# Preflight

> Scans an MCP server for security gaps before your agent connects. Free tier, no signup.

- name: com.allthepossibles/preflight
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 83/100 flags: no-repository
- quality: 89/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.allthepossibles%2Fpreflight
- tools: https://api.protogrid.dev/v1/servers/com.allthepossibles%2Fpreflight/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "preflight": {
      "type": "http",
      "url": "https://preflight.allthepossibles.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% +updated-1d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 89/100 (new)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 4 of 4 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 897 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool history recorded for 1 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 4, about 897 tokens to load them all
- tool set hash: a2ac7904ecc6ed6cdc73a2e2ae4227e6
- tools last changed: 2026-10-19T22:17:40.068Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.allthepossibles/preflight.svg)](https://protogrid.dev/servers/com.allthepossibles/preflight)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-19 `check_output` changed (title, description, inputSchema, annotations)
  - before: Check a structured output you're about to return or act on for degenerate-answer patterns a schema check can't see: invalid JSON, a placeholder value ('TBD', 'N/A', 'unknown') where a real answer should be, an array of byte-identical items (a common symptom of a loop that never advanced), or an expected field that's missing or empty. Schema validity and answer quality are different guarantees — call this before trusting your own output, not just after validating it parses.
  - after: Check a structured output you're about to return or act on for degenerate-answer patterns a schema check can't see: invalid JSON, a placeholder value ('TBD', 'N/A', 'unknown') where a real answer should be, an array of byte-identical items (a common symptom of a loop that never advanced), or an expected field that's missing or empty. Schema validity and answer quality are different guarantees, call this before trusting your own output, not just after validating it parses.
- 2026-10-19 `scan_extension` changed (title, annotations)
- 2026-10-19 `scan_content` changed (title, annotations)
- 2026-10-19 `scan_mcp_server` changed (title, description, annotations)
  - before: Check an MCP server for real risk signals before trusting it: unauthenticated transport, capability overreach (filesystem/shell/credential access with no scoping), and known-bad signatures. Pass a live server URL, or a manifest of tool definitions if the server isn't reachable over HTTP. Semantic prompt-injection detection runs too if a Pro API key is sent as an Authorization: Bearer header — see /docs.
  - after: Check an MCP server for real risk signals before trusting it: unauthenticated transport, capability overreach (filesystem/shell/credential access with no scoping), and known-bad signatures. Pass a live server URL, or a manifest of tool definitions if the server isn't reachable over HTTP. Semantic prompt-injection detection runs too if a Pro API key is sent as an Authorization: Bearer header, see /docs.

Full history: https://api.protogrid.dev/v1/servers/com.allthepossibles%2Fpreflight/changes

## Remotes

- https://preflight.allthepossibles.com/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (4)

- `check_output`: Check a structured output you're about to return or act on for degenerate-answer patterns a schema check can't see: invalid JSON, a placeholder value ('TBD', 'N/A', 'unknown') where a real answer should be, an array of byte-identical items (a common symptom of a loop that never advanced), or an expected field that's missing or empty. Schema validity and answer quality are different guarantees, call this before trusting your own output, not just after validating it parses.
- `scan_content`: Check a document or web page for hidden instructions before an agent reads, summarizes, or acts on it: invisible Unicode, obfuscated payloads, and (on Pro) a semantic pass for prompt-injection phrasing aimed at the model instead of the human reader. Pass either a URL to fetch, or raw text you already have.
- `scan_extension`: Check a VS Code extension or a Claude Skill before installing or trusting it. For a VS Code extension (which runs with full Node.js access and no permission model to scope): publisher domain-verification status weighed against install count, and known-bad-signature checks on its description. For a Claude Skill: hidden-instruction and obfuscated-payload detection on the SKILL.md body (the same engine scan_content uses), unscoped or credential-referencing tool grants in its allowed-tools/disallowed-tools frontmatter, inline shell execution baked into the file itself, and pattern matching on any bundled script files for credential-exfiltration signatures. Semantic prompt-injection detection on a skill's body runs too on Pro.
- `scan_mcp_server`: Check an MCP server for real risk signals before trusting it: unauthenticated transport, capability overreach (filesystem/shell/credential access with no scoping), and known-bad signatures. Pass a live server URL, or a manifest of tool definitions if the server isn't reachable over HTTP. Semantic prompt-injection detection runs too if a Pro API key is sent as an Authorization: Bearer header, see /docs.