# MCPLookup

> Look up independent trust ratings and security, maintenance, and adoption evidence for MCP servers.

- name: com.mcplookup/mcp
- version: 0.1.6
- connection class: R0 (autonomous)
- trust: 93/100
- quality: 91/100 (strong)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.mcplookup%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/com.mcplookup%2Fmcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "mcplookup": {
      "type": "http",
      "url": "https://mcplookup.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 85
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-100% ~updated-64d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 91/100 (strong)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 3 of 3 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: find_servers (idempotentHint); trust_lookup (idempotentHint); resolve_server (idempotentHint)
- pass `tools.token_cost`: about 939 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 100 (weight 15)

- pass `deps.known_vulns`: no known advisory in 1 resolved packages
- n/a `deps.mcp_sdk_version`: the official MCP SDK is not in the dependency graph
- pass `deps.resolvable`: @mcplookup/mcp@0.1.6 resolved: 1 packages

- tools: 3, about 939 tokens to load them all
- tool set hash: d91b98bbfa06f065d2e40b3d432d2f72
- badge: [![protogrid quality](https://protogrid.dev/badge/com.mcplookup/mcp.svg)](https://protogrid.dev/servers/com.mcplookup/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm @mcplookup/mcp@0.1.6: resolved, 0 dependencies

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://mcplookup.com/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

- npm @mcplookup/mcp@0.1.6

## Tools (3)

- `find_servers`: Find a compact, trust-aware shortlist for a task or capability when no particular MCP server or product is known. Search by free text or MCPLookup's normalized capability taxonomy, with optional filters. Free text returns a reviewed identity-only slate when available; otherwise results are explicitly labelled catalog matches, and the two evidence lanes are never mixed. Returns at most five results with no pagination. A selected exact server name can be passed to resolve_server for reviewed identity context and connection options; named artifacts fit resolve_server directly.
- `resolve_server`: Resolve a named MCP server, vendor, product, package, repository, Registry identifier, or endpoint to a canonical MCPLookup identity. Returns at most five reviewed candidates with query-relative identity and publisher explanations, a compact trust assessment, and current connection options. This is the best fit when a particular artifact or product is known; find_servers covers open-ended capability discovery, while trust_lookup returns the full current evidence record for an exact canonical name.
- `trust_lookup`: Return MCPLookup's complete current trust record for one exact canonical MCP server name. Includes the verdict, Trust Index band and 0–100 score with confidence, coarse safety, maintenance, adoption, and provenance bands, coverage, freshness, public evidence, and citation. This fits trust questions and evidence review after identity is known; resolve_server handles ambiguous names or coordinates. Current state only—no history or safety certification.