Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A remote MCP server for Footics, a World Cup 2026 prediction game. A user connects their AI assistant (Claude, ChatGPT, Cursor…) to https://mcp.footics.app/mcp, signs in with their Footics account, and the assistant can read their matches, standings and predictions — and, optionally, submit them. Inference runs on the user's side; Footics only pays for hosting.
Written in Go (cmd/mcp) with the official modelcontextprotocol/go-sdk. The server is a thin authenticated client of the Footics REST API (/v1): it holds no database connection and no service-role key — every read and write is forwarded to the API with the calling user's token, so the API stays the single source of truth and the single write point.
AI assistant (Claude / ChatGPT) ──MCP/HTTP──► cmd/mcp (/mcp)
│ internal/auth verify user JWT (JWKS or HS256)
│ internal/tools → internal/apiclient (calls /v1 with the user token)
▼
Footics API (api.footics.app) ──► Postgresprod, HS256 for local dev), same JWKS cache + refresh cooldown as the API.
/v1 APIwith the user's bearer token (no privileged credentials here).
whoami · list_matches · get_match · get_my_standing · get_my_predictions · get_leaderboard · list_my_groups · get_joker_status · search · submit_prediction (gated by `MCP_ENABLE_WRITES`)
| Variable | Default | Effect |
|---|---|---|
FOOTICS_API_URL | — | base URL of the Footics REST API |
AUTH_JWKS_URL | — | JWKS URL(s) for asymmetric token verification (prod) |
AUTH_JWT_SECRET | — | HS256 secret (local dev alternative to JWKS) |
MCP_ENABLED | true | false → /mcp returns 503 without verifying tokens (kill switch) |
MCP_REQUIRE_AUTH | true | require a valid bearer token (401 otherwise) |
MCP_ENABLE_WRITES | false | allow submit_prediction |
MCP_RATE_LIMIT_PER_MIN | 30 | tool calls per minute per user (0 = off) |
See .env.example for the full list.
cp .env.example .env # point AUTH at a local/staging GoTrue, not production
go run ./cmd/mcp # serves on $HTTP_ADDR (default :8080), /mcpWithout an Authorization: Bearer <token> header the endpoint returns 401 (unless MCP_REQUIRE_AUTH=false). Build a static binary with go build ./cmd/mcp; the container image is the multi-stage Dockerfile (distroless).
Runs on the Footics VPS as a Dokploy service (footics-mcp), build-from-git via deploy/compose.dokploy.yml → published at mcp.footics.app. Runbook lives in the private infra repo.
Auth is required and writes are off by default. See SECURITY.md for the model and how to report a vulnerability.
MIT © 2026 Tom Cardoen
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.