Developers

Squatch MCP server

Let your AI assistant look up an MCP server before it connects to one. Endpoint: https://squatchmcp.com/mcp

Connect

Squatch speaks Streamable HTTP and supports MCP protocol versions 2026-07-28 back to 2025-03-26. Most clients accept a configuration like this:

{
  "mcpServers": {
    "squatch": {
      "type": "http",
      "url": "https://squatchmcp.com/mcp"
    }
  }
}

All 11 tools are read-only and work without an account (anonymous clients share a per-IP hourly limit). With an API key from your dashboard, calls count against your plan's daily API quota instead:

{
  "mcpServers": {
    "squatch": {
      "type": "http",
      "url": "https://squatchmcp.com/mcp",
      "headers": {
        "Authorization": "Bearer ${SQUATCH_API_KEY}"
      }
    }
  }
}

Tools

Tools exposed by the Squatch MCP server
Tool	What it does	Area
search_mcp_serversSearch the public catalog of MCP servers by name, publisher, tool, capability or category. Returns verification flags, tool effects and open-finding severity for each match.	Search the public catalog of MCP servers by name, publisher, tool, capability or category. Returns verification flags, tool effects and open-finding severity for each match.	Discovery
find_servers_by_capabilityFind MCP servers whose tools have a given capability class (e.g. FILE_ACCESS, PAYMENT) and/or effect class (READ, WRITE, DELETE, ADMIN, EXECUTE).	Find MCP servers whose tools have a given capability class (e.g. FILE_ACCESS, PAYMENT) and/or effect class (READ, WRITE, DELETE, ADMIN, EXECUTE).	Discovery
get_mcp_serverProfile of one MCP server: publisher, verification flags, trust dimension statuses, latest version, transports, tool effects and capabilities.	Profile of one MCP server: publisher, verification flags, trust dimension statuses, latest version, transports, tool effects and capabilities.	Discovery
get_trust_profileAll nine trust dimensions for a server (registry namespace, publisher identity, organization, domain, repository, source provenance, security scan, privacy transparency, monitoring) with status, evidence and evidence source. There is no overall score.	All nine trust dimensions for a server (registry namespace, publisher identity, organization, domain, repository, source provenance, security scan, privacy transparency, monitoring) with status, evidence and evidence source. There is no overall score.	Trust
get_server_toolsTools a server advertises, with Squatch's effect and capability classification, risk notes, declared annotations (unverified hints) and parameter names.	Tools a server advertises, with Squatch's effect and capability classification, risk notes, declared annotations (unverified hints) and parameter names.	Inventory
get_security_findingsPublic findings from Squatch's metadata scanner (hidden content, prompt-injection patterns, risky tool design, authentication and transport issues) with status and publisher responses.	Public findings from Squatch's metadata scanner (hidden content, prompt-injection patterns, risky tool design, authentication and transport issues) with status and publisher responses.	Security
get_privacy_disclosureThe latest publisher-declared privacy disclosure (data categories, retention, AI training, subprocessors, regions). Publisher statements are labelled as declared, not audited.	The latest publisher-declared privacy disclosure (data categories, retention, AI training, subprocessors, regions). Publisher statements are labelled as declared, not audited.	Privacy
get_mcbomMCP Bill of Materials (schema_version 1.0): a deterministic inventory of tools, resources, prompts, transports, auth, external integrations, data handling, findings and trust statuses.	MCP Bill of Materials (schema_version 1.0): a deterministic inventory of tools, resources, prompts, transports, auth, external integrations, data handling, findings and trust statuses.	Inventory
compare_mcp_serversSide-by-side facts for two to four servers: verification, trust dimension statuses, tool effects and capabilities, open findings and privacy completeness.	Side-by-side facts for two to four servers: verification, trust dimension statuses, tool effects and capabilities, open findings and privacy completeness.	Trust
check_server_changesWhat changed on a server recently: tools added/removed/changed, permission expansions, new destructive capabilities, endpoint/auth/repository changes, verification changes. Default window 30 days.	What changed on a server recently: tools added/removed/changed, permission expansions, new destructive capabilities, endpoint/auth/repository changes, verification changes. Default window 30 days.	Monitoring
assess_tool_capabilityExplain what one tool on a server appears able to do: Squatch's effect and capability classification, risk notes, whether its declared readOnly/destructive hints match the observed effect, and related findings.	Explain what one tool on a server appears able to do: Squatch's effect and capability classification, risk notes, whether its declared readOnly/destructive hints match the observed effect, and related findings.	Security

Untrusted content

Tool results quote names and descriptions from third-party servers. Squatch wraps that text in fields marked untrusted and escapes hidden characters, so your assistant can show it to you without treating it as instructions. A well-behaved client should still ask you before acting on anything a looked-up server says.