Mcp Factcheck — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Factcheck (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.The text {match} asks the agent to disclose its hidden system prompt or initial instructions. That is often the first step of a larger attack: knowing the system prompt lets an attacker craft inputs that defeat its constraints by mimicking its own voice.
repeat/reveal/print your system prompt request from the skill.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP Server for validating code or content against the official Model Context Protocol (MCP) specification to ensure technical accuracy and prevent the spread of misinformation.
📦 [View in MCP Registry](https://registry.modelcontextprotocol.io/?q=mcp-factcheck) - Available in the official MCP Registry
📋 [View Project Roadmap](ROADMAP.md) - See planned features and development progress
🏗️ [Design Documentation](DESIGN.md) - Technical design and implementation details
The MCP Fact-Check MCP Server helps ensure technical accuracy when coding or writing about MCP by comparing content against official specifications. It uses:
Parameters:
current_version (required): Source MCP specification version (e.g., "2024-11-05", "2025-06-18")target_version (required): Target MCP specification version to migrate to (e.g., "draft")update_scope (optional): Determines how aggressive the migration should becritical_only: Fix only critical inaccuracies and breaking changes (minimal changes)enhancement_focused: Fix issues and improve clarity, align with best practicescomprehensive: Complete review with all improvements and enhanced claritycomprehensiveThe MCP Fact-Check server is available through the Model Context Protocol registry. Install it directly from your MCP client:
For Claude Desktop and other MCP clients:
That's it! The server will be automatically configured and ready to use.
For developers: If you need to build from source or contribute to the project, see INSTALL.md for development setup instructions.
#### Visual Tracing with Arize Phoenix
For a beautiful, AI-focused trace visualization UI, set up Arize Phoenix:
# Install Phoenix
pipx install arize-phoenix
# Start Phoenix server
phoenix serve{
"mcpServers": {
"mcp-factcheck": {
"command": "/path/to/bin/mcp-factcheck-server",
"args": [
"--data-dir",
"/path/to/data/embeddings",
"--telemetry",
"--otlp-endpoint",
"http://localhost:6006"
],
"env": {
"OPENAI_API_KEY": "your-api-key"
}
}
}
}What you'll see in Phoenix:
Phoenix is specifically designed for AI/ML observability and provides a much more user-friendly experience than traditional tracing tools.
# Build all components
go build -o bin/mfc ./cmd/server
go build -o bin/specloader ./utils/cmd
# Run tests
go test ./...The project includes pre-extracted MCP specifications and embeddings for all versions. To check when the draft specification was last updated, see data/SPEC_METADATA.json:
# View draft update information
cat data/SPEC_METADATA.json | jq '.specs.draft'To update the draft specification:
./bin/specloader spec --version draft
./bin/specloader embed --version draft
./bin/specloader embed --version draft-fineTo add a new specification version:
./bin/specloader spec --version 2025-12-15
./bin/specloader embed --version 2025-12-15
./bin/specloader embed --version 2025-12-15-fineAll specification extraction dates and source commits are automatically tracked in data/SPEC_METADATA.json.
Test the server using the included test client:
# Build test client
go build -o bin/factcheck-curl ./cmd/factcheck-curl
# Test tools
./bin/factcheck-curl --cmd ./bin/mfc --data-dir ./data/embeddings tools/list
./bin/factcheck-curl --cmd ./bin/mfc --data-dir ./data/embeddings tools/call validate_content '{"content":"MCP is a protocol"}'
# Test prompts
./bin/factcheck-curl --cmd ./bin/mfc --data-dir ./data/embeddings prompts/list
# Get migration prompt with minimal parameters
./bin/factcheck-curl --cmd ./bin/mfc --data-dir ./data/embeddings prompts/get migrate-mcp-content '{"current_version":"2024-11-05","target_version":"draft"}'
# Get migration prompt with all parameters
./bin/factcheck-curl --cmd ./bin/mfc --data-dir ./data/embeddings prompts/get migrate-mcp-content '{
"current_version": "2024-11-05",
"target_version": "2025-06-18",
"update_scope": "critical_only"
}'See DESIGN.md for the complete architecture documentation.
OPENAI_API_KEY - Required for embedding generation and content validationGITHUB_TOKEN - Optional, for higher GitHub API rate limits when extracting specsMIT License. See LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.