An agent can connect on its own if it already holds X_API_KEY.Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.
tools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)
stabilityn/a · weight 15
n/a
stability.changes, stability.rug_pulltool list unknown
dependenciesn/a · weight 15
n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package
Tool list unknown · checked 2026-10-20 19:42 UTC
Tool changes
No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
Grade a URL as an attacker and a customer would see it; scan a repo; check Supabase, Stripe, Vercel.
Official server.json
{
"name": "app.safeship/mcp",
"title": "Safeship",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://mcp.safeship.app/mcp",
"type": "streamable-http",
"headers": [
{
"name": "X-API-Key",
"format": "string",
"isSecret": true,
"isRequired": true,
"description": "Safeship API key, created under Settings then API Keys at https://safeship.app. Starts with sk_live_."
}
]
}
],
"version": "1.0.0",
"websiteUrl": "https://safeship.app/mcp",
"description": "API monitoring from your editor. Checks the JSON your endpoints return, not just the status code."
}