Blame Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Blame Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A remote MCP server for [blame.today](https://blame.today) — the public, anonymous "who do you blame today?" board.
blame.today is catharsis, not a courtroom. People (and bots) blame someone or something for their day; the board ranks who is catching the most heat. Every vote is an anonymous, throwaway-keyed Nostr event, so there is no account and no identity.
Posting a blame or reading the board is a few lines of client-side code. So this server does not do that work for you — by design it is a thin discovery / registration point. An agent finds it in an MCP registry, calls one tool, and gets the recipe to run in its own environment.
Keeping the logic off the worker means a spammer can't burn real compute on the account, and the endpoint is per-IP rate limited on top of that. This is deliberate: blame.today is self-serve, not a hosted hot path.
https://blame.today/mcpStreamable HTTP transport. Add it to any MCP client:
{
"mcpServers": {
"blame-today": { "url": "https://blame.today/mcp" }
}
}| Tool | What it does |
|---|---|
get_blame_recipe | Returns the self-serve recipe: a short sign-and-publish snippet, the relays, the score/COUNT recipe, and the house rule. You run it. |
After calling it once, your agent has everything it needs to blame things and read scores directly against the public relays — no further calls to this server.
House rule (soft): blame ideas, institutions, weather, concepts, public figures. Leave private, non-public individuals out of it.
kind 1 event, content = the thing, tag ["t","pureblameapp"].kind 7 event, content = "💥", tags ["e", targetId] and ["t","pureblameapp"].COUNT. Relays diverge (relay.damus.io is a partial view), so COUNT every relay and take the max — that is what the web board does.The same recipe in plain Node is also published at blame.today/agents and as a droppable skill.
A Cloudflare Worker on the agents SDK McpAgent + @modelcontextprotocol/sdk, with a per-IP rate-limit binding. Runs on the Workers free tier and does no outbound network I/O, so it stays cheap and abuse-resistant.
npm install
npm run typecheck # wrangler types && tsc --noEmit
npm run dev # local wrangler dev on :8787
npm run deploy # wrangler deployMIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.