# su.hpt/hptsu-mcp

> Search hpt.su — Russian/EAEU vehicle compliance documents: type approvals, certificates, VIN lookup.

- name: su.hpt/hptsu-mcp
- version: 0.4.4
- connection class: R2 (oauth_consent_once)
- trust: 93/100
- quality: 82/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/su.hpt%2Fhptsu-mcp
- tools: https://api.protogrid.dev/v1/servers/su.hpt%2Fhptsu-mcp/tools

**An agent can connect after a one-time OAuth consent by a human.** Remote endpoint behind OAuth 2. Tokens stay with the agent; the registry only exposes the authorization metadata.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "hptsu-mcp": {
      "type": "http",
      "url": "https://mcp.hpt.su/mcp",
      "headers": {
        "X-API-Key": "${X_API_KEY}"
      }
    }
  }
}
```

Placeholders to fill: `${X_API_KEY}`.

## Trust

- hygiene: 100
- liveness: 100
- freshness: 85
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-100% ~updated-62d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 82/100 (good)

### protocol: n/a (weight 25)

- n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only)

### authorization: 83 (weight 15)

- pass `auth.prm`: Protected Resource Metadata (RFC 9728) published
- pass `auth.as_metadata`: authorization server metadata reachable
- warn `auth.cimd`: only Dynamic Client Registration, deprecated in 2026-07-28 in favour of CIMD
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: search_documents (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_document (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); search_otts (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 6,267 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool history not recorded yet

### dependencies: 100 (weight 15)

- pass `deps.known_vulns`: no known advisory in 30 resolved packages
- pass `deps.mcp_sdk_version`: mcp 1.30.0, no known advisory
- pass `deps.resolvable`: hptsu-mcp@0.4.4 resolved: 30 packages

- tools: 21, about 6,267 tokens to load them all
- badge: [![protogrid quality](https://protogrid.dev/badge/su.hpt/hptsu-mcp.svg)](https://protogrid.dev/servers/su.hpt/hptsu-mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- pypi hptsu-mcp@0.4.4: resolved, 29 dependencies, MCP SDK mcp 1.30.0

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://mcp.hpt.su/mcp (streamable-http, auth oauth2, reachable true, uptime30d 1)

## Packages

- pypi hptsu-mcp@0.4.4 secrets: HPTSU_API_KEY

## Tools (21)

- `download_document_file`: Get links for a document file: page URL for everyone, direct
    download URL when the plan allows it.

    Always returns `document_page_url` — the document's page on hpt.su
    where the user can download the file manually under their account.
    Share this link with the user.

    When the plan includes direct downloads, the response also contains
    `download_url` — a personal temporary link to the PDF. It can be
    fetched programmatically: send a GET request with the same
    `X-API-Key: <key>` header used for this API. In a browser it works
    when signed in to hpt.su under the account that owns the key. The
    link is bound to the key owner — it does not work with anyone
    else's key or account. The download quota is charged at actual
    download time. Otherwise `download_url` is null and `download_note`
    explains why.
    
- `fulltext_search`: Full-text search inside type-approval document bodies (PDF text).

    Covers ОТТС / ОТШ / ЗОТТС / ЗОТШ. Other document kinds (СБКТС / ЗОЕТС /
    СУТ / cert / decl) are not covered by full-text search.

    **Premium feature** — requires a plan that includes full-text search
    (see https://hpt.su/pricing/) with a subscription covering at least
    one type-approval kind.
    
- `get_document`: Fetch a single Document by slug+kind.
- `list_brands`: Resolve a vehicle brand name to its canonical record (used to filter
    type approvals).
- `list_certification_bodies`: Lookup accredited certification bodies (issuers of сертификатов/деклараций).
- `list_document_files`: List the files attached to a document.

    Returns `[{file_uid, file_name, kind, pages_count, published_at}]` —
    each entry's `file_uid` can be passed to `download_document_file`.

    A document often has several PDFs (e.g. cleaned + original); use this
    tool to enumerate them and pick the right one before download.
    
- `list_registry_kinds`: Return the catalogue of registry kinds exposed by the hpt.su public API.
- `list_test_labs`: Lookup accredited testing laboratories (issuers of СБКТС/ЗОЕТС).
- `list_tnved_codes`: TN VED EAEU classifier lookup.

    Note: TN VED codes are linked **only** to certificates and declarations —
    not to vehicle type approvals or safety reports.
    
- `list_vehicle_models`: Resolve a vehicle model name (within a brand) to canonical record.
- `search_by_vin`: Aggregated search by VIN across all car-kinds (ОТТС/ОТШ/ЗОТТС/ЗОТШ/
    СБКТС/ЗОЕТС). Open for any active API key — no subscription required.

    Returns documents whose VIN field contains the given fragment, newest
    first. For exact full-VIN search within a single registry use the
    per-kind tool (search_otts/search_sbkts/…) with its `vin` parameter.
    
- `search_certificates`: Search conformity certificates (ТР ТС / ТР ЕАЭС).
- `search_declarations`: Search declarations of conformity (ТР ТС / ТР ЕАЭС).
- `search_documents`: Cross-registry search by document number across all hpt.su kinds.
- `search_otch`: Search ОТШ (chassis type approvals).
- `search_otts`: Search ОТТС (vehicle type approvals, ТР ТС 018/2011).
- `search_sbkts`: Search СБКТС (vehicle safety certificate).
- `search_sout`: Search СУТ (vehicle type notification — small dataset, only basic fields).
- `search_zoets`: Search ЗОЕТС (vehicle technical expertise conclusion).
- `search_zotch`: Search ЗОТШ (chassis conformity assessment conclusion).
- `search_zotts`: Search ЗОТТС (vehicle conformity assessment conclusion).