Claude Code reads ATTRKIT_API_KEY (AttriKit management key (sk_...), created in Dashboard > Settings > API keys & MCP. On macOS, `npx -y @attrkit/mcp login` can store it in the Keychain instead) from your environment each time it starts the server, so the value stays out of its config: export it in your shell profile (macOS, Linux), or run setx ATTRKIT_API_KEY … and open a new terminal (Windows). The '--' is in quotes so that PowerShell passes it on.

claude mcp add --scope user --env 'ATTRKIT_API_KEY=${ATTRKIT_API_KEY}' --transport stdio attrikit-mcp '--' npx -y @attrkit/mcp

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.

What it asks of you

It reaches a system of yours, so it needs your own credential rather than the publisher’s: ATTRKIT_API_KEY — AttriKit management key (sk_...), created in Dashboard > Settings > API keys & MCP. On macOS, `npx -y @attrkit/mcp login` can store it in the Keychain instead.. You set it in your own client’s config, on your machine — this marketplace never holds it.

What it writes

One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.

What you approve

39 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Read from its source code. A server that builds its tool list when it starts can list more tools than this.

Return the authenticated workspace, plan, app restriction and read/write scopes.

No parameter schema on file.

Return the workspace's monthly qualified-install cap, alert email, current billing period and usage. Requires a workspace-scoped read key.

No parameter schema on file.

Set a monthly qualified-install cap of at least 10,000 and its alert email. Pass null for both values to clear the cap. Requires a workspace-scoped write key.

Parameter	Type	Required	Notes
monthly_qualified_install_cap	integer	yes	Monthly qualified-install cap, a whole number of at least 10,000, or null to clear the cap (alert_email must then be null too). Once the cap is exceeded, additional install charges stop for the rest o
alert_email	string	yes	Email address for the cap's alerts, at most 320 characters, or null to clear the cap (monthly_qualified_install_cap must then be null too).
idempotency_key	string	no	Stable retry key for this exact mutation.

List the iOS and Android apps in your AttriKit workspace (id, name, platform, bundle id, store id, status).

Parameter	Type	Required	Notes
cursor	string	no	Pass the next_cursor from the previous response to fetch the following page. Omit for the first page.
limit	integer	no	Rows per page, 1-200. The API defaults to 50, so a workspace with more than that needs paging.

Create an iOS or Android app without the web UI. Returns the publishable key and a one-time app-scoped management key.

Parameter	Type	Required	Notes
name	string	yes	App name, 1 to 80 characters.
bundle_id	string	yes	The iOS bundle id or Android package name, for example com.example.app, 3 to 255 characters.
platform	string	yes	The app's platform: iOS or Android.
store_url	string	yes	The app's App Store or Google Play page URL.
timezone	string	no	The app's timezone, at most 64 characters. The API uses UTC when omitted.
device_matching_mode	string	no	Coverage mode. on (the API's default): maximum coverage, events of all eligible matches are sent. strict: events of verified matches only.
idempotency_key	string	no	Stable retry key for this exact mutation.

Return one app's configuration.

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.

Update app metadata, store destination, timezone or coverage mode.

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.
name	string	no	New app name, 1 to 80 characters. Omit to keep the current one.
bundle_id	string	no	New iOS bundle id or Android package name, 3 to 255 characters. Omit to keep the current one.
platform	string	no	New platform, iOS or Android. Omit to keep the current one.
store_url	string	no	New App Store or Google Play page URL. Omit to keep the current one.
timezone	string	no	New app timezone, at most 64 characters. Omit to keep the current one.
device_matching_mode	string	no	New coverage mode. on: maximum coverage, events of all eligible matches are sent. strict: events of verified matches only. Omit to keep the current one.
idempotency_key	string	no	Stable retry key for this exact mutation.

Archive an app and remove it from active customer operations.

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.

Reveal the recoverable SDK publishable key for an app.

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.

Issue a new SDK publishable key and return the old-key grace deadline.

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.
idempotency_key	string	no	Stable retry key for this exact mutation.

List masked workspace and app management keys. Secret plaintext is never returned.

No parameter schema on file.

Create a read-only or read/write workspace or app key. The secret is returned once.

Parameter	Type	Required	Notes
label	string	yes	A name for the key, 1 to 80 characters, shown by list_api_keys.
scopes	array	yes	["read"] or ["read", "write"]; every key needs read, so the API refuses ["write"] alone. Read permits every read, including the POST attribution lookup; write is also required to create, update, rotat
app_id	string	no	App UUID to clamp the key to one app. Omit or pass null for a workspace key. An app-scoped caller can only create keys for its own app.
idempotency_key	string	no	Stable retry key for this exact mutation.

Immediately revoke a management key by id.

Parameter	Type	Required	Notes
key_id	string	yes	The key's id (UUID), as returned by list_api_keys.

List tracking links, optionally for one app. Each link's tracking_url is the campaign link to use in the ad (null if unavailable); url is the store destination.

Parameter	Type	Required	Notes
app_id	string	no	Optional app id to scope the result to one app.
cursor	string	no	Pass the next_cursor from the previous response to fetch the following page. Omit for the first page.
limit	integer	no	Rows per page, 1-200. The API defaults to 50, so a workspace with more than that needs paging.

List ad campaigns with their honest profit surface. call preserves the original v1 fail-closed automation behavior for multi-component rows; recommended_call is the additive SCALE/CUT/HOLD recommendation the current engine made. It is backed by…

Parameter	Type	Required	Notes
app_id	string	no	Optional app id to scope the result to one app.
period	string	no	Reporting window. Omit to use the endpoint's documented default.
from	string	no	First UTC day of an explicit window, YYYY-MM-DD, inclusive. Use instead of period; sending both is a 400.
to	string	no	Last UTC day of an explicit window, YYYY-MM-DD, inclusive. Use instead of period; sending both is a 400.
cursor	string	no	Pass the next_cursor from the previous response to fetch the following page. Omit for the first page.
limit	integer	no	Rows per page, 1-200. The API defaults to 50, so a workspace with more than that needs paging.

Return ad and ad-set performance, evidence tiers, ROAS, CPA, CPC and modeled remainders.

Parameter	Type	Required	Notes
app_id	string	no	Optional app id to scope the result to one app.
period	string	no	Reporting window. Omit to use the endpoint's documented default.
from	string	no	First UTC day of an explicit window, YYYY-MM-DD, inclusive. Use instead of period; sending both is a 400.
to	string	no	Last UTC day of an explicit window, YYYY-MM-DD, inclusive. Use instead of period; sending both is a 400.
cursor	string	no	Pass the next_cursor from the previous response to fetch the following page. Omit for the first page.
limit	integer	no	Rows per page, 1-200. The API defaults to 50, so a workspace with more than that needs paging.

Return the same recent attribution events and installs visible on the Live dashboard.

Parameter	Type	Required	Notes
app_id	string	no	Optional app id to scope the result to one app.
limit	integer	no	Rows to return, 1-50. The API returns 50 when omitted.
from	string	no	First UTC day to include, YYYY-MM-DD. May be sent without to. Sending from, to or cursor switches the response to paged mode, which adds next_cursor.
to	string	no	Last UTC day to include, YYYY-MM-DD. May be sent without from.
cursor	string	no	Pass the next_cursor from the previous response to fetch the following page. Omit for the first page.

Return one row per delivery of an event to a network connection, newest first: its state (held, queued, sending, retrying, sent, suppressed or failed), the reason with a one-line explanation (for example consent_suppressed, attributed_only_suppressed or destination_event_too_old), attempts, the…

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.
install_id	string	no	Only this install: the install epoch id the events feed and the export call the install id.
event_id	string	no	Only this event's deliveries, one per connection that receives it.
connection_id	string	no	Only this network connection, as returned by list_integrations.
network	string	no	Only connections to this network, for example meta.
state	string	no	Only deliveries in this state.
from	string	no	First UTC day the event was received, YYYY-MM-DD. May be sent without to.
to	string	no	Last UTC day the event was received, YYYY-MM-DD, inclusive. May be sent without from.
cursor	string	no	Pass the next_cursor from the previous response to fetch the following page. Omit for the first page.
limit	integer	no	Rows per page, 1-200. The API defaults to 50, so a workspace with more than that needs paging.

Return AttriKit's profit DECISIONS for your campaigns: the scale/cut/hold call and confidence, computed by the attribution engine. Report the call VERBATIM — do not recompute or override it; when it says not_enough_data, say so. This is the tool to drive budget automation.

Parameter	Type	Required	Notes
app_id	string	no	Optional app id to scope the result to one app.
period	string	no	Reporting window. Omit to use the endpoint's documented default.
cursor	string	no	Pass the next_cursor from the previous response to fetch the following page. Omit for the first page.
limit	integer	no	Rows per page, 1-200. The API defaults to 50, so a workspace with more than that needs paging.

Record a scale/cut/hold decision for the reporting period the caller reviewed. AttriKit freezes that period's current campaign range, spend, costs, revenue basis, and model version server-side; callers cannot author receipt provenance.

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.
campaign_id	string	yes	The AttriKit campaign uuid, as returned by list_campaigns or get_campaign_decision. Not the ad network's own campaign id.
call	string	yes	The decision being frozen. Report get_campaign_decision's own call verbatim rather than forming your own.
period	string	no	The reporting window you reviewed; the receipt freezes that window. Pass the same period you read. Omitted, this tool and get_campaign_decision use all, while list_campaigns defaults to 30d.
idempotency_key	string	no	Stable retry key for this exact mutation.

Return the account-level attribution overview: installs accounted-for by evidence class (verified / matched / modeled / organic), MER, revenue and data freshness.

Parameter	Type	Required	Notes
app_id	string	no	Optional app id to scope the result to one app.
period	string	no	Reporting window. Omit to use the endpoint's documented default.
from	string	no	First UTC day of an explicit window, YYYY-MM-DD, inclusive. Use instead of period; sending both is a 400.
to	string	no	Last UTC day of an explicit window, YYYY-MM-DD, inclusive. Use instead of period; sending both is a 400.

Create a web-to-app tracking link for an ad campaign. Requires a write-scoped API key. Returns the link: tracking_url is the campaign link to use in the ad (for meta the ad's Website URL, for tiktok the ad's destination, for google the tracking template with the App Store URL kept as the final…

Parameter	Type	Required	Notes
app_id	string	yes	The app id the link belongs to.
network	string	yes	The ad network delivering the campaign.
destination_url	string	yes	The App Store URL to send users to.
campaign_name	string	no	Optional human-readable campaign name.
network_campaign_id	string	no	The AD NETWORK's own campaign id (for Meta, the campaign ID in Ads Manager, which exists as soon as the campaign is saved, even as a draft). pull_network_spend matches report rows on it, so set it on
campaign_id	string	no	Optional EXISTING AttriKit campaign uuid (from list_campaigns) to attach this link to. Not the ad network's id: use network_campaign_id for that. Pass one or the other, not both.
serve_landing	boolean	no	Serve the landing bridge on this link. Defaults to true at the API.
idempotency_key	string	no	Stable retry key for this exact mutation.

Change a tracking link between active and disabled, and/or attach the ad network's own campaign id to a link created without one (then pull_network_spend can match its spend). Send status, network_campaign_id, or both. A campaign that already has a different network id is refused with 409…

Parameter	Type	Required	Notes
link_id	string	yes	The link's id (UUID), as returned by list_links or create_campaign_link.
status	string	no	active: the link sends people to your store page. disabled: it stops. Omit to leave the status as it is.
network_campaign_id	string	no	The ad network's own campaign id (for Meta, the campaign ID in Ads Manager).
idempotency_key	string	no	Stable retry key for this exact mutation.

Return imported ad spend, cost models, completeness and spend freshness. Without from, to or cursor every row comes back at once; with any of them the rows are paged, ordered by network, campaign, ad set, ad and day, and next_cursor is null on the last page.

Parameter	Type	Required	Notes
app_id	string	no	Optional app id to scope the result to one app.
from	string	no	First metric day to include (UTC, YYYY-MM-DD). May be sent without to.
to	string	no	Last metric day to include (UTC, YYYY-MM-DD). May be sent without from.
cursor	string	no	Pass the next_cursor from the previous response to fetch the following page. Omit for the first page.
limit	integer	no	Rows per page, 1-5000 (1000 when omitted). Read only in paged mode; alone it changes nothing.

Import campaign or creative-level spend rows.

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.
network	string	yes	The ad network the spend was paid to.
source	string	no	Where the rows came from: network_api, csv or manual. The API uses manual when omitted.
account_ref	string	no	Optional reference of the ad account the spend belongs to.
currency	string	yes	Three-letter ISO 4217 code of every amount in rows, for example USD.
report_timezone	string	no	Timezone of the network report the rows come from. The API uses UTC when omitted.
covers_from	string	yes	First day the batch covers, YYYY-MM-DD, inclusive. Every row's metric_date must fall between covers_from and covers_to.
covers_to	string	yes	Last day the batch covers, YYYY-MM-DD, inclusive, on or after covers_from.
completeness	string	no	final when the network has settled these days; partial when it is still updating them. Either way, a newer import of a row with the same campaign, ad set, ad and day replaces the earlier one in report
notes	string	no	Optional free-text note stored with the batch.
rows	array	yes	The spend rows, 1 to 5,000: one per campaign and day, or per campaign, ad set, ad and day.
idempotency_key	string	no	Stable retry key for this exact mutation.

Version commission, payment fees and variable COGS used in profit decisions.

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.
effective_at	string	yes	When this cost version takes effect: a date (YYYY-MM-DD) or an ISO 8601 date-time.
store_commission_bps	integer	yes	Store commission in basis points, 0-10,000: 1,500 is 15% (Apple's Small Business Program), 3,000 is 30%.
payment_fee_bps	integer	yes	Payment fees outside the store commission, in basis points, 0-10,000. Usually 0 for App Store revenue.
variable_cogs_kind	string	yes	How variable_cogs_value is read: bps is a percent of revenue in basis points; per_unit_minor is a fixed amount per install in the currency's minor units.
variable_cogs_value	number	yes	The other variable cost, a whole number: basis points of revenue, at most 10,000, for bps; minor units per install for per_unit_minor.
assumptions	object	no	Optional JSON object stored with this cost version. Its profit_threshold, a number, is the break-even bar: AttriKit suggests scale only when the low return per 1 unit of spend exceeds it (1.00 is true
idempotency_key	string	no	Stable retry key for this exact mutation.

Fetch and import creative-level spend from a configured Meta, Google or TikTok connection. AttriKit already pulls every enabled connection every 6 hours, covering today and the 3 days before; call this for an immediate pull or a longer window. Report rows are kept only for campaigns whose network…

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.
network	string	yes	The network to pull from: meta, google or tiktok. It needs an active integration.
connection_id	string	no	The integration id, as returned by list_integrations. Needed only when several integrations of this network are active (otherwise 409 ambiguous_connection); omitted, the one active integration is used
covers_from	string	yes	First day of the report window to pull, YYYY-MM-DD, inclusive.
covers_to	string	yes	Last day of the report window to pull, YYYY-MM-DD, inclusive, on or after covers_from.
idempotency_key	string	no	Stable retry key for this exact mutation.

List redacted ad-network connections and their readiness.

No parameter schema on file.

Store encrypted network credentials and choose, for each of the eight event families (install, session, trial, subscription, purchase, refund, paywall, business), which source's copy AttriKit forwards to the network. AttriKit always does the sending; the owner only picks the copy. attrkit = the…

Parameter	Type	Required	Notes
network	string	yes	The ad network: meta, google or tiktok.
account_ref	string	yes	The ad account: for Meta the ad account ID starting with act_, for Google the Ads customer ID (123-456-7890), for TikTok the advertiser ID.
credential	string	yes	The network credential, a JSON object written as a string. Meta: pixelId and accessToken. Google: linkId (conversions), accessToken and developerToken (spend). TikTok: eventSourceId (your Pixel code)
owners	object	yes	For each event family, whose copy is forwarded: attrkit, revenuecat or customer (see the tool description). Enabling a destination requires ALL eight families to be present, or the API rejects the cal
enable	boolean	no	true starts delivery at once, which needs all eight families in owners. false (the default) saves a draft that sends nothing.
delivery_scope	string	no	Which events a Meta or TikTok integration sends. all (the API's default): the events of every install with measurement consent, organic ones included. attributed: send only events of installs AttriKit
renewal_event	string	no	How a renewal reaches Meta website and TikTok web events. purchase (the API's default): as Purchase with its price and currency. custom: as the custom event subscription_renewed with its price and cur
idempotency_key	string	no	Stable retry key for this exact mutation.

Rotate credentials or enable/disable an integration. set_delivery_options changes delivery_scope, renewal_event or both on a Meta or TikTok integration, in any status, without touching its credential or status; give at least one of the two.

Parameter	Type	Required	Notes
connection_id	string	yes	The integration id, as returned by list_integrations.
action	string	yes	rotate replaces the credential (send credential). disable stops delivery. enable starts it, once every one of the eight event families has a sender. set_delivery_options changes delivery_scope, renewa
credential	string	no	The new credential for rotate, in create_integration's format: a JSON object written as a string. Stored encrypted and never returned.
owners	object	no	Read by enable: the sender (attrkit, revenuecat or customer) of some or all event families, merged over the saved ones. Every family must end up with a sender, or the API rejects the call.
delivery_scope	string	no	Which events a Meta or TikTok integration sends. all (the API's default): the events of every install with measurement consent, organic ones included. attributed: send only events of installs AttriKit
renewal_event	string	no	How a renewal reaches Meta website and TikTok web events. purchase (the API's default): as Purchase with its price and currency. custom: as the custom event subscription_renewed with its price and cur
idempotency_key	string	no	Stable retry key for this exact mutation.

Delete a disabled integration. Enabled integrations must be disabled first.

Parameter	Type	Required	Notes
connection_id	string	yes	The integration id, as returned by list_integrations.

Return redacted RevenueCat status and the AttriKit webhook URL.

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.

Store the RevenueCat provider app id and encrypted authorization secret for an app, and optionally the webhook signing secret (omitted, the stored one is kept).

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.
provider_app_id		yes	RevenueCat's PROJECT app id from their dashboard app settings, not the SDK key.
authorization_secret	string	yes	The Authorization header value set on the AttriKit webhook in RevenueCat's dashboard, 16 to 1,024 characters. Stored encrypted.
signing_secret	string	no	RevenueCat's HMAC signing secret, for the X-RevenueCat-Webhook-Signature header. Optional: omitted, the stored one is kept.
idempotency_key	string	no	Stable retry key for this exact mutation.

List redacted outbound webhook subscriptions.

No parameter schema on file.

Create an SSRF-checked webhook subscription. Returns the signing secret once.

Parameter	Type	Required	Notes
url	string	yes	Your public HTTPS endpoint, on the default port 443. HTTP, other ports, credentials in the URL, and local, private or other non-public targets (checked after DNS resolution) are rejected.
event_types	array	yes	The notifications to receive, 1 to 4 of install, event, decision and fraud.
description	string	no	Optional label for the subscription, at most 500 characters.
app_id	string	no	Optional app UUID to receive one app's notifications only. Omitted, a workspace key subscribes to all apps; an app-scoped key always subscribes to its own app.
idempotency_key	string	no	Stable retry key for this exact mutation.

Delete a webhook subscription.

Parameter	Type	Required	Notes
subscription_id	string	yes	The subscription id (UUID), as returned by list_webhooks or create_webhook.

Export one app's events and installs for an inclusive date range. By default (version 1) the answer is the seven-column CSV, event rows capped at the 100,000 most recent INSIDE the range; narrow the range until it is safely below that cap when a complete snapshot is required. Pass version 2 for…

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.
from	string	yes	ISO date or timestamp
to	string	yes	ISO date or timestamp
version	integer	no	Export version, 1 or 2. Omit for version 1, the original CSV, unchanged. format, limit and cursor need version 2.
format	string	no	Version 2 only: csv (the default) or ndjson, one JSON record per line.
limit	integer	no	Version 2 only: records per page, 1-10,000 (10,000 when omitted).
cursor	string	no	Version 2 only: the next_cursor of the previous page. Omit for the first page.

Report an event for one of your users from your own backend, by the customer_user_id your app passed to AttriKit.setUserID; no device installation id is needed. The event is attached to the install that id resolves to and reaches the destinations whose sender for its family is Your servers.…

No parameter schema on file.

Look up the attribution of one of your users by the customer_user_id your app passed to AttriKit.setUserID: the campaign, ad set, ad, network, match confidence and attribution_status (attributed, device_matched, organic, pending or consent_required) of the user's newest install. 404…

Parameter	Type	Required	Notes
app_id	string	yes	The AttriKit app id.
customer_user_id	string	yes	The opaque id your app passed to AttriKit.setUserID. Refused when it looks like an email address or phone number.

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under MIT
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install AttriKit or to call it, at any volume.

ATrust score 93 / 100

Release 2.0.1 · scanned 3 Nov 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings1 threat · 5 capability

Capabilityhigh

Coveragesource

Verificationrepo

Surface digest5b80314ed138e7f5b0ce77c03b645ff773e2db1fecc1727087ef49b38f1076f6

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	high	capability blast radius (high) — client exposure if the model is manipulated	−6
verification-discount	repo	publisher verification (public source) — no provenance, but the source is public and inspectable	−1
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfaceread

Implementation sourceread

Package metadataread

Live transportnot available

Tools were statically extracted from the published source (39 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.

Tool	Capability tags	Why the tag was assigned
whoami	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_usage_cap	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
set_usage_cap	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
list_apps	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
create_app	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_app	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
update_app	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
archive_app	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
get_publishable_key	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
rotate_publishable_key	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
list_api_keys	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
create_api_key	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
revoke_api_key	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
list_links	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
list_campaigns	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
list_ads	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
list_recent_events	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
list_event_deliveries	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_campaign_decision	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
record_campaign_decision	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_attribution_rollup	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
create_campaign_link	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
update_link_status	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_spend	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
import_spend	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
set_cost_model	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
pull_network_spend	untrusted-inputexternal-sink	untrusted-input: keyword "fetch"; external-sink: declares readOnlyHint: false, openWorldHint: true
list_integrations	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
create_integration	external-sink	external-sink: keyword "webhook", declares readOnlyHint: false, openWorldHint: true
update_integration	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
delete_integration	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
get_revenuecat	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
configure_revenuecat	external-sink	external-sink: keyword "webhook", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
list_webhooks	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
create_webhook	external-sink	external-sink: keyword "webhook", declares readOnlyHint: false, openWorldHint: true
delete_webhook	external-sink	external-sink: keyword "webhook", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
export_events	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
send_server_event	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
lookup_customer_attribution	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

flow-1

Untrusted input can drive an external action even though no sensitive source is exposed.

Supply chain and provenance

Integrityfirst-seen

Surface digest5b80314ed138e7f5

Scanned2026-11-03

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

AttriKit MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also