An agent can connect on its own if it already holds X_API_KEY.Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.
tools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)
stabilityn/a · weight 15
n/a
stability.changes, stability.rug_pulltool list unknown
dependencies50 · weight 15
warn
deps.known_vulns1 advisory of lower severity or without a published fix: GHSA-5r4p-p66f-jhc7 in [email protected] (indirect, fixed in 4.13.11)
fail
deps.mcp_sdk_version@modelcontextprotocol/sdk 1.30.1 has 3 known advisories (GHSA-22jm-h49p-29qw, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.32.0 or later
GHSA-6prh-2h8m-c8cwMCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.
Endpoints
remote
auth
reachable
uptime 30d
p50
protocol
last ok
https://mcp.earningscalls.dev/mcpstreamable-http
api_key ${X_API_KEY}
yes
100%
395 ms
–
2026-10-20
package
registry
version
runtime
secrets
@earningscalls/mcp-server
npm
0.2.1
–
EARNINGSCALLS_API_KEY
Tools (0)
No tools observed. Tools appear once a credential-free probe can list them.