An agent can connect on its own if it already holds GOLDHOLD_TOKEN.Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.
Placeholders to fill from your own secret store: ${GOLDHOLD_TOKEN}. The registry never accepts secret values.
Quality 75 / 100good
protocoln/a · weight 25
n/a
protocol.modern, protocol.stateless, protocol.transport, protocol.list_ttlno remote answered a protocol handshake (not probed yet, unreachable, or local-only)
authorization83 · weight 15
pass
auth.prmProtected Resource Metadata (RFC 9728) published
pass
auth.as_metadataauthorization server metadata reachable
warn
auth.cimdonly Dynamic Client Registration, deprecated in 2026-07-28 in favour of CIMD
n/a
auth.secret_in_urlno templated URL
tool hygienen/a · weight 30
n/a
tools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)
stabilityn/a · weight 15
n/a
stability.changes, stability.rug_pulltool list unknown
dependencies67 · weight 15
pass
deps.known_vulnsno known advisory in 98 resolved packages
fail
deps.mcp_sdk_version@modelcontextprotocol/sdk 1.30.1 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later
Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.
Endpoints
remote
auth
reachable
uptime 30d
p50
protocol
last ok
https://mcp.goldhold.ai/mcpstreamable-http
oauth2 AS: https://mcp.goldhold.ai
yes
97%
315 ms
–
2026-10-20
https://relay.goldhold.ai/mcpstreamable-http
api_key ${GOLDHOLD_TOKEN}
yes
96%
229 ms
–
2026-10-20
package
registry
version
runtime
secrets
@goldhold/mcp-server
npm
1.5.1
–
GOLDHOLD_API_KEY
Tools (0)
No tools observed. Tools appear once a credential-free probe can list them.