Fab Card Db Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Fab Card Db Mcp (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server for searching and retrieving information about Flesh and Blood Trading Card Game (FAB TCG) cards. This server is deployed on Cloudflare Workers and provides tools for card search and print variation lookup.
The official FAB card database has moved to cardvault.fabtcg.com and uses a new API host (api.cardvault.fabtcg.com).
docs/cardvault-api-analysis.mdsearch_fab_cards / get_fab_card_prints / get_card_detail / get_fab_products now use CardVault API (api.cardvault.fabtcg.com)This MCP server provides the following tools:
search_fab_cards)Search for Flesh and Blood cards by name. Returns detailed information about matching cards, including:
get_fab_card_prints)Retrieve all print variations of a specific card using its card ID. Returns information such as:
get_fab_products)Retrieve product groups shown on cardvault.fabtcg.com/products, including:
next, previous, nextPage, previousPage)This project is designed to be deployed on Cloudflare Workers.
npm install -g wrangler) git clone <repository-url>
cd fab-card-db-mcp npm install wrangler login wrangler deployThe server will be deployed to the domain configured in wrangler.jsonc (currently fab-card-db-mcp.discord.jp).
The server exposes two main endpoints:
/sse or /sse/message - SSE-based MCP endpoint/mcp - Regular MCP endpointWhen connected to an MCP client, you can use the provided tools as follows:
#### Card Search Example
// Using the search_fab_cards tool
const searchResults = await use_mcp_tool({
server_name: "Flesh and Blood Card Search API",
tool_name: "search_fab_cards",
arguments: {
query: "Awakening"
}
});
// Results will contain card information matching the search query#### Print Variations Example
// Using the get_fab_card_prints tool
const printVariations = await use_mcp_tool({
server_name: "Flesh and Blood Card Search API",
tool_name: "get_fab_card_prints",
arguments: {
cardId: "CARD_ID_HERE" // Replace with an actual card ID from search results
}
});
// Results will contain all print variations for the specified cardTo connect this MCP server to Claude Desktop:
{
"mcpServers": {
"fab-cards": {
"command": "npx",
"args": [
"mcp-remote",
"https://fab-card-db-mcp.discord.jp/sse" // Or your deployed URL
]
}
}
}For other MCP clients, configure them to connect to:
https://fab-card-db-mcp.discord.jp/sse (for SSE-based connections)https://fab-card-db-mcp.discord.jp/mcp (for regular MCP connections)See the LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.