Syracuse Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Syracuse Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Installation notes
Get a free API key from syracuse.1145.am - all you need to provide is your email address. Here is a curl command to do so:
curl -X POST "https://syracuse.1145.am/api/v1/register-and-get-key/" \
-H "Content-Type: application/json" \
-d "{\"email\":\"[email protected]\"}"You'll get a low usage level until you confirm the key, so make sure to use an email address that you have access to.
There are 3 options:
Pre-req: Install uv
.env.sample to .env and configure your MCP_SERVER_API_TOKEN with the API key you got above{
"mcpServers": {
"Syracuse Company News API": {
"command": "/path/to/uv",
"args": [
"--directory",
"/path/to/repo/syracuse-mcp-server",
"run",
"stdio_mcp_server.py"
]
}
}
}There are no special pre-requisites
Connect to https://syracuse.1145.am/mcp and provide your key as part of the authorization
MCP doc is at https://syracuse.1145.am/.well-known/mcp.json
If, for some reason, you want to run your own local MCP server then that is also possible. Again, it expects uv.
You don't need to update your key in the .env file, but you do need to:
.env.sample to .env - though any further configuration is not neededuv run stateless_streaming_http_mcp_server.pyConnection info for MCP Inspector:
http://127.0.0.1:9000/mcpThe Stateless Streaming MCP Server also serves an mcp.json at .well-known/mcp.json (in this example it would be http://127.0.0.1/.well-known/mcp.json )
By default the ALLOWED_TOOLS restricts the MCP server to the minimum needed to register accounts and get stories:
There's no problem to allow all tools - if you'd like to experiment simply remove ALLOWED_TOOLS from .env
Each tool is tagged with whether it requires authentication, derived from the OpenAPI security rules (an operation's security overrides the spec-level security, and an explicit empty security: [] means no auth). This is exposed two ways:
tools/list, each tool carries _meta: { "requiresAuth": true | false }..well-known/mcp.json, the same _meta flag is present, and the security block is only attached to tools that actually require auth.Clients can use this to call public endpoints without prompting the user for a token, and only request credentials for tools that need them.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.