# nophi.sh

> Public facts on nophi.sh, phishing-awareness training for French SMBs: catalogue, prices, security.

- name: sh.nophi/nophish
- version: 1.0.2
- connection class: R0 (autonomous)
- trust: 83/100 flags: no-repository
- quality: 96/100 (strong)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/sh.nophi%2Fnophish
- tools: https://api.protogrid.dev/v1/servers/sh.nophi%2Fnophish/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "nophish": {
      "type": "http",
      "url": "https://app.nophi.sh/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% +updated-5d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 96/100 (strong)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 9 of 9 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 2,175 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump
- pass `tools.hidden_text`: no hidden text in tool names, descriptions, schemas or annotations

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name
- pass `stability.new_links`: no tool change named a new site

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 9, about 2,175 tokens to load them all
- tool set hash: 203eb41667c635fe3551e2cd8b5e5e32
- badge: [![protogrid quality](https://protogrid.dev/badge/sh.nophi/nophish.svg)](https://protogrid.dev/servers/sh.nophi/nophish)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://app.nophi.sh/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (9)

- `compare_fit`: Fit check for one company. Inputs, all optional: company size, mail provider, up to 20 needs.
        Returns the plan for the size (Enterprise on quote above the largest plan), the mail prerequisites for
        the provider, and a status per need: covered, not_covered (SMS, phone/vishing, attachment and
        ransomware-encryption simulations, with the related training), see_facts, or unknown (no public fact;
        contact address given); plus the known gaps and the trial link.
- `get_deliverability_prerequisites`: Mail-system configuration needed for simulation e-mails to reach inboxes, per provider:
        Microsoft 365 (Advanced Delivery, with the sending IPs and domains), Google Workspace and OVH (guidance
        on request); plus the option of sending from the company's own domain or mailbox. Optional filter:
        mail_provider.
- `get_overview`: Summary of nophi.sh, a phishing-awareness training service for French SMBs: target audience,
        capabilities, the 5-step workflow, catalogue sizes (simulation templates per language, QR-code
        templates, courses, course themes), features not included, free trial terms and the free team quiz.
        Public facts; no account needed.
- `get_pricing`: Plans with their user limits and prices in EUR excluding VAT (monthly, and billed annually), the
        Enterprise tier (on quote, above the largest plan), and the free trial terms (14 days, no card) with
        the signup link.
- `get_security_and_data`: Security questionnaire answers with their date: hosting (France), backups, subprocessors (name,
        country, purpose), encryption in transit and at rest, passwords on simulated login pages (not
        collected), employee data processed, retention periods, exports. Topics outside this list are not
        covered by this server; the answer includes the contact address for them.
- `get_template_categories`: Categories of phishing simulation templates: key, label, template counts per language and per
        difficulty, and the course assigned to repeat clickers; also the total and QR-code template counts.
        The category keys are the values accepted by the category filter of list_simulation_templates.
- `list_courses`: Security-awareness course catalogue grouped by theme (essentials, fraud and money, attack channels,
        everyday habits, industry): per course the title, description, number of lessons, duration in minutes,
        quiz questions and passing score; also how courses are assigned after a click, and the practice
        exercise. Optional filter: theme.
- `list_simulation_templates`: E-mail phishing simulation templates in one language: name, category, difficulty, QR-code flag,
        titles of the red flags employees learn to spot, and the course assigned to repeat clickers.
        Metadata only (no e-mail bodies, no links). Optional filters: category, difficulty. Paginated:
        limit (1-100, default 20) and offset; the result includes total and next_offset.
- `start_trial_link`: Signup URL of the 14-day free trial (no card) and the steps a person completes: sign up and verify
        their e-mail address; simulations can only target their own company's e-mail domain. Returns a link
        only: creates no account and sends no e-mail.