Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP (Model Context Protocol) server for Contraption Company essay, built on Chroma Cloud.
Contraption Company MCP is available as a hosted MCP server with no authentication.
| Field | Value |
|---|---|
| Server URL | https://mcp.contraption.co |
<details> <summary><b>Cursor</b></summary>
Use the deep link to install directly in Cursor: Install Contraption Company MCP.
Or, create or edit ~/.cursor/mcp.json:
{
"mcpServers": {
"contraption-company": {
"url": "https://mcp.contraption.co"
}
}
}</details>
<details> <summary><b>ChatGPT</b></summary>
https://mcp.contraption.co.</details>
<details> <summary><b>VS Code (Copilot Chat MCP)</b></summary>
Create or edit .vscode/mcp.json:
{
"servers": {
"contraption-company": {
"type": "http",
"url": "https://mcp.contraption.co"
}
}
}</details>
<details> <summary><b>Codex</b></summary>
Add to ~/.codex/config.toml:
[mcp_servers.contraption-company]
command = "npx"
args = ["mcp-remote", "--transport", "http", "https://mcp.contraption.co"]</details>
<details> <summary><b>Claude Code</b></summary>
Run in your terminal:
claude mcp add --transport http contraption-company https://mcp.contraption.co</details>
<details> <summary><b>OpenAI SDK (Python)</b></summary>
from openai import OpenAI
client = OpenAI()
response = client.responses.create(
model="gpt-5",
input="List the newest Contraption Company blog posts.",
tools=[
{
"type": "mcp",
"server_label": "contraption-company",
"server_url": "https://mcp.contraption.co",
"require_approval": "never",
}
],
)
print(response)</details>
git clone <repository>
cd mcp
uv sync --all-extrascp .env.example .env
# Edit .env with your credentials./run.sh
# Or: uv run python -m src.main# Build
docker build -t contraption-mcp .
# Run
docker run -p 8000:8000 --env-file .env contraption-mcp
# Or use docker-compose
docker-compose upRunning locally requires credentials for external services:
CHROMA_QUERY_COLLECTION to override the default queries collectionPOLL_INTERVAL_SECONDS to override the default 5 minute sync cadence[email protected]fetch(id): Fetch a single post or page using the canonical URL as the identifier. Provide the id returned by list_posts/search (which is the canonical URL); slugs and shorthand schemes are also accepted but responses always resolve to full URLs.list_posts(sort_by, page, limit): List posts with pagination, returning canonical URLs as identifierssearch(query, limit): Search posts and pages by query text; returns canonical URLs for result IDsGET /: Server info (redirects to GitHub repo for non-MCP requests)GET /health: Health checkGET /debug/search: Debug search endpoint (see /debug/docs for Swagger UI)/mcp/*: MCP protocol endpointsThe server polls the Ghost Admin API every 5 minutes to detect new, updated, or deleted posts and pages. Adjust the cadence by setting the POLL_INTERVAL_SECONDS environment variable.
# Install dev dependencies
make dev
# Run tests
make test
# Lint and format
make format lint
# Run all checks
make checkMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.