tstuckle/bluecrane-forms-mcp
MCP server for 115 Canadian contractor forms (Ontario, Alberta, BC) with verified citations. Hosted at mcp.bluecraneworks.ca/mcp — no auth.
Not Assessed
trustsnap_965fce4c37835438.- Utility Coverage
- Recovery Semantics
- OAUTH Interop
- Add an explicit confirm/dry-run parameter or two-step confirmation flow to write, delete, exec, and egress-capable tool…
- Align MCP-Protocol-Version, MCP-Session-Id, DELETE teardown, and expired-session handling with the transport spec.
- Only send roots/list, sampling/createMessage, or elicitation/create requests while handling an active client-initiated…
- ledger / trust summary inspection
Dispute this assessment
If any published claim about this server -- its score, a risk flag, a capability classification, or its taxonomy -- is factually wrong, tell us what evidence shows and we will review it. This does not require claiming or verifying ownership of the server first.
Verify responds to disputes within 5 business days and resolves them within 15.
Dispute history
No disputes filed for this server.
Risk
Security posture
Tool capability & risk inventory
| Tool | Capabilities | Risk | Findings | Notes |
|---|---|---|---|---|
search_forms |
read | Low | freeform input surface | No explicit safeguard hints detected. |
get_form |
read | Low | none | No explicit safeguard hints detected. |
which_form_do_i_need |
read | Low | none | No explicit safeguard hints detected. |
list_categories |
read | Low | none | No explicit safeguard hints detected. |
estimate_contractor_tax |
undetermined | Low | none | No explicit safeguard hints detected. |
required_hourly_rate |
undetermined | Low | none | No explicit safeguard hints detected. |
hst_quick_method |
undetermined | Low | none | No explicit safeguard hints detected. |
get_form_maker_pass |
read financial | High | financial transaction | No explicit safeguard hints detected. |
Write-action governance
Status detail: 1 high-risk tool(s) are exposed without a clear auth boundary; no safeguards or confirmation signals detected.
| Tool | Risk | Flags | Safeguards |
|---|---|---|---|
get_form_maker_pass |
High | financial transaction | no |
Action-controls diff
New actions
| Action | Risk | Flags |
|---|---|---|
estimate_contractor_tax | Low | none |
get_form | Low | none |
get_form_maker_pass | High | financial transaction |
hst_quick_method | Low | none |
list_categories | Low | none |
required_hourly_rate | Low | none |
search_forms | Low | freeform input surface |
which_form_do_i_need | Low | none |
Changed actions
| Action | Change types | Risk |
|---|---|---|
| No materially changed actions. | ||
Critical alerts
Compatibility
Client compatibility verdicts
Client compatibility only means the server shape can work with a client. Production trust decision and write-action publishing are evaluated separately so a client-compatible server can still be blocked for production.
Evidence provenance
initialize• OKtools_list• OKtransport_compliance_probe• Not_Assessedstep_up_auth_probe• Missingconnector_replay_probe• OK — Frozen tool snapshots must survive refresh.request_association_probe• Missing — Roots, sampling, and elicitation should stay request-scoped.
Evidence provenance
initialize• OKtools_list• OKtransport_compliance_probe• Not_Assessed
Evidence provenance
action_safety_probe• Error
Evidence provenance
tool_snapshot_probe• OKconnector_replay_probe• OK
Client compatibility gate details
Remediation checklist
OpenAI connectors expect OAuth for remote server auth.Dynamic client registration materially improves connector setup.Transport compliance should be in good shape.OAuth interoperability should be strong.The tool surface is not limited to search/fetch-style read tools.This client profile expects a read/search-only tool surface, but write, delete, or exec-capable tools are present.
Remediation checklist
Transport behavior should match Claude-compatible HTTP expectations.The tool surface is not limited to search/fetch-style read tools.This client profile expects a read/search-only tool surface, but write, delete, or exec-capable tools are present.OAuth is not configured, so this client cannot authenticate without additional setup.A connector refresh would break existing tool references (new required arguments or removed tools) -- an admin must re-approve the connector before this is safe.Not yet safe for company-knowledge use: requires a search/fetch-only surface with no write actions present.
Remediation checklist
Add a clearer auth boundary around risky write actions.Add confirmation or dry-run semantics for risky actions.The write/destructive action surface just expanded since the last validation -- review before publishing.
Verdict traces
tool_snapshot_changed• high • Tool snapshot changedauth_mode_changed• high • Auth mode changedwrite_action_surface_expanded• high • Write-action surface expanded
Client verdict trace table
| Verdict | Status | Checks | Winning source | Conflicts |
|---|---|---|---|---|
openai_connectors |
Partially client-compatible | initialize, tools_list, transport_compliance_probe, step_up_auth_probe, connector_replay_probe, request_association_probe | live_validation | none |
claude_desktop |
Client-compatible | initialize, tools_list, transport_compliance_probe | live_validation | none |
unsafe_for_write_actions |
Publishing blocked | action_safety_probe | live_validation | none |
snapshot_churn_risk |
Medium | tool_snapshot_probe, connector_replay_probe | history | none |
Publishability policy profiles
- Search Fetch Only: No
- Write Actions Present: Yes
- Oauth Configured: No
- Admin Refresh Required: Yes
- Safe For Company Knowledge: No
- Safe For Messages Api Remote Mcp: No
- Search Fetch Only: No
- Write Actions Present: Yes
- Oauth Configured: No
- Admin Refresh Required: Yes
- Safe For Company Knowledge: No
- Safe For Messages Api Remote Mcp: No
Compatibility fixtures
- remote_http_endpoint: Passes
- oauth_discovery: Degraded
- frozen_tool_snapshot_refresh: Passes
- request_association: Passes
- remote_transport: Passes
- tool_discovery: Passes
- auth_connect: Passes
- safe_write_review: Degraded
Recommended for
Evidence
Current trust snapshot
trustsnap_965fce4c37835438Canonical machine links
Evidence confidence
Latest validation evidence
Failures
oauth_authorization_serverno authorization serveroauth_protected_resourceClient error '404 Not Found' for url 'https://mcp.bluecraneworks.ca/.well-known/oauth-protected-resource' For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404openid_configurationno authorization serverserver_cardClient error '404 Not Found' for url 'https://mcp.bluecraneworks.ca/.well-known/mcp/server-card.json' For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404
Checks
| Check | Status | Latency | Evidence |
|---|---|---|---|
action_safety_probe |
Error | n/a | 1 high-risk tool(s); no clear auth boundary; safeguards=0; confirmation=none. |
advanced_capabilities_probe |
Missing | n/a | No advanced MCP capability signals detected. |
connector_publishability_probe |
Warning | n/a | Publishability blockers: transport compliance, action safety, server card. |
connector_replay_probe |
OK | n/a | Backward compatible with no breaking tool-surface changes. |
determinism_probe |
Not_Assessed | n/a | owner opt out |
initialize |
OK | 23.2 ms | Protocol 2025-03-26 |
interactive_flow_probe |
Missing | n/a | Check completed |
oauth_authorization_server |
Missing | n/a | no authorization server |
oauth_protected_resource |
Error | 33.5 ms | Client error '404 Not Found' for url 'https://mcp.bluecraneworks.ca/.well-known/oauth-protected-resource' For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404 |
official_registry_probe |
Warning | n/a | Check completed |
openid_configuration |
Missing | n/a | no authorization server |
probe_noise_resilience |
OK | 7.7 ms | Fetched https://mcp.bluecraneworks.ca/robots.txt |
prompt_get |
Missing | n/a | not advertised |
prompts_list |
Missing | 7.0 ms | not supported |
protocol_version_probe |
Warning | n/a | Claims 2025-03-26; 2 release(s) behind 2025-11-25. |
provenance_divergence_probe |
Not_Assessed | n/a | Check completed |
request_association_probe |
Missing | n/a | No request-association capabilities were advertised. |
resource_read |
Missing | n/a | not advertised |
resources_list |
Missing | 7.2 ms | not supported |
schema_divergence_probe |
Missing | n/a | no server card tools |
server_card |
Error | 34.9 ms | Client error '404 Not Found' for url 'https://mcp.bluecraneworks.ca/.well-known/mcp/server-card.json' For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404 |
session_resume_probe |
Warning | n/a | no session id |
step_up_auth_probe |
Missing | n/a | No OAuth or incremental-scope signals detected. |
tool_snapshot_probe |
OK | n/a | Check completed |
tools_list |
OK | 7.2 ms | 8 tool(s) exposed |
transport_compliance_probe |
Not_Assessed | n/a | Session header=no, protocol header=no, bad protocol=n/a. |
utility_coverage_probe |
Missing | 7.8 ms | No completions evidence; no pagination evidence; tasks missing. |
Raw evidence view
Show raw JSON evidence
{
"checks": {
"action_safety_probe": {
"details": {
"auth_present": false,
"confirmation_signals": [],
"reason": null,
"safeguard_count": 0,
"summary": {
"annotation_conflict_tools": 0,
"bulk_access_tools": 0,
"capability_distribution": {
"financial": 1,
"read": 5,
"undetermined": 3
},
"declared_non_read_only_tools": 0,
"destructive_tools": 0,
"egress_tools": 0,
"exec_tools": 0,
"high_risk_tools": 1,
"risk_distribution": {
"critical": 0,
"high": 1,
"low": 7,
"medium": 0
},
"secret_tools": 0,
"tool_count": 8
}
},
"latency_ms": null,
"status": "error"
},
"advanced_capabilities_probe": {
"details": {
"capabilities": {
"completions": false,
"elicitation": false,
"prompts": false,
"resource_links": false,
"resources": false,
"roots": false,
"sampling": false,
"structured_outputs": false
},
"enabled": [],
"enabled_count": 0,
"initialize_capability_keys": [
"tools"
]
},
"latency_ms": null,
"status": "missing"
},
"connector_publishability_probe": {
"details": {
"blockers": [
"transport_compliance",
"action_safety",
"server_card"
],
"criteria": {
"action_safety": false,
"auth_flow": true,
"connector_replay": true,
"initialize": true,
"protocol_version": true,
"remote_transport": true,
"request_association": true,
"server_card": false,
"session_resume": true,
"step_up_auth": true,
"tool_surface": true,
"tools_list": true,
"transport_compliance": false
},
"high_risk_tools": 1,
"tool_count": 8,
"transport": "streamable-http"
},
"latency_ms": null,
"status": "warning"
},
"connector_replay_probe": {
"details": {
"added_tools": [],
"additive_output_changes": [],
"backward_compatible": true,
"output_breaks": [],
"removed_tools": [],
"required_arg_breaks": [],
"would_break_after_refresh": false
},
"latency_ms": null,
"status": "ok"
},
"determinism_probe": {
"details": {
"reason": "owner_opt_out"
},
"latency_ms": null,
"status": "not_assessed"
},
"initialize": {
"details": {
"headers": {
"content-type": "application/json"
},
"http_status": 200,
"payload": {
"id": 1,
"jsonrpc": "2.0",
"result": {
"capabilities": {
"tools": {}
},
"instructions": "Blue Crane's Canadian contractor form and tax tools. Start with search_forms or which_form_do_i_need for paperwork, estimate_contractor_tax for tax questions. All forms are free to fill and print; always pass the fill_and_print_free URL to the user. Note: Blue Crane provides preparation worksheets and on-site records. It does not file anything with any ministry or tribunal.",
"protocolVersion": "2025-03-26",
"serverInfo": {
"name": "bluecrane-forms",
"title": "Blue Crane \u2014 Canadian Contractor Forms & Tax Tools",
"version": "1.1.0"
}
}
},
"url": "https://mcp.bluecraneworks.ca/mcp"
},
"latency_ms": 23.18,
"status": "ok"
},
"interactive_flow_probe": {
"details": {
"oauth_supported": false,
"prompt_available": false,
"risk_hits": [],
"safe_hits": []
},
"latency_ms": null,
"status": "missing"
},
"oauth_authorization_server": {
"details": {
"reason": "no_authorization_server"
},
"latency_ms": null,
"status": "missing"
},
"oauth_protected_resource": {
"details": {
"error": "Client error '404 Not Found' for url 'https://mcp.bluecraneworks.ca/.well-known/oauth-protected-resource'\nFor more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404",
"url": "https://mcp.bluecraneworks.ca/.well-known/oauth-protected-resource"
},
"latency_ms": 33.48,
"status": "error"
},
"official_registry_probe": {
"details": {
"direct_match": false,
"official_identifiers": [
"ai.linkguard/linkguard-mcp",
"ai.inblog/mcp",
"ai.dinglebear/cortex-rmcp",
"ai.nauro/nauro",
"ai.elfa/mcp",
"ai.beket/audit",
"ai.klyf/klyf",
"ai.intuitek.the-stall/the-stall",
"ai.epinu/epinu",
"ai.exa/exa"
],
"official_peer_count": 10,
"registry_source": "github_topic_registry"
},
"latency_ms": null,
"status": "warning"
},
"openid_configuration": {
"details": {
"reason": "no_authorization_server"
},
"latency_ms": null,
"status": "missing"
},
"probe_noise_resilience": {
"details": {
"headers": {
"content-type": "text/plain; charset=utf-8"
},
"http_status": 200,
"url": "https://mcp.bluecraneworks.ca/robots.txt",
"validation_disallowed": true
},
"latency_ms": 7.72,
"status": "ok"
},
"prompt_get": {
"details": {
"reason": "not_advertised"
},
"latency_ms": null,
"status": "missing"
},
"prompts_list": {
"details": {
"headers": {
"content-type": "application/json"
},
"http_status": 200,
"payload": {
"error": {
"code": -32601,
"message": "Method not found: prompts/list"
},
"id": 3,
"jsonrpc": "2.0"
},
"reason": "not_supported",
"url": "https://mcp.bluecraneworks.ca/mcp"
},
"latency_ms": 7.04,
"status": "missing"
},
"protocol_version_probe": {
"details": {
"claimed_version": "2025-03-26",
"lag_days": 244,
"latest_known_version": "2025-11-25",
"releases_behind": 2,
"validator_protocol_version": "2025-03-26"
},
"latency_ms": null,
"status": "warning"
},
"provenance_divergence_probe": {
"details": {
"compared_fields": [
"title",
"version",
"homepage",
"repository"
],
"direct_official_match": false,
"drift_fields": [],
"metadata_document_count": 1,
"readable_sources": [
"registry"
],
"registry_homepage": null,
"registry_repository": null,
"registry_title": null,
"registry_version": null,
"server_card_homepage": null,
"server_card_repository": null,
"server_card_title": null,
"server_card_version": null
},
"latency_ms": null,
"status": "not_assessed"
},
"request_association_probe": {
"details": {
"reason": "no_request_association_capabilities_advertised"
},
"latency_ms": null,
"status": "missing"
},
"resource_read": {
"details": {
"reason": "not_advertised"
},
"latency_ms": null,
"status": "missing"
},
"resources_list": {
"details": {
"headers": {
"content-type": "application/json"
},
"http_status": 200,
"payload": {
"error": {
"code": -32601,
"message": "Method not found: resources/list"
},
"id": 5,
"jsonrpc": "2.0"
},
"reason": "not_supported",
"url": "https://mcp.bluecraneworks.ca/mcp"
},
"latency_ms": 7.17,
"status": "missing"
},
"schema_divergence_probe": {
"details": {
"compared_dimensions": [
"tool_membership",
"parameter_names",
"required_parameters",
"parameter_types",
"output_schema_presence"
],
"compared_tool_count": 0,
"reason": "no_server_card_tools"
},
"latency_ms": null,
"status": "missing"
},
"server_card": {
"details": {
"error": "Client error '404 Not Found' for url 'https://mcp.bluecraneworks.ca/.well-known/mcp/server-card.json'\nFor more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404",
"url": "https://mcp.bluecraneworks.ca/.well-known/mcp/server-card.json"
},
"latency_ms": 34.9,
"status": "error"
},
"session_resume_probe": {
"details": {
"protocol_version": "2025-03-26",
"reason": "no_session_id",
"resume_expected": true,
"transport": "streamable-http"
},
"latency_ms": null,
"status": "warning"
},
"step_up_auth_probe": {
"details": {
"auth_required_checks": [],
"broad_scopes": [],
"challenge_headers": [],
"minimal_scope_documented": false,
"oauth_present": false,
"scope_specificity_ratio": 0.0,
"step_up_signals": [],
"supported_scopes": []
},
"latency_ms": null,
"status": "missing"
},
"tool_snapshot_probe": {
"details": {
"added": [],
"changed_outputs": [],
"current_tool_count": 8,
"previous_tool_count": 8,
"removed": [],
"similarity": 1.0
},
"latency_ms": null,
"status": "ok"
},
"tools_list": {
"details": {
"headers": {
"content-type": "application/json"
},
"http_status": 200,
"payload": {
"id": 2,
"jsonrpc": "2.0",
"result": {
"tools": [
{
"description": "Search Blue Crane's compendium of 126 Canadian contractor forms \u2014 Ontario, Alberta and BC statutory worksheets plus Canada-wide site paperwork (safety, statutory worksheets, inspections, invoices, sign-offs, site logs) by keyword, form number, or alias (e.g. 'FLHA', 'form 1.2', 'hot work', 'toolbox talk'). Returns matching forms with citations and free fill-and-print URLs.",
"inputSchema": {
"properties": {
"limit": {
"description": "Max results (default 8)",
"maximum": 25,
"minimum": 1,
"type": "integer"
},
"query": {
"description": "Keywords, a form number, or an alias",
"type": "string"
}
},
"required": [
"query"
],
"type": "object"
},
"name": "search_forms",
"title": "Search Ontario contractor forms"
},
{
"description": "Get full details for one form by its id (from search_forms): description, regulatory citation, the exact fields it collects, and free print / Pass options.",
"inputSchema": {
"properties": {
"id": {
"description": "Form id, e.g. 'field-level-hazard-assessment'",
"type": "string"
}
},
"required": [
"id"
],
"type": "object"
},
"name": "get_form",
"title": "Get form details"
},
{
"description": "Describe a jobsite or paperwork situation in plain language (e.g. 'starting an $80k renovation in Ontario', 'GC is not paying my invoice', 'crew doing welding tomorrow') and get the forms that fit, with citations and free print links. Guidance only \u2014 not legal advice.",
"inputSchema": {
"properties": {
"situation": {
"description": "The situation, in plain language",
"type": "string"
}
},
"required": [
"situation"
],
"type": "object"
},
"name": "which_form_do_i_need",
"title": "Which form do I need?"
},
{
"description": "List the form categories (WSIB & incidents, site safety, vehicles & equipment, finance, subcontractors, etc.) with what each covers and how many forms it holds.",
"inputSchema": {
"properties": {},
"type": "object"
},
"name": "list_categories",
"title": "List form categories"
},
{
"description": "Estimate 2026 income tax, CPP, and take-home for a self-employed Canadian contractor or tradesperson (sole proprietor) by province. Uses sourced CRA and provincial rates from tradestaxcalculator.ca. Provinces: ontario, alberta, bc, saskatchewan, manitoba, new-brunswick, nova-scotia, pei, newfoundland, yukon, nwt, nunavut (no Quebec). Planning estimate, not tax advice.",
"inputSchema": {
"properties": {
"expenses": {
"description": "Deductible business expenses, CAD (default 0)",
"type": "number"
},
"province": {
"description": "Province slug, e.g. 'ontario', 'alberta', 'bc'",
"type": "string"
},
"revenue": {
"description": "Gross self-employment revenue for the year, CAD (before HST)",
"type": "number"
}
},
"required": [
"province",
"revenue"
],
"type": "object"
},
"name": "estimate_contractor_tax",
"title": "Estimate contractor tax (Canada)"
},
{
"description": "Work backwards from the annual take-home a contractor wants to the hourly rate they must bill, accounting for 2026 income tax and CPP in their province plus billable time. Planning estimate.",
"inputSchema": {
"properties": {
"billable_hours_per_week": {
"description": "Billable hours per week (default 30)",
"type": "number"
},
"overhead_annual": {
"description": "Annual business overhead, CAD (default 0)",
"type": "number"
},
"province": {
"description": "Province slug, e.g. 'ontario'",
"type": "string"
},
"target_take_home": {
"description": "Desired annual after-tax take-home, CAD",
"type": "number"
},
"weeks_per_year": {
"description": "Working weeks per year (default 48)",
"type": "number"
}
},
"required": [
"province",
"target_take_home"
],
"type": "object"
},
"name": "required_hourly_rate",
"title": "Required hourly rate for a target take-home"
},
{
"description": "Compare the CRA Quick Method of accounting for HST against the regular method for an Ontario contractor: what they would remit and keep under each, with the break-even. Planning estimate.",
"inputSchema": {
"properties": {
"operating_itcs": {
"description": "GST/HST paid on operating expenses that the regular method would reclaim as ITCs, CAD (default 0)",
"type": "number"
},
"revenue": {
"description": "Annual revenue before HST, CAD",
"type": "number"
},
"type": {
"description": "Business type for the quick-method rate (default services)",
"enum": [
"services",
"goods"
],
"type": "string"
}
},
"required": [
"revenue"
],
"type": "object"
},
"name": "hst_quick_method",
"title": "HST Quick Method comparison (Ontario)"
},
{
"description": "Pricing and checkout links for the Blue Crane Form Maker Pass: one-time purchase that strips all Blue Crane text from printed PDFs (clean, client-ready paper) and auto-fills saved company details across all 126 forms.",
"inputSchema": {
"properties": {},
"type": "object"
},
"name": "get_form_maker_pass",
"title": "Form Maker Pass pricing"
}
]
}
},
"url": "https://mcp.bluecraneworks.ca/mcp"
},
"latency_ms": 7.19,
"status": "ok"
},
"transport_compliance_probe": {
"details": {
"reason": "owner_opt_out"
},
"latency_ms": null,
"status": "not_assessed"
},
"utility_coverage_probe": {
"details": {
"completions": {
"advertised": false,
"live_probe": "not_executed",
"sample_target": null
},
"initialize_capability_keys": [
"tools"
],
"pagination": {
"metadata_signal": false,
"next_cursor_methods": [],
"supported": false
},
"tasks": {
"advertised": false,
"http_status": 200,
"probe_status": "missing"
}
},
"latency_ms": 7.83,
"status": "missing"
}
},
"failures": {
"oauth_authorization_server": {
"reason": "no_authorization_server"
},
"oauth_protected_resource": {
"error": "Client error '404 Not Found' for url 'https://mcp.bluecraneworks.ca/.well-known/oauth-protected-resource'\nFor more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404",
"url": "https://mcp.bluecraneworks.ca/.well-known/oauth-protected-resource"
},
"openid_configuration": {
"reason": "no_authorization_server"
},
"server_card": {
"error": "Client error '404 Not Found' for url 'https://mcp.bluecraneworks.ca/.well-known/mcp/server-card.json'\nFor more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404",
"url": "https://mcp.bluecraneworks.ca/.well-known/mcp/server-card.json"
}
},
"remote_url": "https://mcp.bluecraneworks.ca/mcp",
"server_card_payload": null,
"server_identifier": "github-tstuckle/bluecrane-forms-mcp"
}
Known versions
- No versions recorded.
Validation history
| Timestamp | Status | Score | Latency | Tools |
|---|---|---|---|---|
| Aug 06, 2026 07:37:42 AM UTC | Healthy | 60.7 | 140.5 ms | 8 |
| Aug 06, 2026 07:37:42 AM UTC | Healthy | 36.4 | 221.5 ms | 0 |
| Aug 06, 2026 07:37:42 AM UTC | Healthy | 36.4 | 350.7 ms | 0 |
| Aug 05, 2026 07:37:04 PM UTC | Healthy | 38.9 | 330.3 ms | 0 |
| Aug 03, 2026 05:10:46 AM UTC | Healthy | 41.0 | 416.3 ms | 0 |
Validation timeline
| Validated | Summary | Score | Protocol | Auth mode | Tools | High-risk tools | Changes |
|---|---|---|---|---|---|---|---|
| Aug 06, 2026 07:37:42 AM UTC | Healthy | 60.7 | 2025-03-26 | public | 8 | 1 | auth_mode_changed write_surface_expanded tool_snapshot_changed |
| Aug 06, 2026 07:37:42 AM UTC | Healthy | 36.4 | unknown | unknown | 0 | 0 | none |
| Aug 06, 2026 07:37:42 AM UTC | Healthy | 36.4 | unknown | unknown | 0 | 0 | none |
| Aug 05, 2026 07:37:04 PM UTC | Healthy | 38.9 | unknown | unknown | 0 | 0 | none |
| Aug 03, 2026 05:10:46 AM UTC | Healthy | 41.0 | unknown | unknown | 0 | 0 | none |
Recent validation runs
| Started | Status | Summary | Latency | Checks |
|---|---|---|---|---|
| Aug 06, 2026 07:37:42 AM UTC | Completed | Healthy | 140.5 ms | action_safety_probe, advanced_capabilities_probe, connector_publishability_probe, connector_replay_probe, determinism_probe, initialize, interactive_flow_probe, oauth_authorization_server, oauth_protected_resource, official_registry_probe, openid_configuration, probe_noise_resilience, prompt_get, prompts_list, protocol_version_probe, provenance_divergence_probe, request_association_probe, resource_read, resources_list, schema_divergence_probe, server_card, session_resume_probe, step_up_auth_probe, tool_snapshot_probe, tools_list, transport_compliance_probe, utility_coverage_probe |
| Aug 06, 2026 07:37:42 AM UTC | Completed | Healthy | 221.5 ms | |
| Aug 06, 2026 07:37:41 AM UTC | Completed | Healthy | 350.7 ms | |
| Aug 05, 2026 07:37:03 PM UTC | Completed | Healthy | 330.3 ms | |
| Aug 03, 2026 05:10:46 AM UTC | Completed | Healthy | 416.3 ms | |
Public server reputation
Incident & change feed
| Timestamp | Event | Details |
|---|---|---|
| Aug 05, 2026 10:59:49 AM UTC | Score corrected (post-1.0.503 remediation, R1 zero-anchoring) | Prior: 68.26. Corrected: 64.9. |
| Aug 06, 2026 07:37:42 AM UTC | Latest validation: healthy | Score 60.7 with status healthy. |
| Aug 06, 2026 07:37:42 AM UTC | Score changed | Score delta +24.3 versus the previous run. |
| Aug 06, 2026 07:37:42 AM UTC | Tool snapshot changed | Added 8, removed 0, and changed 0 tool contracts. |
| Aug 06, 2026 07:37:42 AM UTC | Auth mode changed | Auth mode moved from unknown to public. |
| Aug 06, 2026 07:37:42 AM UTC | Score changed | Score delta -2.5 versus the previous run. |
Capabilities
- OAuth:
- DCR/CIMD:
- Prompts:
- Homepage: https://mcp.bluecraneworks.ca/mcp
- Docs: https://mcp.bluecraneworks.ca/mcp
- Support: https://github.com/tstuckle/bluecrane-forms-mcp
- Icon: https://avatars.githubusercontent.com/u/273635708?v=4
- Remote endpoint: https://mcp.bluecraneworks.ca/mcp
- Server card: none
Benchmark tasks
| Benchmark task | Status | Evidence |
|---|---|---|
| Discover tools | Passes |
|
| Read-only fetch flow | Degraded |
|
| OAuth-required connect | Degraded |
|
| Safe write flow with confirmation | Likely to fail |
|
Utility coverage
Transport compliance drilldown
Issues: none
Request association
Connector replay
Required-argument replay breaks
| Tool | Added required args | Removed required args |
|---|---|---|
| No required-argument replay breaks detected. | ||
Output-schema replay breaks
| Tool | Removed properties | Added properties |
|---|---|---|
| No output-schema replay breaks detected. | ||
Tool snapshot diff & changelog
Required-argument changes
| Tool | Added required args | Removed required args |
|---|---|---|
| No required-argument changes detected. | ||
Output-schema drift
| Tool | Previous properties | Latest properties |
|---|---|---|
| No output-schema drift detected. | ||
Validation diff
Regressed checks: action_safety_probe, determinism_probe, oauth_protected_resource, provenance_divergence_probe, server_card, transport_compliance_probe
Improved checks: connector_replay_probe, initialize, probe_noise_resilience, tool_snapshot_probe, tools_list
Newly assessed dimensions: none
No longer assessed dimensions: none
| Component | Previous | Latest | Delta |
|---|---|---|---|
| No component deltas between the latest two runs. | |||
Registry & provenance divergence
| Field | Registry | Live server card |
|---|---|---|
| Title | n/a | n/a |
| Version | n/a | n/a |
| Homepage | n/a | n/a |
Active alerts
- Tool snapshot changed (high)
Tools were added, removed, or materially changed between the latest two validations. - Auth mode changed (high)
Auth mode changed from unknown to public. - Write-action surface expanded (high)
The number of high-risk write, delete, exec, or bulk-access tools increased on the latest run.
Aliases & registry graph
| Identifier | Source | Canonical | Score |
|---|---|---|---|
github-tstuckle/bluecrane-forms-mcp |
github_topic_registry | yes | 60.7 |
Alias consolidation
Source disagreements
| Field | What differs | Observed values |
|---|---|---|
| No source disagreements detected. | ||
Fix it
Why this score?
Algorithmic score breakdown
Actionable remediation
| Severity | Remediation | Why it matters | Recommended action |
|---|---|---|---|
| High | Add confirmation and dry-run semantics for risky actions | High-risk write, delete, exec, or egress tools should communicate safeguards clearly. | Add an explicit confirm/dry-run parameter or two-step confirmation flow to write, delete, exec, and egress-capable tools before they can make destructive changes.Playbook
|
| High | Align session and protocol behavior with Streamable HTTP expectations | Clients increasingly rely on MCP-Protocol-Version, session teardown, and expired-session semantics. | Align MCP-Protocol-Version, MCP-Session-Id, DELETE teardown, and expired-session handling with the transport spec.Playbook
|
| High | Associate roots, sampling, and elicitation with active client requests | Modern MCP guidance expects roots, sampling, and elicitation traffic to be tied to an active client request instead of arriving unsolicited on idle sessions. | Only send roots/list, sampling/createMessage, or elicitation/create requests while handling an active client-initiated request, never on idle sessions.Playbook
|
| High | Expose /.well-known/oauth-protected-resource | Without a protected-resource document, OAuth clients cannot discover auth requirements reliably. | Serve /.well-known/oauth-protected-resource and point it at your authorization server metadata.Playbook
|
| High | Publish OAuth authorization-server metadata | Clients need authorization-server metadata to discover issuer, endpoints, and DCR support. | Publish /.well-known/oauth-authorization-server from your issuer and include registration_endpoint when supported.Playbook
|
| High | Publish a complete server card | Missing or incomplete server-card metadata weakens discovery, documentation, and trust signals. | Serve /.well-known/mcp/server-card.json and include tools, prompts/resources, homepage, and support links.Playbook
|
| High | Respond to auth mode changed | Auth mode changed from unknown to public. | Document the new auth posture and confirm protected-resource and challenge metadata still match reality. |
| High | Respond to tool snapshot changed | Tools were added, removed, or materially changed between the latest two validations. | Publish a first-class changelog for tool additions, removals, and breaking schema changes.Playbook
|
| High | Respond to write-action surface expanded | The number of high-risk write, delete, exec, or bulk-access tools increased on the latest run. | Review the newly exposed write and destructive actions before publishing them broadly.Playbook
|
| High | Stabilize repeated tools/list responses | Tool enumeration drift causes client caching and planning issues. | Return the same tool surface on repeated tools/list calls unless a real version change occurred. |
| High | Stop asking users to paste secrets directly | Public MCP servers should prefer OAuth or browser-based auth guidance over in-band secret collection. | |
| High | Sync the published server card's tool schemas with the live tool surface | The server card and live tools/list disagree on parameter names, required sets, or types -- clients that trust the published card will construct invalid calls. | Regenerate the published server card from the live tool schemas (or vice versa) so parameter names, required sets, and types match exactly.Playbook
|
| Medium | Adopt a current MCP protocol revision | Older protocol revisions reduce compatibility with newer clients and registry programs. | Advertise a current MCP protocol revision (2025-06-18 or later) in both the initialize response and the MCP-Protocol-Version header.Playbook
|
| Medium | Close connector-publishing gaps | Connector catalogs care about protocol recency, session behavior, auth clarity, and tool-surface stability. | |
| Medium | Document minimal scopes and return cleaner auth challenges | Modern clients expect granular scopes and step-up auth signals such as WWW-Authenticate scope hints. | Return granular scopes and WWW-Authenticate challenge hints instead of forcing overly broad auth upfront.Playbook
|
| Medium | Publish OpenID configuration | OIDC metadata improves token validation and client compatibility. | Expose /.well-known/openid-configuration with issuer, jwks_uri, and supported grants.Playbook
|
| Medium | Reconcile registry, server-card, and repository metadata | Directory trust falls quickly when official registry fields drift from the live server card or public repo metadata. | |
| Medium | Repair prompts/list or stop advertising prompts | Prompt metadata should either work live or be removed from the advertised capability set. | Only advertise prompts if prompts/list works and prompt arguments are documented.Playbook
|
| Medium | Repair resources/list or stop advertising resources | Resource metadata should either work live or be removed from the advertised capability set. | Only advertise resources if resources/list works and resources expose stable URIs/types.Playbook
|
| Medium | Support resumable HTTP sessions cleanly | Modern MCP clients increasingly expect resumable session behavior on streamable HTTP transports. | Persist session state keyed by Mcp-Session-Id and honor Last-Event-ID on GET reconnects so clients can resume a dropped Streamable HTTP session.Playbook
|
| Low | Expose modern utility surfaces like completions, pagination, or tasks | Utility coverage improves interoperability with larger clients and long-lived agent workflows. | Expose completions, pagination, and task metadata where supported so larger clients can plan and resume work safely.Playbook
|
| Low | Publish newer MCP capability signals | Roots, sampling, elicitation, structured outputs, and related metadata improve client understanding and ranking. | Advertise only the advanced capabilities (roots, sampling, elicitation) you have actually implemented end to end in the initialize capabilities object.Playbook
|
| Low | Publish or reconcile the server in the official MCP registry | Official registry presence improves discovery confidence and cross-source consistency. |
Point loss breakdown
| Component | Current | Points missing |
|---|---|---|
| Utility Coverage | 0/4 | -4.0 |
| Recovery Semantics | 0/4 | -4.0 |
| OAUTH Interop | 0/4 | -4.0 |
| Dependency Supply Chain Signal | 0/4 | -4.0 |
| Advanced Capability Coverage | 0/4 | -4.0 |
| Least Privilege Scope | 1/4 | -3.0 |
| Error Contract | 1/4 | -3.0 |
| Action Safety | 1/4 | -3.0 |
| Trust Confidence | 2/4 | -2.0 |
| Spec Recency | 2/4 | -2.0 |
| Session Semantics | 2/4 | -2.0 |
| Security Hygiene | 2/4 | -2.0 |
Compatibility profiles
Connector URL: https://mcp.bluecraneworks.ca/mcp # No OAuth metadata detected. # Server: github-tstuckle/bluecrane-forms-mcp
{
"mcpServers": {
"bluecrane-forms-mcp": {
"command": "npx",
"args": ["mcp-remote", "https://mcp.bluecraneworks.ca/mcp"]
}
}
}
smithery mcp add "https://mcp.bluecraneworks.ca/mcp"
curl -sS https://mcp.bluecraneworks.ca/mcp -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"mcp-verify","version":"0.1.0"}}}'
Governance
MCP TrustOps
TrustOps turns this report into operational controls: freshness SLAs, authenticated validation, semantic benchmarks, policy exports, alert subscriptions, badges, cost/compliance metadata, and runtime routing. Fresh trusted index decisions stay separate from long-tail inventory so stale scores do not masquerade as current evidence.
/v1/decideAlert subscription types
MCP Runtime hosting
Verify Hosted MCP turns a trusted server report into a managed remote MCP endpoint with GitHub deployment provenance, sandbox policy, encrypted secrets, release history, rollback, and audit/usage events.
/hosted/{namespace}/{name}/mcp| Deployment | Status | Endpoint | Release |
|---|---|---|---|
| No hosted runtime deployments yet. | |||
Authenticated validation sessions
Public validation is free. Authenticated validation is paid and proves scoped behavior, write-action safeguards, and authenticated tool execution.
/v1/verify/v1/ci/previewInstall snippets
Connector URL: https://mcp.bluecraneworks.ca/mcp # No OAuth metadata detected. # Server: github-tstuckle/bluecrane-forms-mcp
{
"mcpServers": {
"bluecrane-forms-mcp": {
"command": "npx",
"args": ["mcp-remote", "https://mcp.bluecraneworks.ca/mcp"]
}
}
}
smithery mcp add "https://mcp.bluecraneworks.ca/mcp"
curl -sS https://mcp.bluecraneworks.ca/mcp -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"mcp-verify","version":"0.1.0"}}}'
Agent access & tool surface
tools/list, prompts/list, and resources/list checks.github-tstuckle/bluecrane-forms-mcp.