Holdify Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Holdify Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP (Model Context Protocol) server for the Holdify API. Enables AI assistants like Claude and Cursor to manage API keys, check usage, and debug authentication issues.
npm install -g @holdify/mcp
# or
npx @holdify/mcpSet the following environment variables:
# Required: Your Holdify project API key
export HOLDIFY_API_KEY=hld_proj_live_xxx
# Optional: Custom API URL (defaults to https://api.holdify.io)
export HOLDIFY_API_URL=https://api.holdify.io
# Optional: Request timeout in ms (defaults to 30000)
export HOLDIFY_TIMEOUT=30000Add to your Claude Desktop configuration (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"holdify": {
"command": "npx",
"args": ["@holdify/mcp"],
"env": {
"HOLDIFY_API_KEY": "hld_proj_live_your-key-here"
}
}
}
}Add to your Cursor MCP settings (.cursor/mcp.json):
{
"mcpServers": {
"holdify": {
"command": "npx",
"args": ["@holdify/mcp"],
"env": {
"HOLDIFY_API_KEY": "hld_proj_live_your-key-here"
}
}
}
}| Resource | URI | Description |
|---|---|---|
| Project Summary | holdify://project | Project overview with plan, limits, and key count |
| API Keys List | holdify://keys | List all API keys for the project |
| Key Details | holdify://keys/{keyId} | Get detailed info about a specific key |
| Usage Stats | holdify://usage | Current usage statistics (30-day period) |
| Audit Log | holdify://audit | Recent audit events (last 50) |
| Tool | Description | Input |
|---|---|---|
create_api_key | Create a new API key | name, environmentId, scopes? |
verify_key | Verify if an API key is valid | key, resource?, units? |
revoke_key | Permanently revoke an API key | keyId |
rotate_key | Rotate an API key (24h grace period) | keyId |
get_usage | Get usage statistics | period? (24h, 7d, 30d, 90d) |
| Prompt | Description | Arguments |
|---|---|---|
setup_api_auth | Help setting up API authentication | framework, language? |
debug_key_issue | Debug API key problems | errorMessage?, keyPrefix? |
"What's my current usage and how many keys do I have?"
The AI will read holdify://project to get plan info, usage stats, and key count.
"Create a new API key called 'Production Server' for environment env_abc123"
The AI will use the create_api_key tool and return the new key (save it immediately!).
"My API key isn't working, I'm getting a 401 error"
The AI will use the debug_key_issue prompt to guide you through troubleshooting.
"Am I close to my rate limit?"
The AI will use get_usage to check your current usage and quota status.
# Install dependencies
pnpm install
# Build the package
pnpm build
# Run locally
HOLDIFY_API_KEY=your-key node dist/index.jsMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.