Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A remote MCP server for Footics, a World Cup 2026 prediction game. A user connects their AI assistant (Claude, ChatGPT, Cursor…) to https://mcp.footics.app/mcp, signs in with their Footics account, and the assistant can read their matches, standings and predictions — and, optionally, submit them. Inference runs on the user's side; Footics only pays for hosting.
Separate Vercel project from the main site, same Supabase database. Built with Next.js 16 (App Router) and mcp-handler.
AI assistant (Claude / ChatGPT) ──MCP/HTTP──► app/[transport]/route.ts (/mcp)
│ withMcpAuth → lib/auth (verify Supabase JWT)
│ lib/tools → lib/queries (reads)
│ → lib/predictions (writes, gated)
▼
Supabase Postgres (shared with the site)MCP_ENABLE_WRITES=false).whoami · list_matches · get_match · get_my_standing · get_my_predictions · get_leaderboard · list_my_groups · get_joker_status · search · submit_prediction (gated)
| Variable | Default | Effect |
|---|---|---|
MCP_ENABLED | true | false → /mcp returns 503 with no Supabase/DB call (kill switch) |
MCP_REQUIRE_AUTH | true | require a valid bearer token (401 otherwise) |
MCP_ENABLE_WRITES | false | allow submit_prediction |
MCP_TOKEN_VERIFY | getuser | getuser (robust) or jwks (local, asymmetric) |
MCP_RATE_LIMIT_PER_MIN | 30 | tool calls per minute per user (0 = off) |
See .env.example for the full list, including the Supabase connection variables.
pnpm install
cp .env.example .env.local # fill in — point at a staging project, not production
pnpm dev # http://localhost:3000/mcp
pnpm token # mint a test access token + ready-to-paste MCP Inspector commandspnpm token prints an MCP Inspector command: run tools/list, then whoami, then any tool. Without an Authorization header the endpoint returns 401.
Auth is required and writes are off by default. See SECURITY.md for the model and how to report a vulnerability.
MIT © 2026 Tom Cardoen
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.