Is Urdb Mcp safe to install?

SaferSkills independently audited Urdb Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md4.9 KB · Markdown

urdb-mcp

MCP server for URDB. Gives your AI assistant 76 electronics, hardware and firmware calculators — plus the product integrity database tracking downgrades, shrinkflation, warranty cuts and enshittification.

Ask "what UBRR do I need for 9600 baud on a 16 MHz AVR?" and get 103 with the error percentage and the worked derivation, instead of a plausible-sounding guess.

Setup

1. Get an API key at urdb.io/settings/api-keys (free tier available)

2. Add to your MCP host

Claude Desktop config lives at ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows).

{
  "mcpServers": {
    "urdb": {
      "command": "npx",
      "args": ["urdb-mcp"],
      "env": {
        "URDB_API_KEY": "urdb_live_your_key_here"
      }
    }
  }
}

3. Restart your host

Calculators are metered separately from product data — 1,000 calculator calls a day on the free tier, so an agent working through a design won't exhaust your quota on arithmetic.

Example prompts

"Size the current-limiting resistor for a blue LED on 5 V"
"Give me every valid CAN bit timing for 500 kbit/s on a 40 MHz clock"
"What trace width do I need for 3 A with a 20 °C rise on an external layer?"
"Decode this struct's padding for a 32-bit target"
"Is 1000 km realistic on LoRa SF12?"
"Which laptops have the highest integrity scores?"
"Has the KitchenAid Stand Mixer gotten worse over the years?"

Tools

Call tools/list to see the current set — the calculator catalogue is fetched from the server at runtime, so it grows without a package update.

Calculators

76 tools across seven categories, named calc_<name>:

Category	Covers
Components (11)	Resistor and capacitor colour/SMD codes, E-series snapping, LED resistors, RC time constants, series/parallel networks
Circuits (16)	555 timers, op-amps, filters, buck/boost converters, MOSFET gate drive, Ohm's law, zener and LM317 regulators, Schmitt triggers
Power & Wiring (13)	PCB trace width and impedance, wire gauge, voltage drop, fuse sizing, heat sinks, battery packs, solar sizing, via current
Firmware (22)	UART baud rates, CAN bit timing, PLL dividers, timer prescalers, CRC, IEEE 754, struct padding, bitfields, watchdogs, Intel HEX
RF & Signals (7)	Antenna lengths, LoRa airtime, path loss, VSWR, Nyquist, FFT bins, wavelength
Mechanical (4)	Stepper motors, E-steps, gear ratios, tap drill sizes
Reference (3)	Pinouts, logic levels, MCU comparison

Each returns the answer, machine-readable values, the worked derivation and a link to the same tool on the web at https://urdb.io/tools/<name>.

Product data

Tool	Description
`urdb_search`	Search products by name or keyword, with integrity scores
`urdb_get_product`	Full integrity breakdown across 7 dimensions
`urdb_get_changes`	Documented enshittification events for a product
`urdb_list_products`	List/filter products by category, brand, score

How it works

This package is a thin stdio→HTTPS proxy for https://urdb.io/api/v1. It contains no calculation logic: the catalogue and every tool's JSON Schema are fetched from /api/v1/tools when the server starts.

That means a calculator added to URDB shows up here on your next restart, and a fix reaches you via a deploy rather than npm update. If the API is unreachable the server still starts and serves the product tools, and retries the catalogue on the next tools/list.

Calculators follow published standards where one exists — IPC-2221 and IPC-2141 for trace geometry, IEC 60063 for E-series, IEC 60127 for fuses, ISO 11898-1 for CAN, IEEE 754 for floats. Where a result is an extrapolation rather than a measurement, the tool says so.

REST API

Everything here is available over plain HTTP:

curl -H "Authorization: Bearer $URDB_API_KEY" https://urdb.io/api/v1/tools

curl -X POST https://urdb.io/api/v1/tools/uart-baud-rate \
  -H "Authorization: Bearer $URDB_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"clockHz": 16000000, "baud": 9600, "family": "avr-normal"}'

Full docs: urdb.io/api

Configuration

Variable	Required	Description
`URDB_API_KEY`	yes	Your key from urdb.io/settings/api-keys
`URDB_API_URL`	no	API base URL. Defaults to `https://urdb.io/api/v1`.

Development

npm run typecheck
npm run build     # bundle to dist/index.js
npm test          # stdio end-to-end against a mock API

License

MIT

Urdb Mcp— agent skill

Is Urdb Mcp safe to install?

urdb-mcp

Setup

Example prompts

Tools

Calculators

Product data

How it works

REST API

Configuration

Development

License

Audit the pieces. Scan the whole. Decide.