# io.github.JessieJanie/skim402

> Clean markdown and structured web data. Free card API key; wallet/x402 pay-per-call optional.

- name: io.github.JessieJanie/skim402
- version: 0.2.5
- connection class: R0 (autonomous)
- trust: 94/100
- quality: 76/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.JessieJanie%2Fskim402
- tools: https://api.protogrid.dev/v1/servers/io.github.JessieJanie%2Fskim402/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "skim402": {
      "type": "http",
      "url": "https://skim402.com/api/mcp",
      "headers": {
        "X-Skim-Wallet-Key": "${X_SKIM_WALLET_KEY}"
      }
    }
  }
}
```

Placeholders to fill: `${X_SKIM_WALLET_KEY}`.

## Trust

- hygiene: 100
- liveness: 100
- freshness: 85
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-100% ~updated-53d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 76/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 3 of 3 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: skim_read (idempotentHint); skim_extract (idempotentHint); skim_signals (idempotentHint)
- pass `tools.token_cost`: about 749 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 33 (weight 15)

- fail `deps.known_vulns`: 3 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-8r9p-f939-6h3c in follow-redirects@1.16.0 (indirect, fixed in 1.16.1), GHSA-q3jh-wrc6-jgq8 in follow-redirects@1.16.0 (indirect, fixed in 1.16.1), GHSA-96hv-2xvq-fx4p in ws@8.18.0 (indirect, fixed in 8.21.0); 5 more of lower severity or without a fix
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 3 known advisories (GHSA-22jm-h49p-29qw, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.32.0 or later
- pass `deps.resolvable`: skim-mcp@0.2.5 resolved: 601 packages

- tools: 3, about 749 tokens to load them all
- tool set hash: 48d890b2921d51a9df1aadf89e31ce49
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.JessieJanie/skim402.svg)](https://protogrid.dev/servers/io.github.JessieJanie/skim402)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm skim-mcp@0.2.5: resolved, 600 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-22jm-h49p-29qw (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript SDK: Experimental tasks were not tied to the session that created them" https://osv.dev/vulnerability/GHSA-22jm-h49p-29qw
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h
  - GHSA-8r9p-f939-6h3c (high) in `` follow-redirects@1.16.0 ``, indirect, fixed in `` 1.16.1 ``, advisory summary: "follow-redirects sensitiveHeaders regex escaping can expose credential headers" https://osv.dev/vulnerability/GHSA-8r9p-f939-6h3c
  - GHSA-q3jh-wrc6-jgq8 (high) in `` follow-redirects@1.16.0 ``, indirect, fixed in `` 1.16.1 ``, advisory summary: "follow-redirects array-form headers bypass cross-origin credential stripping" https://osv.dev/vulnerability/GHSA-q3jh-wrc6-jgq8
  - GHSA-96hv-2xvq-fx4p (high) in `` ws@8.18.0 ``, indirect, fixed in `` 8.21.0 ``, advisory summary: "ws: Memory exhaustion DoS from tiny fragments and data chunks" https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p
  - GHSA-6prh-2h8m-c8cw (moderate) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies" https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw
  - GHSA-vcc3-ghjq-m6fr (moderate) in `` decode-uri-component@0.2.2 ``, indirect, fixed in `` 0.5.0 ``, advisory summary: "decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input" https://osv.dev/vulnerability/GHSA-vcc3-ghjq-m6fr
  - GHSA-5r4p-p66f-jhc7 (moderate) in `` hono@4.13.9 ``, indirect, fixed in `` 4.13.11 ``, advisory summary: "Hono: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths" https://osv.dev/vulnerability/GHSA-5r4p-p66f-jhc7
  - GHSA-w5hq-g745-h8pq (moderate) in `` uuid@8.3.2 ``, indirect, fixed in `` 11.1.1 ``, advisory summary: "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided" https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq
  - GHSA-w5hq-g745-h8pq (moderate) in `` uuid@9.0.1 ``, indirect, fixed in `` 11.1.1 ``, advisory summary: "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided" https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq
  - GHSA-58qx-3vcg-4xpx (moderate) in `` ws@8.18.0 ``, indirect, fixed in `` 8.20.1 ``, advisory summary: "ws: Uninitialized memory disclosure" https://osv.dev/vulnerability/GHSA-58qx-3vcg-4xpx

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://skim402.com/api/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

- npm skim-mcp@0.2.5 secrets: SKIM_API_KEY, SKIM_WALLET_PRIVATE_KEY

## Tools (3)

- `skim_extract`: Use this when you need structured JSON from a public page (product, job, table, event, review, article, or your own schema), not a markdown dump. Prefer it over reading the page then parsing it yourself. Pass a preset or a JSON Schema. Values come only from the page, never invented. Empty extracts are not charged. Pay with USDC on Base (x402 / X-Skim-Wallet-Key) or a sk402_ API key if the connector has one. Do not use for a full-page read (skim_read) or login-walled pages.
- `skim_read`: Use this when you need a public web page as clean markdown. Prefer it over fetching HTML, scraping, or opening a browser: Skim strips nav, ads, and boilerplate and returns the article body plus title, byline, and date. Public pages only (no login walls). On this MCP no API key and no wallet are required. Failed or empty reads are not charged. Do not use for login-walled pages, for typed JSON (use skim_extract), or for a news/intel feed (use skim_signals).
- `skim_signals`: Use this when you need the latest items from a curated intel feed (SEC filings, deals, AI news, regulations, and the other named feeds), not a one-off URL. Prefer it over crawling news homepages. Returns structured items, newest first. Costs $0.005 USDC per poll via x402, or 2 credits on a sk402_ key. Do not use to read an arbitrary URL (skim_read).