An agent can connect after a one-time OAuth consent by a human.Remote endpoint behind OAuth 2. Tokens stay with the agent; the registry only exposes the authorization metadata.
Placeholders to fill from your own secret store: ${ENCARAPI_MCP_TOKEN}, ${X_CHINA_KEY}. The registry never accepts secret values.
Quality 83 / 100good
protocoln/a · weight 25
n/a
protocol.modern, protocol.stateless, protocol.transport, protocol.list_ttlno remote answered a protocol handshake (not probed yet, unreachable, or local-only)
authorization83 · weight 15
pass
auth.prmProtected Resource Metadata (RFC 9728) published
pass
auth.as_metadataauthorization server metadata reachable
warn
auth.cimdonly Dynamic Client Registration, deprecated in 2026-07-28 in favour of CIMD
n/a
auth.secret_in_urlno templated URL
tool hygienen/a · weight 30
n/a
tools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)
stabilityn/a · weight 15
n/a
stability.changes, stability.rug_pulltool list unknown
dependenciesn/a · weight 15
n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvabledeps.dev does not know [email protected]
Tool list unknown · checked 2026-10-20 10:35 UTC
Tool changes
No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
Dependencies
[email protected]npmthis version is not known to the dependency resolver
Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.
Endpoints
remote
auth
reachable
uptime 30d
p50
protocol
last ok
https://mcp.encarapi.com/mcpstreamable-http
oauth2 AS: https://mcp.encarapi.com/
yes
98%
594 ms
–
2026-10-20
package
registry
version
runtime
secrets
encarapi-mcp
npm
1.6.0
–
ENCARAPI_KEY, CHINACARAPI_KEY
Tools (0)
No tools observed. Tools appear once a credential-free probe can list them.
Live used car listings from China (Dongchedi, Che168) in English, with inspection reports.
Official server.json
{
"name": "io.github.ThatMojo/encarapi-mcp",
"title": "EnCarAPI - Korean & Chinese used cars",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://mcp.encarapi.com/mcp",
"type": "streamable-http",
"headers": [
{
"name": "Authorization",
"isSecret": true,
"description": "Optional: Bearer <your EnCarAPI key>. Without it the server starts the OAuth flow (paste the key once in the browser)."
},
{
"name": "x-china-key",
"isSecret": true,
"description": "Optional: a separate ChinaCarAPI key for the Chinese tools."
}
]
}
],
"version": "1.6.0",
"packages": [
{
"version": "1.6.0",
"transport": {
"type": "stdio"
},
"identifier": "encarapi-mcp",
"registryType": "npm",
"environmentVariables": [
{
"name": "ENCARAPI_KEY",
"isSecret": true,
"description": "EnCarAPI key (https://encarapi.com). Set this and/or CHINACARAPI_KEY."
},
{
"name": "CHINACARAPI_KEY",
"isSecret": true,
"description": "ChinaCarAPI key (https://chinacarapi.com). Set this and/or ENCARAPI_KEY."
}
]
}
],
"repository": {
"url": "https://github.com/ThatMojo/encarapi-mcp",
"source": "github"
},
"websiteUrl": "https://encarapi.com/?utm_source=mcp_registry&utm_medium=encarapi-mcp",
"description": "Live used car listings from South Korea (Encar, KB Chachacha, K Car) and China (Dongchedi, Che168)."
}