# ClusterHack

> Run hackathons end to end: events, teams, submissions, judging and winners.

- name: dev.clusterhack/clusterhack
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 80/100 flags: no-repository
- quality: 88/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/dev.clusterhack%2Fclusterhack
- tools: https://api.protogrid.dev/v1/servers/dev.clusterhack%2Fclusterhack/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "clusterhack": {
      "type": "http",
      "url": "https://clusterhack.dev/mcp/"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 85
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-99% ~updated-53d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 88/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 60 of 60 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- warn `tools.token_cost`: about 10,601 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: 3 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 60, about 10,601 tokens to load them all
- tool set hash: 6208cff9955d74ab32f50fc364dd56a5
- tools last changed: 2026-10-11T00:57:16.582Z
- badge: [![protogrid quality](https://protogrid.dev/badge/dev.clusterhack/clusterhack.svg)](https://protogrid.dev/servers/dev.clusterhack/clusterhack)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-11 `team_seeking_members` changed (inputSchema)
- 2026-10-11 `team_list` changed (inputSchema)
- 2026-10-11 `search` changed (inputSchema)

Full history: https://api.protogrid.dev/v1/servers/dev.clusterhack%2Fclusterhack/changes

## Remotes

- https://clusterhack.dev/mcp/ (streamable-http, auth none, reachable true, uptime30d 0.99130434)

## Packages

_none_

## Tools (60)

- `account_ai_access`: How the signed-in user sees and revokes AI access to their own account —
read this instead of looking for a tool that lists or cuts off connected
clients, because there is deliberately no such tool.

The controls over AI access (list connected clients, revoke one, list and
end live MCP sessions, read the record of what a client did as them) are
gated to the account holder signing in directly: a browser session, a JWT,
or an API token they hold themselves. A connected AI client — including
this one — is refused, on purpose. If it were not, a client could revoke
its rivals, enumerate the user's other connections, or read the trail it
leaves behind. So this tool tells the user where to go and what they will
find; it makes no API call and cannot fail.

Also names where account deletion and data export live: the export has a
tool (`account_export_data`), the deletion deliberately does not.
- `account_how_to_sign_in`: Explains how to connect an account to this MCP server — read this instead
of guessing at a login/registration tool, because there isn't one.

ClusterHack's own credential endpoints (register, login, JWT issuance,
password reset) are the website's login form, not MCP tools: an MCP client
authenticates by OAuth 2.1 (the same flow a human approves in a browser
tab) and must never see or handle a ClusterHack password directly. This
tool works with no account at all, and just explains the steps and links.
- `article_get`: Retrieve one CMS article by id: its body, publish date, hidden flag, and
which title/slug and language it belongs to.
- `article_languages`: List the languages articles can be written in, e.g.
{"language_name": "English", "short_name": "en"}. Use this to find the
`language_id` `article_create` needs.
- `article_list`: Browse CMS articles (the pages under /articles/<language>/<slug>). Filter
by `language` (a language's short code, e.g. 'en') and/or `slug` (a
title's slug) to find one specific page's translations. Hidden drafts are
only included for staff callers; everyone else sees only published
articles.
- `article_titles`: List the CMS "title" records — each one a page's title text and slug,
e.g. {"title": "How to organize a hackathon", "slug": "how-to-organize"}.
An article always points at one of these; use this to find the `title_id`
`article_create` needs, or to see what pages exist at all.
- `company_about_us`: A company's longer "about us" blurb (up to 10,000 characters), separate
from its short `description`. Returns `found: false` if the company has
not written one yet.
- `company_employees`: A company's employee roster (position, start date). Without `company_id`,
returns every roster row the caller can see (their own employment rows
plus every company they administer) — the underlying API is already
scoped that way. With `company_id`, narrows to that company only.
- `company_employment_requests`: Pending requests to join a company. A company admin sees everyone waiting
on their door; anyone else sees only their own outstanding applications.
This is where the `request_id` for `company_decide_employment_request`
comes from.
- `company_ex_employees`: A company's former employees (position, start and end date) — the record
created when someone is fired via `company_fire_employee`. Without
`company_id`, returns every ex-employment row the caller can see (their
own, plus every company they administer).
- `company_get`: One company page by id: name, description, organisation type, website and
logo. Public read. Use it after `company_list` or `search` to get the full
record, and to confirm you have the right company before employment or
sponsorship actions, which are irreversible for the people involved.
- `company_list`: Browse ClusterHack company pages: name, description, org type, website and
logo. Public data — use this to find a company's id before calling any
other company tool.
- `company_roster`: The company page's public roster in one call: the people listed as
employees and the people listed as moderators, exactly as the company page
renders them to any visitor.

Use this — not `company_employees` / `company_admins` — whenever you want
to read *someone else's* roster. Those two are scoped to self-or-admin, so
an outsider gets an empty list from them and cannot tell "nobody works
here" apart from "you may not see who does". This endpoint is the part of
the page that is already public, and nothing more: no join requests, no
ex-employees, no write verbs.
- `company_vacancies`: The public board of companies not yet on ClusterHack (a lightweight
off-platform listing — name, description, website — not a job-posting
system). Public, no filters.
- `event_background_images`: The global catalogue of certificate background templates (used for the
`background` field of an event's certificate config). Not tied to one
event.
- `event_branding`: Read an event's white-label branding: brand colours, public-page theme and
dedicated subdomain, plus the resolved values actually used for rendering
and `branding_enabled` — whether the evening currently wears its costume,
i.e. whether those values are applied.

Public, because the colours are visible on the event page anyway. Use it
before `event_set_branding` to see what is already set.
- `event_cities`: The global catalogue of cities (used for the `city` field on
`event_create`/`event_update` and to show where events happen).
- `event_faq`: An event's FAQ: the question/answer pairs shown on its public page. Public
read — use it to answer a participant's question from the event's own words
before guessing, and to check what is already covered before adding more.
- `event_free_agents`: List participants at an event who are looking for a team.

Visibility follows the platform's own rule, not a full public roster:
a normal caller only sees their own free-agent listing here, while an
organiser of the event sees everyone's. Use `team_matchmaking_teams` on a
listing's id for AI-ranked team suggestions for that person.
- `event_get`: Get one event's full public profile by slug: name, dates, address, topic,
description, status and city.

Call this once you have a slug (from `event_list` or `search`) and need
the details. It does not include the schedule, FAQ or nominations — use
`event_schedule`, `event_faq` and `event_nominations` for those.
- `event_info_blocks`: An event's additional free-form information blocks (extra sections shown
on its public page beyond the main description — rules, prizes, sponsors
notes, etc.).
- `event_leaderboard`: The ranked leaderboard for one event: submissions ordered by weighted
judge score then vote count, with each entry's rank, team and score.
Public once the organiser publishes winners; before that, only the
event's admins and judges can preview it (everyone else gets a clear
"not published yet" error).
- `event_list`: Browse hackathons on the platform — filter by status, city or date.

Returns each event's slug, which every other event tool needs, plus name,
status, dates and city. Use this when the user names an event you do not
have a slug for and `search` is not precise enough, or to show a list of
upcoming/past events. Hidden events only appear here for their own
organisers.
- `event_my_membership`: Summarise the signed-in user's relationship to one event: whether they
have joined, their registration answers on file, whether they are listed
as a free agent, and which roles they hold there (organizer, judge, team
lead, ...).

Cheaper than combining several other tools when you just need "is this
user in, and how" for one event.
- `event_my_registration_answers`: List the signed-in user's own answers to one event's registration
questions. Only ever returns their own data — use
`event_registration_responses` (organiser only) to read other people's.
- `event_nominations`: An event's award nominations/tracks (e.g. "Best AI prototype"), used when
creating teams, awarding winners and building the leaderboard per track.
- `event_presets`: Public catalogue of event-creation presets (AI build day, student
hackathon, corporate innovation day, ...) with sensible defaults and
starter nominations. Call before `event_create` when the user describes a
kind of hackathon rather than exact field values.
- `event_registration_form`: List the custom questions an event asks at registration time (its
registration form), in display order.

Public data — the question text is visible to anyone. Use this before
`event_submit_registration_answers` to know which `form_field_id`s exist
and which are required.
- `event_roles`: Which roles the signed-in user holds at one specific event.

Cheaper and more precise than `whoami` when you already know the event and
just need to know whether the user can organise, judge or only take part.
- `event_schedule`: The event's timeline: an ordered list of stages/activities (opening,
workshops, deadlines, closing ceremony) with title, location, time window
and status (past/now/future). This is what participants see as "the
schedule". Broadcast link and chat link are only included for the event's
admins and registered participants — everyone else sees them blanked.
- `event_share_links`: The public links for promoting an event: its shareable page, the
calendar file participants can add to their own calendar, the Open Graph
preview image used when the link is pasted into chat, and a plain-text
digest meant for AI assistants. Handy when drafting an announcement — put
the share URL in the post and the .ics next to the date. Public read.
- `event_sponsors`: The on-platform companies sponsoring one event, with the sponsorship tier
each one is slotted into (e.g. "Sponsors", "Partners", "General Partner").
Public read. Use `event_sponsor_text` alongside this for sponsors that are
not themselves on ClusterHack yet.
- `event_sponsor_text`: Sponsors of one event that are NOT themselves on ClusterHack (a name,
description, website and logo entered as free text, with the sponsorship
tier each one belongs to) — the off-platform counterpart to
`event_sponsors`. Public read.
- `event_sponsor_tiers`: The sponsorship tiers/groups defined for one event (e.g. "Sponsors",
"Partners", "General Partner") — the buckets `event_add_sponsor` slots
companies into. Public read.
- `event_team_stages`: An event's team-facing reporting checkpoints (e.g. "Idea locked", "Demo
ready") with their time windows — distinct from `event_schedule`, which
is the event's own agenda. Used to track team progress through the event.
- `event_types`: The global catalogue of event types (used for the `type` field on
`event_create`/`event_update`). Small and rarely changes.
- `invite_preview`: Look up what a shareable invite link opens, without redeeming it.

Public and PII-free: returns the event's name and slug and whether the
token is still valid (active, not expired, uses remaining). Use this
before `invite_join` to show the user what they are about to join, or to
explain why a link stopped working.
- `legal_info`: The service's legal identity, as the terms-of-service, privacy and support
pages render it: the service and operating entity, whether that entity is
registered and where, the contact and privacy email addresses, the postal
address, the terms' effective date and the minimum age to hold an account.

Read it instead of hard-coding a copy — a client building its own footer,
quoting the contact address, or answering "how old do I have to be" should
take the values from here, where the pages themselves take them, so the two
cannot drift apart. Public: it needs no account, and it is the same text an
anonymous visitor already sees.
- `list_api_endpoints`: List the raw REST endpoints behind this server.

Use it together with `api_request` when you need something no curated tool
covers. The list is read from the live URL configuration, so it always
matches what the server actually serves.
- `list_capabilities`: The catalogue of everything this server can do, grouped by area.

Returns each tool available to the current connection with its one-line
purpose, the role it is meant for and the permission it consumes. Use it
when you are not sure a capability exists — it is cheaper than guessing tool
names, and it shows what the user would gain by granting more permissions.
- `search`: Search across the platform: events, teams, projects, people and articles.

One call when you do not yet know the identifier of the thing the user means
("the AI hackathon in Berlin", "Sasha's team"). Returns the matching objects
with the slug or id you need for every other tool.
- `server_info`: What this MCP server is, which version it speaks, and how to connect.

Useful for diagnostics and for telling the user where to manage or revoke
the connection.
- `showcase_browse`: Browse the public, cross-event showcase: shipped/submitted projects
ranked for display, with title, tagline, team name, vote count and a
cover image. Optionally narrow to one event. This is the public gallery —
use `event_leaderboard` instead when you specifically need judged
rankings for one event.
- `submission_get`: Retrieve one project submission by id: title, links, description, status,
approval status, vote count and attached media.

Anonymous and unrelated callers only see it once the team has submitted
(status "submitted"); drafts are visible only to the team, the event's
admins and its judges. Use `submission_list` or `submission_get_mine` when
you do not already know the numeric id.
- `submission_list`: Browse project submissions, filterable by event, team or status.

Anonymous and unrelated callers only ever see submitted (public) projects;
a signed-in caller additionally sees their own team's drafts and every
submission at events they administer or judge. ``status`` narrows the
returned page client-side (draft / submitted / disqualified) since the
underlying list endpoint does not filter by status itself — combine with a
larger `page_size` if you need it applied beyond one page.
- `submission_list_media`: List the screenshots/gallery images attached to a submission. Visibility
mirrors the parent submission: public once submitted, otherwise limited to
the team, event admins and judges.
- `submission_page`: Read a project's public page: the submission itself, every judge's written
feedback (signed with the judge's name only where that judge consented to
being named, empty otherwise), and — once the organiser has published the
winners — its placement, rank and judge score.

This is the tool for "what did the judges say about our project?".
`submission_get` returns the project's own fields and nothing about how it
was received; `judging_scores_for_submission` is scoped to judges and event
admins, so a team cannot read its own verdict through it. A submitted
project's page is public; a draft is visible only to its team and the
event's admins. Before the ceremony the placement is shown to the team and
the hosts alone, flagged `placement_private` so a client says "not
announced yet" instead of leaking it. `private_note` is the organisers'
line and is absent — not blanked, absent — from everyone else's payload.
- `tag_list`: List tags used to categorize content across the platform (articles,
projects and more share the same tag vocabulary).
- `team_get`: Get one team's full detail: name, description, project info, readiness,
accessibility flags, and which event and nomination it belongs to.

Only visible if the signed-in user belongs to the team, created it, or
administers its event.
- `team_list`: List teams — scoped to what the signed-in account can see: teams they
belong to, created, or administer via being an admin of the team's event.
This is never a full public directory of every team on the platform.

Filter by `event_slug` to see just one event's teams, or `search` to
match team/project name and description. Use `team_get` for the full
detail of one team once you have its id.
- `team_locations`: Read the physical location details linked to a team's additional-info
profile (street, city, state, zip), if one has been set. There is
currently no self-service way to create a new location through this API
— location rows are set up separately, then referenced by id via
`team_additional_info`'s `location_id`.
- `team_matchmaking_teams`: AI-ranked list of teams one free (teamless) participant could join,
within the same event. Callable by the free-agent listing's own owner,
or an admin of the event. Use `event_free_agents` or
`event_join_as_free_agent` to get a `free_member_id`. Throttled — do not
call it in a tight loop.
- `team_members`: List a team's current members with their role and caption. Use the row
`id` (a membership id, not a user id) with `team_assign_role` or
`team_remove_member`.
- `team_open_roles`: List the positions teams are looking to fill ("we need a designer").

Visibility is limited to what the signed-in account can already see:
their own team's open roles, or — if they organise the event — every
team's. It is not a public cross-team browse for a stranger looking for
any team: that is `team_seeking_members`, which reads the find-a-team
page's own list (pair it with `event_free_agents` and
`team_matchmaking_teams`). Filter with `team_id` for one team, or
`event_slug` to see everything the caller can see at that event.

`team_id` is answered exactly. `event_slug` (and the unfiltered form) is
not: the underlying endpoint narrows by one team at a time and has no
event filter, so a very large event can return a `note` saying rows were
left unscanned. Ask per team when that matters.
- `team_posts`: List a team's public updates ("twits") — the short build-log posts a team
publishes as it works, in the order the server returns them. Use it to catch
up on what a team has been doing, or to check what has already been posted
before writing another update with `team_post`.
- `team_readiness`: Check whether a team has marked itself ready to present, plus whether it
is banned or currently accessible for judging.
- `team_roles`: List the roles a team has defined (e.g. "Frontend", "Designer"), which
members can be assigned via `team_assign_role`.
- `team_seeking_members`: Browse the teams of one event that are advertising open positions — the
public "who is recruiting" list behind the find-a-team page, readable by
anyone, including someone who has not joined the event yet.

This is the tool for a person looking for a team. `team_open_roles` is the
other direction: it lists open positions the caller already has access to
(their own teams', or every team's if they organise the event) and shows a
stranger nothing. Each row here carries the team's public profile plus its
`open_roles`. Follow up with
`team_request_join`, or list yourself with `event_join_as_free_agent` if
nothing fits.
- `tech_list`: List technologies (tech-stack tags) that projects and teams can be
labelled with, e.g. "React", "PostgreSQL".
- `whoami`: Who is signed in, what roles they hold, and where.

Call this first in any new conversation. It returns the account, the OAuth
permissions this connection was granted, and — crucially — the list of
events, teams and companies the user belongs to *with the role they hold in
each one* (organizer, judge, participant, team lead, free agent, builder,
speaker, company admin, platform admin).

Use it to decide which tools apply before calling anything else, and to
resolve "my event" / "our team" into a concrete slug or id.