MCP Endpoint Lint - handshake, tool schemas, JSON-RPC errors
dev.workers.pathwren.www/mcp-endpoint-lint
MCP Bill of Materials
A machine-readable inventory of what this server exposes and depends on: tools with their effects, transports, packages, findings and provenance (schema version 1.0). Third-party text in it is escaped. Also available from the REST API at /api/v1/servers/399da592-2634-43cb-9587-4043ea5c1f53/mcbom.
MCP Bill of Materials
root{21}
schema_version: "1.0"
bom_format: "squatch-mcbom"
generator{3}
name: "squatch-mcp"
classifier_version: "rules_v1@2026-10-11.1"
unicode_version: "18.0.0"
server{7}
name: "dev.workers.pathwren.www/mcp-endpoint-lint"
title: "MCP Endpoint Lint - handshake, tool schemas, JSON-RPC errors"
description: "{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"whoami","arguments":{}}} free no key"
version: "1.3.0"
homepage_url: "https://www.pathwren.workers.dev/c/mcp-registry-official/mcp-lint.html"
source: "official_registry"
upstream_status: "active"
publisher{4}
namespace: "dev.workers.pathwren.www"
display_name: "dev.workers.pathwren.www"
type: "registry_namespace"
status: "unclaimed"
organization: null
repository: null
packages[0]
transports[1]
0{5}
kind: "remote"
type: "streamable-http"
endpoint_url: "https://www.pathwren.workers.dev/c/mcp-registry-official/mcp/lint"
endpoint_host: "www.pathwren.workers.dev"
auth_type: "none"
auth{3}
type: "none"
authorization_servers[0]
scopes[0]
protocol{4}
era: "modern"
negotiated_version: "2026-07-28"
supported_versions[0]
transport_type: "streamable-http"
tools[7]
0{9}
name: "discovery_report"
title: "What a client looks for before it dials"
effect: "READ"
effect_confidence: 0.595
capabilities[1]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.661
risk_severity: "INFO"
fingerprint: "4001272c114e17f0e6eebda61473c27b3c38da20e04c8a60a85ff5e74be511c4"
input_schema_fingerprint: "04f723d6d9c318d63b2b759f86f4ad8be025128faf941d87706ebc7d08e5a6a3"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
1{9}
name: "error_conformance"
title: "Does it answer JSON-RPC errors, or HTML 500s?"
effect: "READ"
effect_confidence: 0.32
capabilities[1]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.661
risk_severity: "INFO"
fingerprint: "27014e79e25b285407ea1e08fdcc1d5e49e6f8eef5d4f7a5c0382111507edb48"
input_schema_fingerprint: "83e4253ab116d0de1732723a8b8dcc94f1c0139621f9b4bdbebda93fd702c18b"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
2{9}
name: "example"
title: "Run this server's worked example (no arguments)"
effect: "EXECUTE"
effect_confidence: 0.49
capabilities[1]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.567
risk_severity: "HIGH"
fingerprint: "5b10a204e1736e2d0b757fa6e5e4dc4ec4262543d8348ee1ece000c3e1b154c1"
input_schema_fingerprint: "395a8b887a894a0ec6c0b7e68dca4b85e081d75957e46839a2a982c5a574b137"
annotations{5}
title: "Run the worked example"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: false
3{9}
name: "handshake_report"
title: "Does the handshake work, and is it idempotent?"
effect: "READ"
effect_confidence: 0.595
capabilities[1]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.76
risk_severity: "INFO"
fingerprint: "bec4680ff641f3b0f9d7527e4acde0df52110a2377de239e9336f0ae0d176e28"
input_schema_fingerprint: "0b5efd143387b44c32f0361a64875dd58fd3e2e093ac93638117e6adbdb42a0f"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
4{9}
name: "score_card"
title: "All four checks, one machine-readable verdict"
effect: "READ"
effect_confidence: 0.798
capabilities[1]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.796
risk_severity: "INFO"
fingerprint: "7aec82aef61fc2213f4702cf8a97c299a491a967fb0b9066ac5e55b09ad5be96"
input_schema_fingerprint: "83e4253ab116d0de1732723a8b8dcc94f1c0139621f9b4bdbebda93fd702c18b"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
5{9}
name: "tools_list_report"
title: "Schema-validate every tool the endpoint advertises"
effect: "READ"
effect_confidence: 0.798
capabilities[1]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.741
risk_severity: "INFO"
fingerprint: "914dcfcce0f3337f19653c38f5e8018018a2d8f307d1a77d82dd46cb9fd08951"
input_schema_fingerprint: "83e4253ab116d0de1732723a8b8dcc94f1c0139621f9b4bdbebda93fd702c18b"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
6{9}
name: "whoami"
title: "Who is calling? — the one call that needs nothing from you"
effect: "READ"
effect_confidence: 0.798
capabilities[2]
0{2}
capability: "IDENTITY"
confidence: 0.745
1{2}
capability: "PERSONAL_DATA"
confidence: 0.567
risk_severity: "LOW"
fingerprint: "4154a0ff335be6282743614f3cae922f046148fe067b6a9e10581572907f0c94"
input_schema_fingerprint: "395a8b887a894a0ec6c0b7e68dca4b85e081d75957e46839a2a982c5a574b137"
annotations{5}
title: "Who is calling?"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: false
resources[3]
0{4}
key: "https://www.pathwren.workers.dev/.well-known/mcp.json"
kind: "resource"
mime_type: "application/json"
fingerprint: "6a61bdf2003a0d915b05511ee2ec63e3488544bd6c8d4649506a4f58a908c26c"
1{4}
key: "https://www.pathwren.workers.dev/changes.json?since=0"
kind: "resource"
mime_type: "application/json"
fingerprint: "237ac83d38e1deb5003506b5595a88e7774ed3c4c3dae77ad45a68710b112211"
2{4}
key: "https://www.pathwren.workers.dev/mcp-transport.json"
kind: "resource"
mime_type: "application/json"
fingerprint: "e24492c054548a3216981c6bfab8bc8652fc55dc9f16d3d2fb51df43bb309632"
prompts[1]
0{2}
name: "start_here"
fingerprint: "e4ba683fb3492318417c207746824136b412cd5f6bdb638dfbb9d505c2ff4109"
extensions[0]
data{6}
privacy_completeness: "not_provided"
data_categories[0]
ai_training: null
retention_policy: null
processing_regions[0]
subprocessors[0]
external_integrations[1]
0{3}
host: "www.pathwren.workers.dev"
registrable_domain: "pathwren.workers.dev"
source: "transport"
findings[11]
0{6}
check_id: "SQ-CONFORMANCE-MODERN-FAILURE"
category: "conformance"
severity: "LOW"
title: "Protocol conformance checks failed"
subject_type: "server"
subject_name: null
1{6}
check_id: "SQ-PROMPT-INJECTION"
category: "prompt_injection"
severity: "MEDIUM"
title: "Prompt metadata contains directives to the AI model"
subject_type: "server"
subject_name: null
2{6}
check_id: "SQ-REPO-MISSING"
category: "provenance"
severity: "LOW"
title: "No source repository linked"
subject_type: "server"
subject_name: null
3{6}
check_id: "SQ-RESOURCE-INJECTION"
category: "prompt_injection"
severity: "HIGH"
title: "Resource metadata contains directives to the AI model"
subject_type: "server"
subject_name: null
4{6}
check_id: "SQ-RESOURCE-SENSITIVE-URI"
category: "resource"
severity: "HIGH"
title: "Resource at a sensitive system or credential path"
subject_type: "server"
subject_name: null
5{6}
check_id: "SQ-SERVER-AUTH-NONE-WRITE"
category: "authentication"
severity: "MEDIUM"
title: "State-changing tools available without authentication"
subject_type: "server"
subject_name: null
6{6}
check_id: "SQ-TOOL-INJECTION-INSTRUCTIONS"
category: "prompt_injection"
severity: "HIGH"
title: "Instructions addressed to the AI model"
subject_type: "tool"
subject_name: "discovery_report"
7{6}
check_id: "SQ-TOOL-INJECTION-INSTRUCTIONS"
category: "prompt_injection"
severity: "MEDIUM"
title: "Instructions addressed to the AI model"
subject_type: "tool"
subject_name: "error_conformance"
8{6}
check_id: "SQ-TOOL-INJECTION-INSTRUCTIONS"
category: "prompt_injection"
severity: "MEDIUM"
title: "Instructions addressed to the AI model"
subject_type: "tool"
subject_name: "handshake_report"
9{6}
check_id: "SQ-TOOL-INJECTION-INSTRUCTIONS"
category: "prompt_injection"
severity: "MEDIUM"
title: "Instructions addressed to the AI model"
subject_type: "tool"
subject_name: "tools_list_report"
10{6}
check_id: "SQ-TOOL-SENSITIVE-PATH-REFERENCE"
category: "prompt_injection"
severity: "HIGH"
title: "References credential or key locations"
subject_type: "tool"
subject_name: "discovery_report"
trust{9}
registry_namespace: "verified_upstream"
publisher_identity: "unverified"
organization: "unverified"
domain: "unverified"
repository: "not_provided"
source_provenance: "unknown"
security_scan: "findings_detected"
privacy_transparency: "not_provided"
monitoring: "active"
provenance{4}
registry_name: "dev.workers.pathwren.www/mcp-endpoint-lint"
registry_content_sha256: "dd809c7b77f9c631a6dde78b0b790e287708e2ba990579a4a713add8e8cb9e86"
scan_snapshot_fingerprint: "4a825639410df4408085543062213bd91b9901ab9629ae363f64b35e0590c13c"
scanner_version: "1.0.0"
timestamps{4}
generated_at: "2026-11-15T05:37:07.741Z"
observed_at: "2026-11-05T12:21:20.313+00:00"
registry_published_at: "2026-09-07T00:44:27.395557+00:00"
registry_updated_at: null