{
  "markdown": "# SRI — MCP Server Inspector\n\nRead what an MCP server does **before** you connect to it.\n\nConnecting an MCP server hands it a channel into your agent's context and its\ntool calls. SRI reads the server's published source and reports what it found —\nevery observation anchored to a `file:line` with the code quoted verbatim.\n\n**It does not tell you whether a server is safe.** It tells you what the code\ndoes, and shows you the line it read. You decide.\n\n- **Endpoint:** `https://sri-test.biz/mcp` (Streamable HTTP)\n- **Corpus:** 2,238 MCP servers from the official registry\n- **Price:** free right now — settlement runs on Bitcoin signet, so invoices\n  cannot be paid with real funds\n- **Findings across the corpus:** [sri-test.biz/research](https://sri-test.biz/research)\n\n## Add it to your client\n\nRemote MCP server, no install, no API key.\n\n```json\n{\n  \"mcpServers\": {\n    \"sri\": {\n      \"type\": \"http\",\n      \"url\": \"https://sri-test.biz/mcp\"\n    }\n  }\n}\n```\n\n<details>\n<summary>Claude Code</summary>\n\n```bash\nclaude mcp add --transport http sri https://sri-test.biz/mcp\n```\n</details>\n\n<details>\n<summary>Anything that speaks Streamable HTTP</summary>\n\nPoint it at `https://sri-test.biz/mcp`. There is one tool and no auth.\n`GET` on that URL returns 405 — this server does not offer a server-initiated\nSSE stream, which the spec permits. Send JSON-RPC over `POST`.\n</details>\n\n## The tool\n\n### `check_mcp_server`\n\n| Argument | Required | Meaning |\n|---|---|---|\n| `name` | yes | Server name as published in the registry, e.g. `io.github.firebase/firebase-mcp` |\n| `version` | yes | Exact version, e.g. `1.2.3` |\n| `ecosystem` | no | Always `mcp`; other ecosystems are not covered |\n\nReturns a `risk_level`, a summary, and a list of findings. Each finding carries\n`location` (`file:line`), `evidence` (the code, quoted), and `why`.\n\nIf the server is not in the corpus you get `status: \"queued\"`, an explicit\n\"nothing has been checked\" — not a clean result — and **no charge**. We do not\nbill for an answer we could not give.\n\n## Try it without a client\n\n```bash\ncurl -X POST https://sri-test.biz/mcp \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\n       \"params\":{\"name\":\"check_mcp_server\",\n                 \"arguments\":{\"name\":\"io.github.firebase/firebase-mcp\",\"version\":\"0.3.0\"}}}'\n```\n\nThere is a plain REST endpoint too, if that is easier:\n\n```bash\ncurl -X POST https://sri-test.biz/v1/verify \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"ecosystem\":\"mcp\",\"name\":\"io.github.firebase/firebase-mcp\",\"version\":\"0.3.0\"}'\n```\n\n`GET /v1/price` is open and tells you the current terms.\n`GET /v1/docs` is the OpenAPI spec.\n\n## What gets reported\n\n| Category | What it means |\n|---|---|\n| `credential_access` | Reads environment credentials, tokens, or key files |\n| `network_egress` | Sends data to a host outside the package's own service |\n| `install_script` | Executes code at install time (`postinstall`, `setup.py`) |\n| `prompt_injection_surface` | Tool text or returned data that steers the agent toward actions unrelated to the tool's stated purpose |\n| `obfuscation` | Encoded strings decoded and executed |\n| `typosquat` | Name close to a well-known package, different publisher |\n| `excessive_permission` | Permissions beyond the declared purpose |\n\nSeverity is `info` / `low` / `medium` / `high`. `risk_level` is the highest\nseverity among the findings, derived in code rather than asked for — a verdict\nwith no findings behind it cannot be published.\n\n## What this is not\n\n- **No finding is not a clean bill of health.** It means nothing was found in\n  the categories above, in the code we could fetch.\n- **We never label a package malicious, and never call one safe.** The ingest\n  step rejects records whose summary contains either kind of claim.\n- **MCP servers only.** npm and PyPI libraries are out of scope; ask about one\n  and you will get \"not analyzed\".\n- **One analyzer, one pass.** Run-to-run agreement measured at 93% on a\n  hand-labelled set of 84 servers before the full corpus was built. Not 100%.\n\n## If a finding is wrong\n\nIf you maintain a server and a finding is mistaken, tell us through\n**[the report form](https://sri-test.biz/contact)**. Agents can use\n`POST /v1/disputes`.\n\n**We reply within three business days.** While we review, the finding may be\nwithheld from results. If we withdraw it, the server is re-analysed and the\nrecord replaced. If we keep it, we say which facts it rests on.\n\n## Payment\n\nThe paid path is [L402](https://docs.lightning.engineering/the-lightning-network/l402)\n(Lightning HTTP 402): the server issues an invoice and a macaroon, you pay, and\nyou present `Authorization: L402 <macaroon>:<preimage>`. Verification is\n`sha256(preimage) == payment_hash` — no node required on your side, and no\nsignup on ours.\n\n**This is switched off today.** Settlement runs on signet, a test chain, so\ninvoices cannot be paid with real funds and usage is free. When mainnet is\nenabled the price returns to $0.20 per cached lookup. `GET /.well-known/l402`\ntells you the current state.\n\n## Privacy\n\nWe record the path requested, response time, User-Agent, and an **IP hashed\nwith a daily salt**, kept for 90 days. Raw IP addresses are never stored, and\n**request bodies are never stored** — the servers you ask about are recorded by\nname, nothing more.\n",
  "bytes": 5348,
  "sha": "aa04c0dab69baee61856e465db7e6f25bf162c2570009448600ea13ffe7a8bfa",
  "repo_slug": "sritest0001/sri",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_biz_sri_test_verifier_6e3757bc/readme"
}