Fab Card Db Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Fab Card Db Mcp (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Breaking Change (MCP 2026-07-28): This server has migrated to the MCP 2026-07-28 protocol revision. Legacy SSE endpoints (/sse,/sse/message) have been removed and will return404. Existing clients must change their connection URL from `/sse` to `/mcp`. Theinitializehandshake and session management have been removed from the protocol; the server is now fully stateless. Clients using older MCP protocol versions will not be able to connect.
A Model Context Protocol (MCP 2026-07-28) server for searching and retrieving information about Flesh and Blood Trading Card Game (FAB TCG) cards. This server is deployed on Cloudflare Workers as a stateless Streamable HTTP service and provides tools for card search, print variation lookup, card detail retrieval, and product catalog browsing.
The official FAB card database has moved to cardvault.fabtcg.com and uses a new API host (api.cardvault.fabtcg.com).
docs/cardvault-api-analysis.mdsearch_fab_cards / get_fab_card_prints / get_card_detail / get_fab_products now use CardVault API (api.cardvault.fabtcg.com)This MCP server provides the following tools. All tools return structured output via structuredContent (in addition to the content text fallback), conforming to their declared outputSchema.
search_fab_cards)Search for Flesh and Blood cards by name. Returns a structured array of matching cards, including:
get_fab_card_prints)Retrieve all print variations of a specific card using its card ID. Returns a structured array of prints, including:
get_card_detail)Get detailed information about a specific card, including non-English text. Returns a structured object containing:
get_fab_products)Retrieve product groups from cardvault.fabtcg.com/products. Returns a structured object containing:
next, previous, nextPage, previousPage)This project is designed to be deployed on Cloudflare Workers.
npm install -g wrangler) git clone <repository-url>
cd fab-card-db-mcp yarn install wrangler login wrangler deployThe server will be deployed to the domain configured in wrangler.jsonc (currently fab-card-db-mcp.discord.jp).
The server exposes the following endpoints:
POST /mcp - Streamable HTTP MCP endpoint (MCP 2026-07-28)GET /.well-known/mcp.json - MCP server discovery manifestThis server intentionally allows all origins (Access-Control-Allow-Origin: *) and performs no Origin validation. This is by design: the server is authless and exposes only public card data, so cross-origin requests carry no credential or data-confidentiality risk.
When connected to an MCP client, you can use the provided tools as follows:
#### Card Search Example
// Using the search_fab_cards tool
const searchResults = await use_mcp_tool({
server_name: "Flesh and Blood Card Search API",
tool_name: "search_fab_cards",
arguments: {
query: "Awakening"
}
});
// Results will contain card information matching the search query#### Print Variations Example
// Using the get_fab_card_prints tool
const printVariations = await use_mcp_tool({
server_name: "Flesh and Blood Card Search API",
tool_name: "get_fab_card_prints",
arguments: {
cardId: "CARD_ID_HERE" // Replace with an actual card ID from search results
}
});
// Results will contain all print variations for the specified cardThis server uses the MCP 2026-07-28 Streamable HTTP transport. Clients that support this protocol revision can connect to:
https://fab-card-db-mcp.discord.jp/mcphttps://fab-card-db-mcp.discord.jp/.well-known/mcp.jsonMCP 2026-07-28 compliant clients can discover the server automatically via the .well-known/mcp.json manifest, which advertises the /mcp endpoint.
Migration required: Legacy SSE-based connections (/sse) are no longer supported and will return404. If you were previously connecting tohttps://fab-card-db-mcp.discord.jp/sse, change your connection URL tohttps://fab-card-db-mcp.discord.jp/mcp. Your client must also support the MCP 2026-07-28 Streamable HTTP transport.
See the LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.