Kordi Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Kordi Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Track, analyze, and act on your streaming & SaaS subscriptions — from any AI agent.
Kordi is a subscription intelligence platform. This Model Context Protocol server lets any MCP-speaking AI client — Claude Desktop, Cursor, Raycast, or your own agent — read a user's tracked subscriptions, score their billing health, surface savings, generate cancel/pause links, and push newly discovered subscriptions in.
It's a hosted, remote MCP server. There's nothing to install or run locally — you connect to a URL with a token.
https://kordiapp.com/mcpAuthorization: Bearer <token>com.kordiapp/kordi-mcp-server on the official MCP RegistrySign in at [kordiapp.com](https://kordiapp.com) and generate an API token at [kordiapp.com/token](https://kordiapp.com/token?ref=github). Tokens are valid for 90 days and grant read/write access to your own subscriptions only.
Claude Desktop — add this to your claude_desktop_config.json (see examples/):
{
"mcpServers": {
"kordi": {
"type": "streamable-http",
"url": "https://kordiapp.com/mcp",
"headers": {
"Authorization": "Bearer YOUR_TOKEN_HERE"
}
}
}
}Any client / raw HTTP — pass the token as a Bearer header (preferred — it never lands in logs, Referer, or history):
# List the available tools
curl -X POST "https://kordiapp.com/mcp" \
-H "Authorization: Bearer YOUR_TOKEN_HERE" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'A legacy ?token=<token> query-string form is also accepted for back-compat, but prefer the header."What am I paying for each month?" "Which subscriptions could I pause to save money?" "Do I have any price hikes or trials ending soon?" "I just signed up for Apple TV+ at $9.99/mo — track it."
| Tool | What it does |
|---|---|
| `kordi_list_subscriptions` | List the user's tracked subscriptions. Paginated (offset/limit), optional include_paused. Sensitive card fields are never returned. |
| `kordi_analyze_billing_health` | Score billing health 0–100: price hikes vs. market, dormant services, savings potential, billing-date clustering. |
| `kordi_get_cancellation_route` | Generate a deep link to cancel or pause a service, and record the intent. Call only on explicit user request. |
| `kordi_ingest_subscription` | Push a discovered subscription into Kordi (used by discovery sources like email/on-screen agents). Dedupes by name; returns a signed pause link. |
| `kordi_get_top_shows` | Most-swiped / most-liked shows across all Kordi users. Aggregate only, no PII. |
Plus a resource:
| Resource | URI | What it is |
|---|---|---|
| `subscription-pulse` | kordi://subscription-pulse | A proactive billing-health snapshot (expiring trials, next bill, monthly spend, savings, price alerts) for ambient feeds. |
A platform-analytics tool (kordi_get_analytics) also exists but is restricted to administrators.<details> <summary><b>kordi_list_subscriptions</b> — read</summary>
Args
include_paused (boolean, default false) — include paused subscriptionsoffset (number, default 0) — pagination startlimit (number, 1–100, default 50) — page sizeReturns
{
"subscriptions": [ { "id": "netflix", "name": "Netflix", "price": 15.99, "billingDate": 12, "state": "ACTIVE" } ],
"count": 1,
"total_count": 1,
"offset": 0,
"limit": 50,
"has_more": false,
"total_monthly": 15.99
}</details>
<details> <summary><b>kordi_analyze_billing_health</b> — read</summary>
Takes no arguments. Returns total monthly spend, active/paused counts, price_hikes, unused_services, savings_potential, top_savings_candidate, billing_clusters, and a health_score (0–100, higher is healthier). </details>
<details> <summary><b>kordi_get_cancellation_route</b> — action</summary>
Args
service_id (string, required) — the exact id from kordi_list_subscriptionsreason (too_expensive | not_using | switching_service | finished_content, optional)Returns { "success": true, "service": "Netflix", "cancellation_url": "https://…" }. Call only when the user explicitly asks to cancel or pause. </details>
<details> <summary><b>kordi_ingest_subscription</b> — write</summary>
Args
name (string, required) — e.g. "Disney+"amount (number, required) — monthly amount in USDbill_date (number 1–31, or ISO date string) — billing day or datesource (qira | screenpipe | manual, optional) — discovery-source attributionDedupes by name (re-calling updates amount/bill date). Returns { status, subscription, pause_link, dashboard_url }. </details>
<details> <summary><b>kordi_get_top_shows</b> — read</summary>
Args
limit (number, 1–50, default 10)sort_by (swipes | likes | like_rate, default swipes)Returns a cross-user popularity leaderboard. Aggregate only — no per-user data. </details>
offset/limit for big accounts.Discovery sources (email-intelligence agents, on-screen detection pipes, etc.) can push subscriptions into a user's Kordi account via kordi_ingest_subscription, or provision brand-new users via the public POST /api/guest-ingest endpoint. See kordiapp.com/developers for the partner provisioning flow, source attribution, and the x-partner-key model.
com.kordiapp/kordi-mcp-serverDocumentation and the registry manifest in this repository are released under the MIT License. The Kordi server, brand, and backend are proprietary; this repo does not contain server source code.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.