examples — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited examples (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Official public setup docs, registry metadata, and local connector package for the hosted 6DuckLearn MCP server.
Use 6ducklearn as the local client key in Codex or Claude Code. The official MCP Registry name is com.6ducklearn/mcp, and the hosted endpoint is:
https://6ducklearn.com/mcpThis repository is intentionally hosted-first. It does not contain the private 6DuckLearn SaaS backend, Supabase edge functions, service-role database access, billing logic, user memory store, or production deployment scripts.
From GitHub:
npx github:kit18/6ducklearn-mcp setup-codexThis configures the hosted 6DuckLearn MCP server in local Codex, adds the hosted OAuth compatibility header, and starts the OAuth login flow. If a 6ducklearn entry already exists, the setup command refreshes it first so old local or stdio bridge settings do not linger.
Manual fallback:
codex mcp remove 6ducklearn # ignore if missing
codex mcp add 6ducklearn --url https://6ducklearn.com/mcp
codex mcp login 6ducklearn --scopes mcp:read,mcp:write,runtime:connect,control:read,control:write,policy:read,approval:request,approval:decideIf you configure Codex manually and OAuth discovery is challenged by the hosting edge, add this block to ~/.codex/config.toml before login:
[mcp_servers.6ducklearn.http_headers]
User-Agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125 Safari/537.36"claude mcp add --transport http 6ducklearn https://6ducklearn.com/mcpThen open the MCP tool picker in Claude Code and authorize 6DuckLearn when prompted.
The npm packages @6ducklearn/mcp and @6ducklearn/connector are not published yet. Until npm publication is available, use the GitHub npx command above for copy/paste setup.
6ducklearncom.6ducklearn/mcp6DuckLearn MCPhttps://6ducklearn.com/mcphttps://6ducklearn.com/.well-known/oauth-authorization-serverhttps://6ducklearn.com/.well-known/oauth-protected-resource/mcpThe setup helper asks Codex for the full supported MCP OAuth bundle up front so the consent page can offer lower permission levels. Users can approve a smaller set during OAuth, and 6DuckLearn role/payment-tier caps can block unavailable scopes. Write-capable and sensitive actions remain controlled by 6DuckLearn runtime policy and user approval.
6DuckLearn MCP gives connected agents account-authorized workflows for research, organization, reminders, portfolio review, knowledge retrieval, canvas creation, and Skill Builder discovery.
For the full public catalog, see MCP tool use cases. The catalog describes each tool by practical use case and example prompt without exposing private schemas or backend implementation details.
Finance-related capabilities are for research, organization, summaries, alerts, and user-authorized workflows. 6DuckLearn MCP is not an order-routing service or source of investment recommendations.
The connector is for users who want a local runtime bridge between 6DuckLearn and local agents such as Codex, OpenClaw, or Hermes. The preferred setup path is OAuth from the 6DuckLearn web app.
npm install
npm run build
SIXDUCK_PUBLIC_BASE_URL=https://6ducklearn.com node packages/connector/dist/index.js loginAfter login, keep the connector process running when using a local runtime:
SIXDUCK_RUNTIME_TYPE=codex \
SIXDUCK_CODEX_CWD=/absolute/path/to/your/workspace \
SIXDUCK_CODEX_QUIET_PROFILE=true \
node packages/connector/dist/index.jsMost users should start from the hosted 6DuckLearn setup page rather than cloning this repository directly.
The official registry manifest lives in server.json. It is a hosted-only listing because the canonical 6DuckLearn MCP server runs at https://6ducklearn.com/mcp; the local connector is a runtime bridge, not a standalone stdio MCP server package.
Before publishing, validate the manifest and hosted endpoint:
npm run validate:registry
npm run smoke:hostedPublish with domain-based authentication so the registry name can stay under the 6DuckLearn domain namespace:
# After generating the proof key and serving /.well-known/mcp-registry-auth:
mcp-publisher login http --domain 6ducklearn.com --algorithm ecdsap384 --private-key "$PRIVATE_KEY"
mcp-publisher publish
curl "https://registry.modelcontextprotocol.io/v0.1/servers?search=com.6ducklearn/mcp"The required HTTP proof must be served from https://6ducklearn.com/.well-known/mcp-registry-auth. After the official MCP Registry lists com.6ducklearn/mcp, request GitHub MCP Registry inclusion by emailing [email protected] with the registry name, official registry URL, GitHub repository, website, hosted endpoint, and validation evidence. GitHub's MCP Registry is a separate curated surface, so listing there currently requires GitHub review rather than relying on automatic community registry sync.
npm install
npm run validateValidation runs TypeScript build, connector tests, package dry-run, MCP Registry manifest checks, hosted MCP smoke checks, and a public-release secret scan.
Report security issues privately. See SECURITY.md.
Code is licensed under Apache-2.0. Documentation examples are licensed under CC BY 4.0. See TRADEMARK.md for 6DuckLearn brand usage.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.