MCP Bill of Materials
A machine-readable inventory of what this server exposes and depends on: tools with their effects, transports, packages, findings and provenance (schema version 1.0). Third-party text in it is escaped. Also available from the REST API at /api/v1/servers/ee274105-ba88-4571-822a-48225f5850e5/mcbom.
MCP Bill of Materials
root{21}
schema_version: "1.0"
bom_format: "squatch-mcbom"
generator{3}
name: "squatch-mcp"
classifier_version: "rules_v1@2026-10-11.1"
unicode_version: "18.0.0"
server{7}
name: "com.savvly/savvly"
title: null
description: "Savvly MCP: query fund data, model projections, and compare against alternative retirement products."
version: "1.0.108"
homepage_url: "https://savvly.com"
source: "official_registry"
upstream_status: "active"
publisher{4}
namespace: "com.savvly"
display_name: "com.savvly"
type: "registry_namespace"
status: "unclaimed"
organization: null
repository{5}
url: "https://github.com/Savvly/savvly-mcp"
provider: "github"
owner: "Savvly"
name: "savvly-mcp"
verified: false
packages[5]
0{4}
registry_type: "mcpb"
identifier: "https://github.com/Savvly/savvly-mcp/releases/download/v1.0.108/savvly-mcp-server.mcpb"
version: null
transport: "stdio"
1{4}
registry_type: "npm"
identifier: "@savvly/mcp-server"
version: "1.0.108"
transport: "stdio"
2{4}
registry_type: "nuget"
identifier: "Savvly.McpServer"
version: "1.0.108"
transport: "stdio"
3{4}
registry_type: "oci"
identifier: "ghcr.io/savvly/savvly-mcp-server:1.0.108"
version: null
transport: "stdio"
4{4}
registry_type: "pypi"
identifier: "savvly-mcp-server"
version: "1.0.108"
transport: "stdio"
transports[6]
0{5}
kind: "package"
type: "stdio"
endpoint_url: null
endpoint_host: null
auth_type: "unknown"
1{5}
kind: "package"
type: "stdio"
endpoint_url: null
endpoint_host: null
auth_type: "unknown"
2{5}
kind: "package"
type: "stdio"
endpoint_url: null
endpoint_host: null
auth_type: "unknown"
3{5}
kind: "package"
type: "stdio"
endpoint_url: null
endpoint_host: null
auth_type: "unknown"
4{5}
kind: "package"
type: "stdio"
endpoint_url: null
endpoint_host: null
auth_type: "unknown"
5{5}
kind: "remote"
type: "streamable-http"
endpoint_url: "https://api.savvly.com/mcp"
endpoint_host: "api.savvly.com"
auth_type: "none"
auth{3}
type: "none"
authorization_servers[0]
scopes[0]
protocol{4}
era: "legacy"
negotiated_version: "2025-11-25"
supported_versions[0]
transport_type: "streamable-http"
tools[8]
0{9}
name: "check_savvly_eligibility"
title: "Check Savvly Eligibility"
effect: "READ"
effect_confidence: 0.921
capabilities[1]
0{2}
capability: "PERSONAL_DATA"
confidence: 0.76
risk_severity: "LOW"
fingerprint: "38e26bed5ef98b4c312fa08780e9099e1cd4a02947ffa4ddbcfaaddc9d762da0"
input_schema_fingerprint: "65cb847950b4ca46199174f90f95b5cf32d709cd0a0e2b225638e5c8df8ce987"
annotations{5}
title: "Check Savvly Eligibility"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: false
1{9}
name: "compare_savvly_vs_alternative"
title: "Compare Savvly vs Alternative Product"
effect: "READ"
effect_confidence: 0.933
capabilities[2]
0{2}
capability: "PAYMENT"
confidence: 0.567
1{2}
capability: "PERSONAL_DATA"
confidence: 0.674
risk_severity: "LOW"
fingerprint: "7eff1543593ae83ec8222411583ced5557ed8352f40276a146077d3cb79bad0f"
input_schema_fingerprint: "b9f814d80c9fb994b4ef9d2dc022f7b243d424fc57b9d88840bcd057dccdd08c"
annotations{5}
title: "Compare Savvly vs Alternative Product"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: false
2{9}
name: "get_savvly_faq"
title: "Get Savvly FAQ"
effect: "READ"
effect_confidence: 0.933
capabilities[0]
risk_severity: "INFO"
fingerprint: "dabea056babdfcbc73df8be4ef4131b587ddf10c787ed9d453d3b4861f74a4ed"
input_schema_fingerprint: "557134b1eb3ff2069b1b4112f36c4c0da67c61d2453568a3dc5f68e65b76899c"
annotations{5}
title: "Get Savvly FAQ"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: false
3{9}
name: "get_savvly_product_info"
title: "Get Savvly Product Info"
effect: "READ"
effect_confidence: 0.933
capabilities[2]
0{2}
capability: "PAYMENT"
confidence: 0.675
1{2}
capability: "PERSONAL_DATA"
confidence: 0.723
risk_severity: "LOW"
fingerprint: "8bfe9351d6545606c7c7f2e296502f7b52b2c1f3f431c18299d44f08d054335f"
input_schema_fingerprint: "c6d5e8cdc978503c10167d441e18a4d19a7d4e5c08e1f6e86b9821b61a4713c8"
annotations{5}
title: "Get Savvly Product Info"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: false
4{9}
name: "project_retirement_with_savvly"
title: "Project Retirement Trajectory With Savvly"
effect: "READ"
effect_confidence: 0.422
capabilities[1]
0{2}
capability: "PERSONAL_DATA"
confidence: 0.565
risk_severity: "LOW"
fingerprint: "dd09a40017e678693053c820a41efc178be4b934591e5278a05ac3cf0048ebb0"
input_schema_fingerprint: "49103cd90d940a64f2a609e49d7c22ad84124070f01add1e0f137938cef8c5b6"
annotations{5}
title: "Project Retirement Trajectory With Savvly"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: false
5{9}
name: "project_savvly_lumpsum"
title: "Project Savvly Lump-Sum Investment"
effect: "READ"
effect_confidence: 0.32
capabilities[0]
risk_severity: "INFO"
fingerprint: "cbaba17ff74aa31ea1975faca1f6f41fd47801196780d9b1d034daeb53bb2eff"
input_schema_fingerprint: "bbe2b431abff66b859e9139a90a0dce2539ef63dddd4667f76a1df0da7810307"
annotations{5}
title: "Project Savvly Lump-Sum Investment"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: false
6{9}
name: "project_savvly_monthly"
title: "Project Savvly Monthly Contributions"
effect: "READ"
effect_confidence: 0.32
capabilities[0]
risk_severity: "INFO"
fingerprint: "14605d36bb85243afce398773f0e550700916b223f8152f2333610c196b00796"
input_schema_fingerprint: "e583a82e03e2fee2afb7a62da23063570f67e2b376751a717da831ddfdfa6c9a"
annotations{5}
title: "Project Savvly Monthly Contributions"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: false
7{9}
name: "search_savvly_content"
title: "Search Savvly Q&A Content Library"
effect: "READ"
effect_confidence: 0.921
capabilities[1]
0{2}
capability: "PERSONAL_DATA"
confidence: 0.632
risk_severity: "LOW"
fingerprint: "ffa7802ce3c34a2be50285fef15b7648a57f533a1b3ebd722319b3ed8e41d713"
input_schema_fingerprint: "559b634b698497d64ae0f34dc3c123d93107ef64fb56d0cfd30dd03b8c53998d"
annotations{5}
title: "Search Savvly Q&A Content Library"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: false
resources[8]
0{4}
key: "savvly://content/qa-library"
kind: "resource"
mime_type: null
fingerprint: "34ddfaeafa1c8a6f109b7d12b4d73781754e9adee6fa194d6f7440a58d0e0434"
1{4}
key: "savvly://product/comparison-matrix"
kind: "resource"
mime_type: null
fingerprint: "96f62d3243b5993c221ec0744dd68cf3e6b607c481901986fc06d3bd5d2f37fe"
2{4}
key: "savvly://product/overview"
kind: "resource"
mime_type: null
fingerprint: "b42c01c5d461e6d53c8289c09d9d8773fe9de5623b2202b2af41a8e415a8fac8"
3{4}
key: "savvly://product/payout-schedule"
kind: "resource"
mime_type: null
fingerprint: "5ca9b8bddefd189f3a26b2d540de667bf2a85bfabdc67c0b4f91c61cfa083a1e"
4{4}
key: "ui://savvly/compare-matrix.html"
kind: "resource"
mime_type: "text/html;profile=mcp-app"
fingerprint: "2437a358c3a623abd8ef15b9a649c729c2ef2404362e8dba3afa45c1dcc1538b"
5{4}
key: "ui://savvly/payout-chart.html"
kind: "resource"
mime_type: "text/html;profile=mcp-app"
fingerprint: "835d6a93746bc3da63949bc290110c4aaad0f2877e1b0aefa0f8f29733450bd1"
6{4}
key: "ui://savvly/product-card.html"
kind: "resource"
mime_type: "text/html;profile=mcp-app"
fingerprint: "23de8087a09451f7beeda36a3ba890779ef60a1eccc870046843605f34e831df"
7{4}
key: "ui://savvly/retirement-chart.html"
kind: "resource"
mime_type: "text/html;profile=mcp-app"
fingerprint: "a1bcf836f30da83141c774f48bc2fadd75ad4c8b4eb4507e0844b227b5f1bcea"
prompts[0]
extensions[1]
0: "io.modelcontextprotocol/ui"
data{6}
privacy_completeness: "not_provided"
data_categories[0]
ai_training: null
retention_policy: null
processing_regions[0]
subprocessors[0]
external_integrations[1]
0{3}
host: "api.savvly.com"
registrable_domain: "savvly.com"
source: "transport"
findings[9]
0{6}
check_id: "SQ-SERVER-INSTRUCTIONS-INJECTION"
category: "prompt_injection"
severity: "MEDIUM"
title: "Server instructions contain directives to the AI model"
subject_type: "server"
subject_name: null
1{6}
check_id: "SQ-TOOL-CONCEALMENT"
category: "prompt_injection"
severity: "CRITICAL"
title: "Text asks the AI model to hide actions from the user"
subject_type: "tool"
subject_name: "project_retirement_with_savvly"
2{6}
check_id: "SQ-TOOL-CONCEALMENT"
category: "prompt_injection"
severity: "CRITICAL"
title: "Text asks the AI model to hide actions from the user"
subject_type: "tool"
subject_name: "project_savvly_lumpsum"
3{6}
check_id: "SQ-TOOL-CONCEALMENT"
category: "prompt_injection"
severity: "CRITICAL"
title: "Text asks the AI model to hide actions from the user"
subject_type: "tool"
subject_name: "project_savvly_monthly"
4{6}
check_id: "SQ-TOOL-INJECTION-INSTRUCTIONS"
category: "prompt_injection"
severity: "MEDIUM"
title: "Instructions addressed to the AI model"
subject_type: "tool"
subject_name: "get_savvly_product_info"
5{6}
check_id: "SQ-TOOL-INJECTION-INSTRUCTIONS"
category: "prompt_injection"
severity: "CRITICAL"
title: "Instructions addressed to the AI model"
subject_type: "tool"
subject_name: "project_retirement_with_savvly"
6{6}
check_id: "SQ-TOOL-INJECTION-INSTRUCTIONS"
category: "prompt_injection"
severity: "CRITICAL"
title: "Instructions addressed to the AI model"
subject_type: "tool"
subject_name: "project_savvly_lumpsum"
7{6}
check_id: "SQ-TOOL-INJECTION-INSTRUCTIONS"
category: "prompt_injection"
severity: "CRITICAL"
title: "Instructions addressed to the AI model"
subject_type: "tool"
subject_name: "project_savvly_monthly"
8{6}
check_id: "SQ-TOOL-INJECTION-INSTRUCTIONS"
category: "prompt_injection"
severity: "MEDIUM"
title: "Instructions addressed to the AI model"
subject_type: "tool"
subject_name: "search_savvly_content"
trust{9}
registry_namespace: "verified_upstream"
publisher_identity: "unverified"
organization: "unverified"
domain: "unverified"
repository: "unverified"
source_provenance: "unknown"
security_scan: "findings_detected"
privacy_transparency: "not_provided"
monitoring: "active"
provenance{4}
registry_name: "com.savvly/savvly"
registry_content_sha256: "4bbc012fa154ef7b05887b07dde465e0f27eb35131a59d78c57e86be53f2ce85"
scan_snapshot_fingerprint: "f03d159ba8be84efb82731a36b03de469714c6fb8b25b841e5280620765f1ec6"
scanner_version: "1.0.0"
timestamps{4}
generated_at: "2026-11-15T04:52:52.108Z"
observed_at: "2026-11-12T06:24:35.023+00:00"
registry_published_at: "2026-11-12T05:43:08.705047+00:00"
registry_updated_at: null