Mcp Vincario — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Vincario (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP (Model Context Protocol) server that exposes the Vincario API to AI agents and LLM clients. Enables AI assistants to decode VINs, check stolen vehicle databases, and retrieve market valuations through natural language.
| Tool | Description |
|---|---|
vin_decode | Decode a VIN and return detailed vehicle information |
vin_decode_info | List available fields for a given VIN (free endpoint) |
stolen_check | Check if a VIN appears in stolen vehicle databases |
vehicle_market_value | Get market valuation for a vehicle (supports odometer input) |
X-API-Key HTTP headerdocker build -t vincario-mcp .
docker run -p 8080:8080 vincario-mcpThe server starts on http://localhost:8080.
pip install uv
uv sync
uv run main.pyPass your Vincario API key as an HTTP header with each request:
X-API-Key: your_api_key_hereAdd to your MCP config (.mcp.json or claude_desktop_config.json):
{
"mcpServers": {
"vincario": {
"type": "http",
"url": "http://localhost:8080",
"headers": {
"X-API-Key": "your_api_key_here"
}
}
}
}If connecting to the hosted server at https://mcp.vincario.com/mcp, replace the URL accordingly.
Once connected, you can ask your AI assistant:
The server uses streamable HTTP transport (stateless_http=True), which means no persistent session is required. Each request is independent, making it straightforward to deploy behind a reverse proxy or load balancer.
For HTTPS deployment, place a reverse proxy (nginx, Caddy, Cloudflare) in front of the server — the application itself runs on plain HTTP port 8080.
See Vincario API Terms of Service for usage terms.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.