MCP Bill of Materials
A machine-readable inventory of what this server exposes and depends on: tools with their effects, transports, packages, findings and provenance (schema version 1.0). Third-party text in it is escaped. Also available from the REST API at /api/v1/servers/be4a1001-08b9-4ed4-9428-7a8648e1931a/mcbom.
MCP Bill of Materials
root{21}
schema_version: "1.0"
bom_format: "squatch-mcbom"
generator{3}
name: "squatch-mcp"
classifier_version: "rules_v1@2026-10-11.1"
unicode_version: "18.0.0"
server{7}
name: "co.launchtrust/launchtrust"
title: "LaunchTrust"
description: "Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure."
version: "0.1.0"
homepage_url: null
source: "official_registry"
upstream_status: "active"
publisher{4}
namespace: "co.launchtrust"
display_name: "co.launchtrust"
type: "registry_namespace"
status: "unclaimed"
organization: null
repository{5}
url: "https://github.com/mustafasalimerek-bit/launchtrust-mcp"
provider: "github"
owner: "mustafasalimerek-bit"
name: "launchtrust-mcp"
verified: false
packages[0]
transports[1]
0{5}
kind: "remote"
type: "streamable-http"
endpoint_url: "https://mcp.launchtrust.co/mcp"
endpoint_host: "mcp.launchtrust.co"
auth_type: "none"
auth{3}
type: "none"
authorization_servers[0]
scopes[0]
protocol{4}
era: "legacy"
negotiated_version: "2025-11-25"
supported_versions[0]
transport_type: "streamable-http"
tools[9]
0{9}
name: "get_compliance_rules"
title: "Get sourced compliance rule snapshots"
effect: "READ"
effect_confidence: 0.921
capabilities[0]
risk_severity: "INFO"
fingerprint: "8bc9e09a632693bedbc5bb5ab2977d226b61e4495ae97b954b26c55878727d3d"
input_schema_fingerprint: "719d418201bac537a0eab686c3d6e715ca0549578132ca74ba9985b4db0353b0"
annotations{5}
title: "Get sourced compliance rule snapshots"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
1{9}
name: "get_market_report"
title: "Get a market-annotated compliance report"
effect: "READ"
effect_confidence: 0.921
capabilities[0]
risk_severity: "INFO"
fingerprint: "2c090ad01e199a3744a8f95bd3d753fd76aa624f5840ddaf5262dd56c84098f4"
input_schema_fingerprint: "b7ccea4d4217df4415a78be908bb7af176922834ca385941e2314cb451631ced"
annotations{5}
title: "Get a market-annotated compliance report"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
2{9}
name: "get_scan_history"
title: "Get scan history for an app"
effect: "READ"
effect_confidence: 0.921
capabilities[0]
risk_severity: "INFO"
fingerprint: "c929c4fe1a6f602d7a24fe110182dd8b691a279e46957f312bd1405361a8ed14"
input_schema_fingerprint: "b7ccea4d4217df4415a78be908bb7af176922834ca385941e2314cb451631ced"
annotations{5}
title: "Get scan history for an app"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
3{9}
name: "list_jurisdictions"
title: "List compliance jurisdictions covered"
effect: "READ"
effect_confidence: 0.908
capabilities[0]
risk_severity: "INFO"
fingerprint: "63eb48ab22aa81a73bb115c2b37819438bce5ab18c478e1bf9da0aafbefe5c9e"
input_schema_fingerprint: "99334726611ccf58a148b0814696bfa6fe08c1b2d027e946beccf5a74331c9aa"
annotations{5}
title: "List compliance jurisdictions covered"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
4{9}
name: "list_my_apps"
title: "List your registered apps"
effect: "READ"
effect_confidence: 0.908
capabilities[0]
risk_severity: "INFO"
fingerprint: "24ff626ffa5e01b9024852dd2a710aa91e85dbe1c69991b07d25750e3b29d2ed"
input_schema_fingerprint: "99334726611ccf58a148b0814696bfa6fe08c1b2d027e946beccf5a74331c9aa"
annotations{5}
title: "List your registered apps"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
5{9}
name: "register_app"
title: "Register an app to monitor"
effect: "WRITE"
effect_confidence: 0.885
capabilities[1]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.796
risk_severity: "MEDIUM"
fingerprint: "2618f2d0fd099823555d94d9db9aacacf18017348b1309b788255313a613b62d"
input_schema_fingerprint: "4e66442a172099851a8aca1b5fd3ade3fe228831a58f70dcef18bff39f91c535"
annotations{5}
title: "Register an app to monitor"
readOnlyHint: false
destructiveHint: false
idempotentHint: true
openWorldHint: true
6{9}
name: "scan_app"
title: "Run a full signed scan on a registered app"
effect: "EXECUTE"
effect_confidence: 0.67
capabilities[0]
risk_severity: "HIGH"
fingerprint: "b29224892aed08c023798193aec052b0d66431f468f06f0f2df722ec45695ac8"
input_schema_fingerprint: "a05de898addf86824e6aed8cadf53051f5771ff4e29f6a4b55c37e1c401b0c38"
annotations{5}
title: "Run a full signed scan on a registered app"
readOnlyHint: false
destructiveHint: false
idempotentHint: false
openWorldHint: true
7{9}
name: "scan_url"
title: "Free count-only quick scan"
effect: "EXECUTE"
effect_confidence: 0.533
capabilities[1]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.898
risk_severity: "HIGH"
fingerprint: "4413458372ff068ee8f59b7e2f1523304cf63bb9110622f662d0fc28d508c565"
input_schema_fingerprint: "1e8eedbb929ed7bea2a2ae69b1596df0a1bb2454fb1c739b1f213013f606c235"
annotations{5}
title: "Free count-only quick scan"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
8{9}
name: "verify_record"
title: "Verify a LaunchTrust signed record"
effect: "READ"
effect_confidence: 0.896
capabilities[0]
risk_severity: "INFO"
fingerprint: "6a2e5afc4e226450d843774742cc8b49ec670b055f688d496492e107c16b7fe5"
input_schema_fingerprint: "c0baee486879a37aead4719b8b6a0226552c6a3948698ff1fd86bcb922a9ea35"
annotations{5}
title: "Verify a LaunchTrust signed record"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
resources[0]
prompts[0]
extensions[0]
data{6}
privacy_completeness: "not_provided"
data_categories[0]
ai_training: null
retention_policy: null
processing_regions[0]
subprocessors[0]
external_integrations[1]
0{3}
host: "mcp.launchtrust.co"
registrable_domain: "launchtrust.co"
source: "transport"
findings[3]
0{6}
check_id: "SQ-SERVER-AUTH-NONE-WRITE"
category: "authentication"
severity: "MEDIUM"
title: "State-changing tools available without authentication"
subject_type: "server"
subject_name: null
1{6}
check_id: "SQ-TOOL-ANNOTATION-UNDERCLAIM"
category: "annotations"
severity: "MEDIUM"
title: "Annotations understate what the tool does"
subject_type: "tool"
subject_name: "scan_url"
2{6}
check_id: "SQ-TOOL-SENSITIVE-PATH-REFERENCE"
category: "prompt_injection"
severity: "HIGH"
title: "References credential or key locations"
subject_type: "tool"
subject_name: "scan_url"
trust{9}
registry_namespace: "verified_upstream"
publisher_identity: "unverified"
organization: "unverified"
domain: "unverified"
repository: "unverified"
source_provenance: "unknown"
security_scan: "findings_detected"
privacy_transparency: "not_provided"
monitoring: "active"
provenance{4}
registry_name: "co.launchtrust/launchtrust"
registry_content_sha256: "f8f4239f8b041a2c1bcefd95671335bb49f0feeeae8a55833b582218b7b8ca3a"
scan_snapshot_fingerprint: "e5b64f0dda23c6883b28c783a24d06012a09e4276a0b013593d4fc302a0a60c1"
scanner_version: "1.0.0"
timestamps{4}
generated_at: "2026-11-15T04:09:34.343Z"
observed_at: "2026-11-13T02:13:02.698+00:00"
registry_published_at: "2026-06-26T10:38:14.49757+00:00"
registry_updated_at: null