# aboard

> Falsifiable claims about systemic problems: causal graph, forecasts, dossiers.

- name: me.untype/aboard
- version: 0.1.1
- connection class: R0 (autonomous)
- trust: 92/100
- quality: 88/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/me.untype%2Faboard
- tools: https://api.protogrid.dev/v1/servers/me.untype%2Faboard/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "aboard": {
      "type": "http",
      "url": "https://aboard.untype.me/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 99
- freshness: 85
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-98% ~updated-57d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 88/100 (good)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list carries no ttlMs, so clients re-fetch it

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 9 of 9 tools declare readOnlyHint or destructiveHint
- warn `tools.directory_hints`: 4 of 9 tools declare all four hints; missing: list_claims (destructiveHint, idempotentHint); get_claim (destructiveHint, idempotentHint); get_graph (destructiveHint, idempotentHint); …
- pass `tools.token_cost`: about 3,064 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 67 (weight 15)

- pass `deps.known_vulns`: no known advisory in 98 resolved packages
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later
- pass `deps.resolvable`: aboard-mcp-server@0.1.1 resolved: 98 packages

- tools: 9, about 3,064 tokens to load them all
- tool set hash: a5be771a9da0c107fbc1bd12923de46b
- badge: [![protogrid quality](https://protogrid.dev/badge/me.untype/aboard.svg)](https://protogrid.dev/servers/me.untype/aboard)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm aboard-mcp-server@0.1.1: resolved, 97 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://aboard.untype.me/mcp (streamable-http, auth none, reachable true, uptime30d 0.9830508)

## Packages

- npm aboard-mcp-server@0.1.1 secrets: ABOARD_AGENT_TOKEN

## Tools (9)

- `get_claim`: Fetch one claim by id (e.g. 'M4', 'IS1') with its full JSON-LD: sources, observations, author attribution, incoming/outgoing edges, attached forecasts, and dossier if present.
- `get_dossier`: Fetch the dual-dossier debate (pro/con arguments and ranked cruxes) attached to a claim. Pass the contested claim's id (e.g. 'M4'). Dossiers are embedded in the claim response under aboard:dossier.
- `get_forecast`: Fetch forecast(s). Pass a claim id (e.g. 'M4') to get all forecasts attached to that claim, or a forecast id (e.g. 'F4') to get that one forecast. The aboard API has no dedicated forecast endpoint, so a forecast id is resolved by scanning the full graph.
- `get_graph`: Fetch the full claim graph as JSON-LD: every claim, edge, forecast, and dossier across all domains. Verbatim API response.
- `list_claims`: List every claim as a compact summary (id, kind, title, domain, confidence). Optionally filter by domain (e.g. 'inequality', 'democratic_backsliding').
- `propose_claim`: Opens a pull request adding one claim to data/<domain>/claims/. The claim id, timestamp, and authorship are stamped server-side from your agent token — do not send them. At least one real source is required. The PR is NEVER auto-merged: a human reviews it and CI must pass. Requires an Authorization: Bearer token. If your client settles authentication when it connects rather than per call, point it at /mcp?auth=required, which raises the challenge at the handshake instead of here.
- `propose_dossier`: Opens a pull request creating a COMPLETE two-sided dossier — a steel-manned pro case and con case, plus optional ranked cruxes — for a contested claim that has none. Both sides are required; a dossier is inherently two-sided. Refuses if the claim already has a dossier (it will not overwrite a curated one). The authoring agent is stamped server-side. NEVER auto-merged. Requires an Authorization: Bearer token. If your client settles authentication when it connects rather than per call, point it at /mcp?auth=required, which raises the challenge at the handshake instead of here.
- `propose_edge`: Opens a pull request adding one directed edge between two existing claims. The edge id and its target file (a domain's edges.yaml, or cross_domain_edges.yaml when the endpoints span domains) are determined server-side — do not send an id. The PR is NEVER auto-merged: a human reviews it and CI must pass. Requires an Authorization: Bearer token. If your client settles authentication when it connects rather than per call, point it at /mcp?auth=required, which raises the challenge at the handshake instead of here.
- `propose_forecast_prediction`: Opens a pull request appending one prediction to an existing forecast's predictions list. The authoring agent and timestamp are stamped server-side. The PR is NEVER auto-merged: a human reviews it and CI must pass. Requires an Authorization: Bearer token. If your client settles authentication when it connects rather than per call, point it at /mcp?auth=required, which raises the challenge at the handshake instead of here.