Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server, built with FastAPI, that wraps the Worcadian JSON-RPC game server API (https://worcadian.vercel.app/rpc, spec) as a set of MCP tools. Designed to be deployed as a Python serverless function on Vercel.
The service speaks MCP over Streamable HTTP at /mcp, with three tools:
| MCP tool | Upstream JSON-RPC method | Arguments | Returns |
|---|---|---|---|
check_wordlist | check | words: list[str] | {"WORD": true/false, ...} |
gameday | gameday.current | none | {"min_day": int, "max_day": int} |
results | board.results | game_day: int | {"num_submissions", "best_score", "submissions": [...]} |
A plain GET /healthz route is also available for uptime checks.
app/worcadian_client.py — a minimal async JSON-RPC client(httpx) for https://worcadian.vercel.app/rpc. Upstream error responses are raised as WorcadianRPCError.
app/mcp_server.py — a FastMCP instance with the three toolsabove, each a thin wrapper around the client. Runs in stateless_http mode, since Vercel functions don't persist MCP session state between invocations, and with DNS rebinding protection explicitly disabled (that protection defaults to allowing only localhost/127.0.0.1 Host headers, which would reject every request once deployed on a real domain).
app/server.py — the FastAPI app. It mounts the MCP app (whichalready serves /mcp by default) at the root, and wires its lifespan to start/stop the MCP session manager (required even in stateless mode, and not handled automatically by Starlette's Mount).
api/index.py — the Vercel entrypoint; re-exports the FastAPI app.cd worcadian-mcp
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements-dev.txt
uvicorn app.server:app --reloadThe MCP endpoint is then available at http://127.0.0.1:8000/mcp. Point an MCP client (Claude, Cursor, etc.) at that URL using its HTTP/Streamable-HTTP MCP server transport.
pip install -r requirements-dev.txt
pytestUnit tests in tests/test_worcadian_client.py and tests/test_mcp_tools.py mock the upstream HTTP call (via respx), so they run offline.
tests/manual_smoke_test.py is not part of the automated suite — it makes real calls to the live Worcadian API (and optionally a deployed instance of this service) for a quick human sanity check:
python tests/manual_smoke_test.py
# or, against a deployed MCP server:
MCP_BASE_URL=https://your-deployment.vercel.app python tests/manual_smoke_test.pycd worcadian-mcp
vercel deployvercel.json routes all requests to api/index.py via the Python ASGI runtime. No environment variables are required — the upstream API has no authentication.
After deploying, the MCP endpoint is https://<your-project>.vercel.app/mcp.
Only the three methods above are wrapped. The upstream API documents several other methods (board.submit, analyse, seedwords.check, checkin.*, the 14 Numbers game, etc.) that are not exposed by this service.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.