Qcdatabase Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Qcdatabase Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A small program that lets an AI assistant (like Claude) do your everyday QC Database work for you — set the project you're working on, upload records, read what the AI pulled off a document, and find and close out the items still needed for a complete, traceable turnover package.
It runs on your own computer. Your AI assistant talks to it; it talks to QCDatabase.AI on your behalf, using your own login.
Built on the official Model Context Protocol Python library and the public QC Database MCP specification.
Once it's connected, you can talk to it in plain language. For example:
recorded under your name — that's your call, not the AI's).
You need Python 3.10 or newer on your computer.
python.org/downloads. During the python.org install, tick "Add Python to PATH."
brew install python or get it fromTo check it's installed, open a terminal (PowerShell on Windows, Terminal on Mac) and run:
python --versionYou should see Python 3.10 or higher. (On some Macs the command is python3.)
From a terminal, in this folder:
pip install .That's it. This installs the server and a command called qcdatabase-mcp.
Ifpipisn't found, trypython -m pip install .(orpython3 -m pip install .).
Claude Desktop launches this server for you and shows its tools in your chats. Set it up once:
If you don't have it, download it from claude.ai/download and sign in.
In Claude Desktop:
(Windows: menu ☰ → File → Settings; Mac: Claude → Settings).
This opens (and, if needed, creates) a file named claude_desktop_config.json. You can also open it directly:
%APPDATA%\Claude\claude_desktop_config.json~/Library/Application Support/Claude/claude_desktop_config.jsonPut this in the file. If the file already has other servers, just add the "qcdatabase" block inside the existing "mcpServers" section.
Windows:
{
"mcpServers": {
"qcdatabase": {
"command": "python",
"args": ["-m", "qcdatabase_mcp"]
}
}
}Mac (Python is usually python3 there):
{
"mcpServers": {
"qcdatabase": {
"command": "python3",
"args": ["-m", "qcdatabase_mcp"]
}
}
}Save the file.
If Claude can't start it (you see "python not found" or the server fails), use the full path to Python instead of just"python". Find it by runningwhere python(Windows) orwhich python3(Mac) in a terminal, then paste that path as the"command". For example on Windows:
>
``json { "mcpServers": { "qcdatabase": { "command": "C:\\Users\\you\\AppData\\Local\\Programs\\Python\\Python312\\python.exe", "args": ["-m", "qcdatabase_mcp"] } } } ``>
(Use double backslashes \\ in Windows paths inside JSON.)Fully quit and reopen the app (on Windows, also close it from the system tray; on Mac, Quit with Cmd-Q — closing the window isn't enough). The new server only loads on a fresh start.
Start a new chat and look for the tools/connector indicator (a slider or tool icon near the message box). Click it and you should see qcdatabase with its tools listed. If you don't, see Troubleshooting.
Then ask Claude to "connect to QC Database" to sign in — see below.
logintool). Your web browser opens; log in and pick which company workspace you want to connect. That choice locks the connection to that one organization. You only do this once — it's remembered.
projects first. Almost every action happens "inside" a project, so the server asks you to choose one before it will do project work. You can switch projects any time.
turnover, create and close reference requests, add notes and photos, and so on.
login, logout, auth_statuslist_tenants, list_projects, set_project,get_active_project, list_project_members, list_lists, list_list_items, list_map_item_schemas, list_document_folders
upload_document, upload_drawing,upload_large_format_drawing, attach_photo
list_fillable_templates, get_fillable_template,download_fillable_template, submit_fillable_template
get_document, set_document_extracted_data,list_documents, list_map_items, create_map_item
list_form_submissions, create_form_submission,complete_form_submission, create_note, list_notes, resolve_note
mark_map_item_complete, mark_map_item_accepted,list_itp_line_items, mark_itp_complete, mark_itp_accepted
list_reference_requests,create_reference_request, list_references, create_reference, turnover_report
Marking work complete or accepted is a buy-off — the system records it under your name and the current time. The assistant can do these for you, but every one of those tools tells you plainly that you are responsible for the action. The server never signs anything off silently. Treat those as your decisions, made with your go-ahead.
https://qcdatabase.ai.session is pinned to one project — so the assistant can't reach into a different workspace or project by accident.
actions are out of scope by design.
Your login is stored on your own computer in a per-user folder:
%LOCALAPPDATA%\qcdatabase-mcp\store.json~/Library/Application Support/qcdatabase-mcp/store.json~/.config/qcdatabase-mcp/store.jsonRun the logout tool (or delete that file) to forget the login.
and reopened it.
server from loading. Paste it into a JSON checker if unsure.
"command" to the full path to Python (seethe install note above).
%APPDATA%\Claude\logs\, Mac ~/Library/Logs/Claude/.
the sign-in in your browser.
open it manually to finish, then sign in again.
local web address on port 8765. If another program is using it, set a different free port before launching the app by adding an environment variable QCDB_CALLBACK_PORT (for example 8766), then sign in again.
(Windows), or use python3 in the config.
pip install -e . # editable install
python -m qcdatabase_mcp # run the stdio server directlyLayout:
src/qcdatabase_mcp/
__main__.py # entry point (stdio server)
server.py # FastMCP server + all tools
client.py # HTTP client: bearer auth, auto-refresh, errors, pagination
auth.py # OAuth2 (PKCE + dynamic client registration) login & refresh
config.py # local token / project storageEnvironment variables:
QCDB_CALLBACK_PORT — local OAuth callback port (default 8765).QCDB_CONFIG_DIR — override where tokens/settings are stored.Licensed under the MIT License (see LICENSE).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.