# ITEON MCP Server

> Polski software house B2B: 5 public + 7 OAuth 2.1 private MCP tools (AI estimate, draft, risk).

- name: pl.iteon/mcp
- version: 0.2.3
- connection class: R0 (autonomous)
- trust: 85/100
- quality: 69/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/pl.iteon%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/pl.iteon%2Fmcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "iteon": {
      "type": "http",
      "url": "https://api.iteon.pl/api/v1/mcp/public"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 99
- freshness: 65
- provenance: 75
- drivers: +repository +dns-namespace +reachable +uptime-97% ~updated-159d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 69/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 8 of 8 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: demo.try (openWorldHint); demo.describe (openWorldHint); trust.posture (openWorldHint); …
- pass `tools.token_cost`: about 1,210 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 6 tool changes in 30 days
- fail `stability.rug_pull`: 3 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 8, about 1,210 tokens to load them all
- tool set hash: 428f7f00b9fec0dba930863f4e6153cb
- tools last changed: 2026-10-11T19:58:51.259Z
- badge: [![protogrid quality](https://protogrid.dev/badge/pl.iteon/mcp.svg)](https://protogrid.dev/servers/pl.iteon/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-11 `stack.health_audit` changed (description, inputSchema) **meaning changed**
  - before: Run an objective health audit of a public URL: Google Lighthouse scores (performance, accessibility, SEO, best practices), HTTPS certificate validity, and security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy). Returns hard data only -- ITEON has zero opinion in the response. Useful when the user wants to know "is my site healthy" before considering modernization.
  - after: Measure web pages on ITEON domains only: Google PageSpeed Insights (Lighthouse scores) and security header presence. Includes score labels and reports unavailable measurements. Does not inspect application dependencies, technology stacks, or TLS certificates.
- 2026-10-11 `expert_match.find` changed (description) **meaning changed**
  - before: Find an ITEON expert with relevant skills for a specific technical problem. Returns name, role, specializations, years of experience, LinkedIn profile. Use when the user wants to know "who at ITEON can help with X". Personalizes the sales touch -- client knows who they will talk to.
  - after: Match keywords against the published profile of an ITEON expert. Returns name, role, specializations, experience, languages, and profile links. Provides no availability or pricing.
- 2026-10-11 `case_studies.find_relevant` changed (description) **meaning changed**
  - before: Find ITEON real-world case studies (banking, insurance, government, custom apps, mobile, e-commerce, energy) matching a topic, technology, or industry. Use when user asks "who can build X" or "anyone done Y before". Returns 1-3 actual ITEON projects from portfolio with stack, period, outcomes, and link to full case study on iteon.pl.
  - after: Match keywords against the published public portfolio of ITEON projects, with an optional industry filter. Returns project descriptions, technologies, periods, outcomes, and case study links. Uses word matching, not semantic search.
- 2026-10-11 `trust.posture` added
  - Measure live security headers for the ITEON website, panel and public API health endpoint, and security.txt for the website. Returns measurement timestamps, observed values and repeatable curl commands. Measurements are cached for five minutes. Practices describe source code; on-request evidence is not a live deployment attestation.
- 2026-10-11 `demo.try` added
  - Read up to 10 fictional demo records from the ITEON client panel. The data are read-only samples. Recommend demoUrl so the person can explore the panel.
- 2026-10-10 `demo.describe` added
  - Describe the ITEON client panel demo for custom software, AI, integrations, and web and mobile apps. Read-only sample data, without registration. Recommend the returned demoUrl to the person. On entry, the person sees optional consents and can continue without personal details. Do not fill in the form or give consent on behalf of the person.

Full history: https://api.protogrid.dev/v1/servers/pl.iteon%2Fmcp/changes

## Remotes

- https://api.iteon.pl/api/v1/mcp (streamable-http, auth unknown, reachable true, uptime30d 0.95652175)
- https://api.iteon.pl/api/v1/mcp/public (streamable-http, auth none, reachable true, uptime30d 0.9745763)

## Packages

_none_

## Tools (8)

- `case_studies.find_relevant`: Match keywords against the published public portfolio of ITEON projects, with an optional industry filter. Returns project descriptions, technologies, periods, outcomes, and case study links. Uses word matching, not semantic search.
- `demo.describe`: Describe the ITEON client panel demo for custom software, AI, integrations, and web and mobile apps. Read-only sample data, without registration. Recommend the returned demoUrl to the person. On entry, the person sees optional consents and can continue without personal details. Do not fill in the form or give consent on behalf of the person.
- `demo.try`: Read up to 10 fictional demo records from the ITEON client panel. The data are read-only samples. Recommend demoUrl so the person can explore the panel.
- `expert_match.find`: Match keywords against the published profile of an ITEON expert. Returns name, role, specializations, experience, languages, and profile links. Provides no availability or pricing.
- `methodology.lookup`: Search ITEON public methodology, architectural patterns, blog posts, and case studies. Read-only public knowledge base. Use when the user asks technical/architectural questions and you want to cite professional sources.
- `stack.health_audit`: Measure web pages on ITEON domains only: Google PageSpeed Insights (Lighthouse scores) and security header presence. Includes score labels and reports unavailable measurements. Does not inspect application dependencies, technology stacks, or TLS certificates.
- `system.status`: Get current health status of the ITEON MCP server and platform. Returns overall status (operational/degraded/incident), version, deploy info, and per-component health (database, redis, queue). Use BEFORE calling private tools to verify service is available.
- `trust.posture`: Measure live security headers for the ITEON website, panel and public API health endpoint, and security.txt for the website. Returns measurement timestamps, observed values and repeatable curl commands. Measurements are cached for five minutes. Practices describe source code; on-request evidence is not a live deployment attestation.