.cursor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .cursor (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Thin Cloudflare Workers MCP server for navigating Bible Aquifer content.
Deploy: Cloudflare dashboard Git integration builds and deploys this repo when you push (see [DEPLOY-SETUP.md](DEPLOY-SETUP.md)). GitHub Actions here only runs tests, not deploy.
Most users should use the deployed endpoint directly. Running locally is primarily for agentic contributors developing this server.
This MCP server was built by AI coding agents with Klappy.
Klappy gave one clear direction: do not build a heavy platform, build a thin navigable layer.
Oddkit provides epistemic posture, prior MCP work provides implementation shape, and Rick Brannan's Aquifer docs and repos provide source truth. The server is a Cloudflare Worker that indexes metadata, retrieves content on demand, and exposes predictable MCP tools for agents and apps.
Capabilities include: explicit catalog browsing via browse, content-addressed SHA-keyed caching where freshness comes from observed repo state instead of TTL assumptions, in-band README access through the readme tool, dynamic resource discovery from the BibleAquifer GitHub org so new resources appear automatically with zero code changes, multilingual coverage where each resource is indexed and served in its own primary language (resolved from the coverage manifest) rather than English-only, server-side resolution of relative content image paths into absolute CORS-open URLs so consuming apps render images without per-resource handling, deterministic Bible verse retrieval via the scripture tool, and named entity profiling via the entity tool.
The Aquifer Window uses this server as its content backend. The Window and agent clients are two interfaces over the same corpus and the same MCP endpoint.
Production URLs:
https://aquifer.klappy.dev/mcphttps://aquifer-window.klappy.devStaging preview (git branch staging): `https://staging-aquifer-mcp.klappy.workers.dev` (/health, /mcp — same as production). Other branches: `https://<branch-slug>-aquifer-mcp.klappy.workers.dev` (slug matches branch name; check Cloudflare if a branch has an odd slug).
Two slices of one pie:
Aquifer MCP provides ten tools:
readme - fetch this README as markdown through MCPtelemetry_policy - fetch telemetry-sharing policy and client integration guidancetelemetry_public - fetch public telemetry snapshot and consumer/tool leaderboardslist - list resources and metadata summarysearch - search by passage, ACAI entity, or title keywordget - fetch full article content by compound keyrelated - follow passage/resource/entity associationsbrowse - paginate through full article catalogs for a resource (defaults to the resource's own language)scripture - fetch Bible verse text by reference (e.g. "Rom 3:23-25") across all translationsentity - profile a named entity by ACAI ID (e.g. "person:David") showing all associated articlesHealth endpoint:
GET /healthMCP endpoint:
POST /mcpThe Aquifer Window does not use a separate backend for content. It uses this exact MCP server as its content interface.
Live Window URL: https://aquifer-window.klappy.dev
Window behavior maps directly to these tool calls:
listsearchgetrelatedbrowsescriptureentityBoth the agent experience and the Aquifer Window experience resolve through the same endpoint and the same retrieval path.
Use the deployed endpoint directly:
https://aquifer.klappy.dev/mcphttps://aquifer.klappy.dev/healthCursor config:
{
"mcpServers": {
"aquifer-mcp": {
"url": "https://aquifer.klappy.dev/mcp"
}
}
}Clone this repo and run local Worker dev if you are changing server code.
npm installnpm run devcurl http://127.0.0.1:8787/healthnpm run build
npm run testnpm run deployBranch strategy and preview URLs (staging → https://staging-aquifer-mcp.klappy.workers.dev) are in docs/branch-and-deployment-strategy.md and DEPLOY-SETUP.md.
Deploy path: push your branch → Cloudflare builds → use the preview or production URL the dashboard shows. No GitHub secrets required for deploy in this repo.
npm run deploy — logged-in Wrangler (deploy:staging is for local Wrangler [env.staging], not the Git preview hostname)GitHub Actions: build + test only (.github/workflows/ci.yml on PRs).
Default (deployed):
{
"mcpServers": {
"aquifer-mcp": {
"url": "https://aquifer.klappy.dev/mcp"
}
}
}Local override for development:
http://127.0.0.1:8787/mcpThese examples target the deployed endpoint, since that is the normal usage path.
curl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":1,
"method":"initialize",
"params":{}
}'curl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":2,
"method":"tools/list",
"params":{}
}'readmecurl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":9,
"method":"tools/call",
"params":{
"name":"readme",
"arguments":{"refresh":false}
}
}'telemetry_policycurl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":10,
"method":"tools/call",
"params":{
"name":"telemetry_policy",
"arguments":{"surface":"mcp-client"}
}
}'telemetry_publiccurl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":11,
"method":"tools/call",
"params":{
"name":"telemetry_public",
"arguments":{"limit":10}
}
}'listcurl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":3,
"method":"tools/call",
"params":{
"name":"list",
"arguments":{"type":"StudyNotes","language":"eng"}
}
}'searchcurl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":4,
"method":"tools/call",
"params":{
"name":"search",
"arguments":{"query":"Romans 3:24"}
}
}'curl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":5,
"method":"tools/call",
"params":{
"name":"search",
"arguments":{"query":"keyterm:Justification"}
}
}'getcurl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":6,
"method":"tools/call",
"params":{
"name":"get",
"arguments":{
"resource_code":"BiblicaStudyNotes",
"language":"eng",
"content_id":"43895"
}
}
}'relatedcurl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":7,
"method":"tools/call",
"params":{
"name":"related",
"arguments":{
"resource_code":"BiblicaStudyNotes",
"language":"eng",
"content_id":"43895"
}
}
}'browsecurl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":8,
"method":"tools/call",
"params":{
"name":"browse",
"arguments":{
"resource_code":"FIAMaps",
"language":"eng",
"page":1,
"page_size":25
}
}
}'browse defaults:
language: engpage: 1page_size: 50page_size max: 100scripturecurl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":12,
"method":"tools/call",
"params":{
"name":"scripture",
"arguments":{"reference":"Rom 3:23-25"}
}
}'curl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":13,
"method":"tools/call",
"params":{
"name":"scripture",
"arguments":{"reference":"John 3:16","resource_code":"BereanStandardBible"}
}
}'entitycurl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":14,
"method":"tools/call",
"params":{
"name":"entity",
"arguments":{"id":"person:David"}
}
}'curl -X POST https://aquifer.klappy.dev/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc":"2.0",
"id":15,
"method":"tools/call",
"params":{
"name":"entity",
"arguments":{"id":"keyterm:Justification"}
}
}'src/index.ts@modelcontextprotocol/sdk and agents/mcpsrc/tools.tsResources are discovered dynamically from the BibleAquifer GitHub organization — no hardcoded list. On each index build the server queries the org API (ETag-cached), fetches eng/metadata.json from every repo, and includes any repo that has valid resource_metadata. New resources Rick adds appear automatically; repos without metadata are silently excluded.
list, search, and entityget, related, browse, and scriptureAQUIFER_CACHEGC_TTL) is 30 days for garbage collection, not freshness truthAquifer MCP aims to maximize operational visibility while preserving user anonymity by default.
Telemetry should measure system behavior, not people:
tools/call usage automatically at the server transport layer (no client opt-in required)10x per tool callFor in-band client guidance, call the telemetry_policy tool from your client integration. For aggregate transparency and gamified usage visibility, call telemetry_public. For a single-page governance reference, see docs/telemetry-governance-snapshot.md.
Supported surface values:
mcp-clientaquifer-windowIf no surface is provided, telemetry_policy returns the base policy.
telemetry_public returns:
10x)Optional env var for weighted verification:
TELEMETRY_VERIFIED_CLIENTS - comma-separated consumer labels treated as verified for the 10x weighted leaderboard (example: Cursor,ClaudeDesktop,AquiferWindow)Recommended self-report headers (honor-system unless verified):
x-aquifer-clientx-aquifer-client-versionx-aquifer-agent-namex-aquifer-agent-versionx-aquifer-surfacex-aquifer-contact-urlx-aquifer-policy-urlx-aquifer-capabilitiesresource_code + language + content_idstart-end BBCCCVVV strings/{language}/metadata.json/{language}/json/*.content.jsonBrowse accepts an optional modality (audio, video, image, text), independent of collection type. Results include structured source identity, original-file and HTML hashes, explicit completeness, and a scan_cursor when further bounded scanning is needed. Counts are provisional until complete. Page numbers select among verified entries; scan_cursor advances source scanning. Omit the cursor to restart failed scans.
Get accepts include_media: true and the same scan cursor while retaining formatted article text. Media URLs are references, not proof of playback, narrator identity or asset licensing. Matching-language collection rights are reported separately when known. No audio/video asset is downloaded by these tools.
For larger source JSON files, get with include_media: true and browse accept optional scan_max_bytes (integer 1–8,000,000; default remains 2,000,000). This bounds each content-scan invocation, not the full multi-call scan or metadata/tree discovery. A delivered chunk may cross the allowance before immediate cancellation; counters include it. For example:
{"resource_code":"FIATranslationGuide","language":"spa","content_id":"spa-luk-p1-v1.1","include_media":true,"scan_max_bytes":3000000}Repeat the same arguments plus returned scan_cursor for each continuation. If a prior scan reports oversized-file, restart without its cursor and explicitly choose a sufficient allowance (up to 8,000,000); increasing the allowance on a cursor does not retry files already classified as failures. Omitting the option on any continuation restores the 2,000,000 default. Files beyond the maximum remain explicit failures. This retrieves original JSON article content and source-bound media references; formatted text can contain the source HTML. It does not add raw Markdown-file retrieval or prove media playback.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.