Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "cra-check": {
      "type": "http",
      "url": "https://api.tokenizen.nl/mcp"
    }
  }
}

claude mcp add --transport http cra-check https://api.tokenizen.nl/mcp

[mcp_servers.cra-check]
url = "https://api.tokenizen.nl/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cra-check": {
      "type": "remote",
      "url": "https://api.tokenizen.nl/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "cra-check": {
      "type": "http",
      "url": "https://api.tokenizen.nl/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=cra-check&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vYXBpLnRva2VuaXplbi5ubC9tY3AifQ%3D%3D"
}

{
  "servers": {
    "cra-check": {
      "type": "http",
      "url": "https://api.tokenizen.nl/mcp"
    }
  }
}

{
  "mcpServers": {
    "cra-check": {
      "httpUrl": "https://api.tokenizen.nl/mcp"
    }
  }
}

extensions:
  "cra-check":
    enabled: true
    name: "cra-check"
    type: streamable_http
    uri: "https://api.tokenizen.nl/mcp"
    timeout: 300

Quality 91 / 100strong

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene100 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations2 of 2 tools declare readOnlyHint or destructiveHint
pass
tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
pass
tools.token_costabout 563 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changes1 tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

2 tools, about 563 tokens to load them all · tool set f404a502abeb · tools last changed 2026-11-02 · checked 2026-11-07 18:01 UTC

Tool changes

2026-11-02check_x402_endpointadded
Makes one anonymous request to a public x402 payment endpoint, without ever paying, and reports whether its payment request passes the official buyer schema and how far up the receipt ladder the seller gets (does it name what it sells, does it sign its offer, does it return a signed receipt). Use it before an agent pays an endpoint it has not used before. The answer carries verdicts only, never the endpoint's raw headers or body. It is an indication from one request, not an endorsement, not a security review and not a promise that the seller will deliver; every answer says what it did not measure.

Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 94 / 100

provenance80

liveness100

freshness100

hygiene100

+repository +namespace-matches-repo +reachable +uptime-100% +updated-9d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://api.tokenizen.nl/mcp` streamable-http	none	yes	100%	368 ms	2025-11-25	2026-11-07

Tools (2)

check_github_reporead-only Reads up to about thirty public pages of a public GitHub repository and reports which of eight security signals are visible: a security policy that names a contact or a reporting link, a software bill of materials, proof of where releases come from, a lockfile, automatic updates of dependencies, security scans in CI, recent maintenance and a licence. For each signal that is not visible the answer says what would make it visible; a signal that could not be read completely is marked not measured, never as a gap. The eight signals are a selection related to topics in the EU Cyber Resilience Act. This is an indication from public data, not a compliance check, not a certificate and not legal advice; private repositories and hosts other than GitHub cannot be checked. Read only. Limited to a few checks per ten minutes per address.

check_x402_endpointread-only Makes one anonymous request to a public x402 payment endpoint, without ever paying, and reports whether its payment request passes the official buyer schema and how far up the receipt ladder the seller gets (does it name what it sells, does it sign its offer, does it return a signed receipt). Use it before an agent pays an endpoint it has not used before. The answer carries verdicts only, never the endpoint's raw headers or body. It is an indication from one request, not an endorsement, not a security review and not a promise that the seller will deliver; every answer says what it did not measure.

Schemas: list_tools.

Also listed as

1 other active names share this repository: io.github.holistis/capacity-attest

Similar MCP servers

More from io.github.holistis

Official server.json

{
  "name": "io.github.holistis/cra-check",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://api.tokenizen.nl/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "0.1.0",
  "repository": {
    "url": "https://github.com/holistis/tokenizen",
    "source": "github",
    "subfolder": "packages/self-check-server"
  },
  "description": "Free read-only check of a public GitHub repo for eight security signals related to the EU CRA."
}