# ideaudit

> The scoring behind an audit allowed to say no. Twenty deterministic tools, offline, no account.

- name: studio.inite/ideaudit-tools
- version: 1.1.0
- connection class: R0 (autonomous)
- trust: 92/100
- quality: 74/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/studio.inite%2Fideaudit-tools
- tools: https://api.protogrid.dev/v1/servers/studio.inite%2Fideaudit-tools/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "ideaudit-tools": {
      "type": "http",
      "url": "https://api.inite.studio/mcp",
      "headers": {
        "Authorization": "Bearer ${IDEAUDIT_TOOLS_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${IDEAUDIT_TOOLS_TOKEN}`.

## Trust

- hygiene: 100
- liveness: 99
- freshness: 85
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-97% ~updated-43d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 74/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: compute_dealbreakers_v2 (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); compute_funding_momentum (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); compute_search_velocity (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 3,895 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 50 (weight 15)

- warn `deps.known_vulns`: 1 advisory of lower severity or without a published fix: GHSA-5r4p-p66f-jhc7 in hono@4.13.9 (indirect, fixed in 4.13.11)
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 3 known advisories (GHSA-22jm-h49p-29qw, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.32.0 or later
- pass `deps.resolvable`: @inite/ideaudit-tools@1.0.0 resolved: 98 packages

- tools: 21, about 3,895 tokens to load them all
- tool set hash: 7cac547828065ce4ba90fc952f99e99f
- badge: [![protogrid quality](https://protogrid.dev/badge/studio.inite/ideaudit-tools.svg)](https://protogrid.dev/servers/studio.inite/ideaudit-tools)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm @inite/ideaudit-tools@1.0.0: resolved, 97 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-22jm-h49p-29qw (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript SDK: Experimental tasks were not tied to the session that created them" https://osv.dev/vulnerability/GHSA-22jm-h49p-29qw
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h
  - GHSA-6prh-2h8m-c8cw (moderate) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies" https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw
  - GHSA-5r4p-p66f-jhc7 (moderate) in `` hono@4.13.9 ``, indirect, fixed in `` 4.13.11 ``, advisory summary: "Hono: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths" https://osv.dev/vulnerability/GHSA-5r4p-p66f-jhc7

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://api.inite.studio/mcp (streamable-http, auth none, reachable true, uptime30d 0.9655172)

## Packages

- npm @inite/ideaudit-tools@1.0.0

## Tools (21)

- `compute_barrier`: Compute barrier_score (0-24) + label (PRISTINE/OPEN/COMPETITIVE/CROWDED) from competitor counts + SERP noise fraction.
- `compute_budget_proof`: Compute budget_proof_score (0-10) + label (STRONG/CONFIRMED/WEAK/ABSENT) + purchase_intent_pct from pricing hits + review-site hits + intent mentions.
- `compute_build_complexity`: Compute build_complexity_penalty (0-10, higher = worse) + per-factor breakdown. Hard tags: ml/realtime/blockchain/hardware/compliance/custom-ai/regulated/on-device-ai/iot.
- `compute_collection_scores`: Compute 12 deterministic collection scores (0-100) + badges + death reason for an enriched idea. Pure math. No external calls.
- `compute_crossed_matrix`: Crossed-product audit explorer. Same input as compute_dealbreakers_v2 — returns substrate verdict (no-observer baseline) + crossed verdict (when observer supplied) + a 5-row matrix of {solo, cofounded_technical, cofounded_business, domain_expert, serial} archetype verdicts. Never persists; meant for the dashboard "view as [archetype]" dropdown and for previewing a verdict before committing to it.
- `compute_dealbreakers_v2`: Methodology v2 dealbreakers — stage-aware weights + confidence-weighted lens scoring + risk-asymmetric verdict (GO requires score≥80 AND zero red flags AND avg confidence≥0.6). Optional `observer` triggers the crossed-product pipeline: substrate verdict (no-observer baseline) PLUS crossed verdict (observer-perturbed weights, risk-tolerance shifted thresholds) PLUS 5-row archetype matrix. The KILL gate (≥2 blockers / score<50) is observer-invariant — fatal stays fatal.
- `compute_funding_momentum`: Compute funding_momentum_score (0-10) + badge (HOT/WARM/COOL/COLD) from tier-weighted funding-article hit counts.
- `compute_hiring_demand`: Compute hiring_demand_score (0-10) from priority-weighted ATS site hit counts (use registries/hiring-sources for priorities).
- `compute_lrs_composite`: Compose lrs_final_100 (0-100) + label (WEAK/EMERGING/GOOD/STRONG/ELITE) + leaderboard_eligible flag + sub-percent breakdown. Weights: sv 0.25, sp 0.30, barrier 0.25, monetization 0.20.
- `compute_lrs_composite_v2`: LRS composite v2 — 6 components (SV, Pain, Barrier, Monet, X-Signal, Budget-Proof). Default Python weights 0.18/0.22/0.18/0.14/0.18/0.10 sum=1.0. Returns BOTH weighted score and equal-weight baseline (per OECD Handbook + Greco 2018 — equal-weight is defensible default when no outcome calibration exists). buildComplexityPenalty 0-10 subtracted from score. sectorProfile (ai_native/creator/crypto) opt-in reshuffles SV→0.16, X→0.20. Labels: THE_ROAR (≥80) / PROMISING (≥60) / EXPERIMENTAL (≥40) / WEAK_SIGNAL (<40).
- `compute_monetization`: Compute monetization_score (0-21) + label + has_pricing_anchors from pricing anchors + model tags + deal cycle hint.
- `compute_multi_source_tam`: Multi-source TAM consensus. Pass 2-3 sources of market-size text. Optional `estimateYear` per source — when supplied, the result includes yearRange and a hasStaleData flag (true if the span exceeds 5 years). Outliers are dropped by modified Z-score over the median absolute deviation when n≥4. Returns the extracted dollar amounts + consensus median + an agreement score 0..1, where 1 means every source lands within 20% of the median.
- `compute_ppc_spend_signal`: Wave 5 N.4 — compute ppc_spend_score (0-10) + label (STRONG/CONFIRMED/WEAK/ABSENT) + market_saturation from PPC traffic projection (avgCpcUsd, totalMonthlySpendUsd, optional competitorBidders + competition). Feed numbers from dataforseo_ad_traffic.
- `compute_search_velocity`: Compute search_velocity_score (0-25) from Trends timeline values + rising queries count + geo region count.
- `compute_search_velocity_v2`: Search velocity (0-25) v2 — canonical 0.40*volume + 0.30*trend + 0.20*intent + 0.10*geo. CRITICAL: externalVolumeNorm MUST come from external sources (Amazon BSR / app store installs / job-board postings) — NOT the Trends timeline (would double-count, since Trends is itself normalized 0-100 within window). trendNorm is derived internally from trendsTimelineValues. Trends peak<50 zeroes the trend component (Yotpo SEO floor). Optional daysSinceLastSignal applies exponential freshness decay (search half-life 90d).
- `compute_social_pain`: Compute social_pain_score (0-30) + total mentions + dominant perspective (business/consumer/trend/mixed).
- `compute_urgency_composite`: Compose composite_urgency_score (0-10) + badge (LOW/MEDIUM/HIGH/VERY_HIGH/EXTREME) from 3 sub-scores: news, pain, hiring.
- `compute_x_signal`: Compute x_signal_score (0-20) + recency share + positivity rate from X/Twitter mention counts.
- `derive_kill_criteria`: Derive a falsifiable, data-driven list of kill criteria from upstream signals — the outputs of validate_unit_economics and compute_dealbreakers_v2, plus an ICP drift count. Returns one row per rule with {rule, threshold, status, evidence?}, where status is tripped_now / monitor / cleared. Replaces prose kill criteria, which are tautologies that can never fire.
- `get_started`: What this server is, what it will do for you right now without an account, and what an account adds. Call this first if you have no API key — it answers in one round trip instead of sending you to a website.
- `validate_unit_economics`: Sanity-check a unit-economics row before publishing it in a business-model slide. Catches the math-drift class of failures (customers × ARPU ≠ revenue), enforces the LTV/CAC ≥ 1.5 floor, the cohort-positivity check, and CAC payback bounds. Returns {ok, errors[{rule, severity, detail}], derived{ratios}}. Skills MUST regenerate the row when ok=false (block-severity errors); warn-severity errors should be surfaced in the final report but do not gate publication. No LLM calls.