MCP Bill of Materials
A machine-readable inventory of what this server exposes and depends on: tools with their effects, transports, packages, findings and provenance (schema version 1.0). Third-party text in it is escaped. Also available from the REST API at /api/v1/servers/7bfb212a-3716-4b8f-885c-81ca96e7dfe5/mcbom.
MCP Bill of Materials
root{21}
schema_version: "1.0"
bom_format: "squatch-mcbom"
generator{3}
name: "squatch-mcp"
classifier_version: "rules_v1@2026-10-11.1"
unicode_version: "18.0.0"
server{7}
name: "dev.patchlabs/patchlabs"
title: "PatchLabs"
description: "Security checks for AI-built apps (Lovable, Supabase, Bolt): RLS, headers, monitoring, fixes."
version: "3.1.0"
homepage_url: null
source: "official_registry"
upstream_status: "active"
publisher{4}
namespace: "dev.patchlabs"
display_name: "dev.patchlabs"
type: "registry_namespace"
status: "unclaimed"
organization: null
repository{5}
url: "https://github.com/manra399/patchlabs"
provider: "github"
owner: "manra399"
name: "patchlabs"
verified: false
packages[0]
transports[1]
0{5}
kind: "remote"
type: "streamable-http"
endpoint_url: "https://api.patchlabs.dev/mcp"
endpoint_host: "api.patchlabs.dev"
auth_type: "none"
auth{3}
type: "none"
authorization_servers[0]
scopes[0]
protocol{4}
era: "legacy"
negotiated_version: "2025-06-18"
supported_versions[0]
transport_type: "streamable-http"
tools[6]
0{9}
name: "get_check"
title: "Get a check"
effect: "READ"
effect_confidence: 0.79
capabilities[0]
risk_severity: "INFO"
fingerprint: "fb0de004bc2a4a9505483b05be202c83eff67923f419dfb318e2d917bcd9e131"
input_schema_fingerprint: "2fad170753989bfcb6e4f3da3f55688cec51162db1635f7bed41c498573e66bc"
annotations{5}
title: null
readOnlyHint: null
destructiveHint: null
idempotentHint: null
openWorldHint: null
1{9}
name: "headers_check"
title: "Security headers check"
effect: "READ"
effect_confidence: 0.494
capabilities[2]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.669
1{2}
capability: "SECURITY_CONTROL"
confidence: 0.669
risk_severity: "INFO"
fingerprint: "276961cd204a82f629d2f761826e4424813283794a65b09541ed9bfe29c2efbf"
input_schema_fingerprint: "db7158446a78cc82b4e6e9fa898850cb371178a47b75a80c28402327e3f95262"
annotations{5}
title: null
readOnlyHint: null
destructiveHint: null
idempotentHint: null
openWorldHint: null
2{9}
name: "list_apps"
title: "List monitored apps"
effect: "READ"
effect_confidence: 0.822
capabilities[1]
0{2}
capability: "SECRETS"
confidence: 0.567
risk_severity: "HIGH"
fingerprint: "a3b4894b6696d25f39fceaa482b7a12af9c0343cc6a6f0bc46a1bba05d426cf9"
input_schema_fingerprint: "d746974fa9afd5e951f76f9af38954b0ad7f436f2120dc974da65e5ee39f856f"
annotations{5}
title: null
readOnlyHint: null
destructiveHint: null
idempotentHint: null
openWorldHint: null
3{9}
name: "rls_check"
title: "Static RLS check"
effect: "READ"
effect_confidence: 0.615
capabilities[1]
0{2}
capability: "SOURCE_CODE"
confidence: 0.669
risk_severity: "INFO"
fingerprint: "844226a3466325f276fcfb72df2792bf1b9335a9f7075dbeb17ac9a78a2bd686"
input_schema_fingerprint: "e4c76607f79e3b836ec00a14ddda2e6516c6e1931bd79627c8d8e43fc68ad02f"
annotations{5}
title: null
readOnlyHint: null
destructiveHint: null
idempotentHint: null
openWorldHint: null
4{9}
name: "run_check"
title: "Run a check on an app"
effect: "EXECUTE"
effect_confidence: 0.79
capabilities[0]
risk_severity: "HIGH"
fingerprint: "c10ed0078d9703346ee5f9a63546f453fdc51dcf6a74f5deada249cf42333f99"
input_schema_fingerprint: "482708d47e3cf037ef48148473483795966e7e8f4918f15de21899500faeaf09"
annotations{5}
title: null
readOnlyHint: null
destructiveHint: null
idempotentHint: null
openWorldHint: null
5{9}
name: "start_check"
title: "Request a full leak check"
effect: "WRITE"
effect_confidence: 0.885
capabilities[1]
0{2}
capability: "SOURCE_CODE"
confidence: 0.53
risk_severity: "MEDIUM"
fingerprint: "a19b3097429ad586fa2d50ad9459960cb1e3de16e25a2e356c971090ce5c5a79"
input_schema_fingerprint: "d8d0e6af09ffc7c3591ec9c5531cee032d7b654b77143fed97419e0cb2b98f5f"
annotations{5}
title: null
readOnlyHint: null
destructiveHint: null
idempotentHint: null
openWorldHint: null
resources[0]
prompts[0]
extensions[0]
data{6}
privacy_completeness: "not_provided"
data_categories[0]
ai_training: null
retention_policy: null
processing_regions[0]
subprocessors[0]
external_integrations[1]
0{3}
host: "api.patchlabs.dev"
registrable_domain: "patchlabs.dev"
source: "transport"
findings[2]
0{6}
check_id: "SQ-SERVER-AUTH-NONE-WRITE"
category: "authentication"
severity: "MEDIUM"
title: "State-changing tools available without authentication"
subject_type: "server"
subject_name: null
1{6}
check_id: "SQ-TOOL-DESTRUCTIVE-NO-ANNOTATION"
category: "annotations"
severity: "LOW"
title: "Destructive tool without annotations"
subject_type: "tool"
subject_name: "run_check"
trust{9}
registry_namespace: "verified_upstream"
publisher_identity: "unverified"
organization: "unverified"
domain: "unverified"
repository: "unverified"
source_provenance: "unknown"
security_scan: "no_critical_findings"
privacy_transparency: "not_provided"
monitoring: "active"
provenance{4}
registry_name: "dev.patchlabs/patchlabs"
registry_content_sha256: "b1903c9681188eba3ad5b562c26c99a3e1515d8ab367887481f1685857d61cd3"
scan_snapshot_fingerprint: "47cfb5ef257f21f7ed8e3239c3d0891e5cf158147e1b44cc83dcf22400e8692b"
scanner_version: "1.0.0"
timestamps{4}
generated_at: "2026-11-15T20:54:25.820Z"
observed_at: "2026-11-11T13:44:50.369+00:00"
registry_published_at: "2026-11-11T10:55:25.484273+00:00"
registry_updated_at: null