Verificate MCP
REMOTE · MCP.VERIFICATE.AI · SCANNED AUG 4
Agentic code review, no signup to try: reality gates + frontier-model review, with veto.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS not yet verified: we couldn't determine whether a plaintext access path exists. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability72
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1042 tokens (~173/item across 6 items; 4 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability check failed: schema churn in the 4 days we've observed: 0 tool removals, 1 breaking changes, 1 auth/transport breaks, 0 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Capabilities20
- Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
remote · mcp.verificate.ai
claude mcp add --transport http ai-verificate-mcp https://mcp.verificate.ai/mcp
[mcp_servers.ai-verificate-mcp] url = "https://mcp.verificate.ai/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-verificate-mcp": {
"type": "remote",
"url": "https://mcp.verificate.ai/mcp",
"enabled": true
}
}
} openclaw mcp add ai-verificate-mcp --url https://mcp.verificate.ai/mcp --transport streamable-http
mcp_servers:
ai-verificate-mcp:
url: "https://mcp.verificate.ai/mcp" {
"mcpServers": {
"ai-verificate-mcp": {
"type": "http",
"url": "https://mcp.verificate.ai/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 −2
- A breaking change shipped without a version bump: still 0.7.1 ▼ security
- The server rewrote its instructions, which are the text every model session reads security
- Tool “validate_ai_output” rewrote its description, which is the text the model reads security
- Schema quality: 143 → 173 ▼ functional
- “validate_ai_output” changed the type of “context”: object → object|string ▼ functional
- Schema quality: excellent → good functional
- “validate_ai_output” reworded the description of “validation_type” cosmetic
- “validate_ai_output” reworded the description of “context” cosmetic
- “validate_ai_output” reworded the description of “ai_output” cosmetic
- Tool “validate_ai_output” changed its title: Gate AI-written code → Gate AI-written output (code or documents) cosmetic
- 1 Aug 26 −3
- Stability: unverified → fail ▼ security
- Authorization: fail → partial ▲ security
- Stability: unverified → 0.03 ▲ functional
- 31 Jul 26 66
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Aug 2026 · Probed https://mcp.verificate.ai/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=verificate.ai | CN=WE1,O=Google Trust Services,C=US | 31 Jul 2026 | 29 Oct 2026 | ECDSA 256 | ECDSA-SHA256 | 3b41703f84e72f510e2463da4790895c |
| SANs: verificate.ai, mcp.verificate.ai, *.mcp.verificate.ai | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
DNSSEC insecure
Validation of mcp.verificate.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| verificate.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.verificate.ai/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.verificate.ai/mcp | Inconclusive | 405 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
analyze_code Advisory code deep-dive ~207
Advisory deep-dive on existing code — scores and findings, deliberately NO pass/fail verdict, so it never blocks an agent. Surfaces performance hot paths, scalability cliffs, reliability gaps and tech debt with concrete latency/throughput arithmetic (e.g. 'O(n²) dedup: ~4s at 10k items'). Read-only: the code is analyzed, never executed. Use it to understand a validate_ai_output rejection or review inherited code; use validate_ai_output when you need an accept/reject decision.
| Name | Type | Req | Description |
|---|---|---|---|
| analysis_type | string | — | Lens for the review: 'quality' (default, broad ISO/IEC 25010 pass) or a focused pass on one dimension. |
| code | string | yes | The source code to analyze — a function, file or pasted excerpt. |
| language | string | — | Source language, e.g. 'python', 'typescript', 'cpp', 'sql', 'swift'. Inferred if omitted; stating it sharpens findings. |
| Name | Type | Req | Description |
|---|---|---|---|
| complexity | string | — | low | medium | high |
| issues | array | yes | Findings as 'severity|category|detail' with supporting arithmetic |
| provider | string | — | — |
| quality_score | number | yes | 0-100 advisory score for the chosen lens |
| suggestions | array | — | — |
No examples provided.
generate_code Generate gated code ~180
Generate code and gate it in one step: an LLM writes the implementation, then the same protection engine as validate_ai_output vets it — retrying generation when the gate rejects. If every attempt is vetoed you still receive the last attempt, clearly marked validated:false with the gate findings — rejected code is never presented as clean. Generation runs on our infrastructure; nothing executes in your environment.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | — | Target language for the generated code, e.g. 'python' (default), 'typescript', 'go', 'sql'. |
| max_tokens | integer | — | Generation budget. The default 4000 fits most functions/classes; raise it for multi-file scaffolds. |
| prompt | string | yes | What to build, with any constraints worth enforcing — e.g. 'a rate-limited retry decorator with exponential backoff, stdlib only'. |
| Name | Type | Req | Description |
|---|---|---|---|
| attempts | integer | — | Generation attempts before approval or give-up |
| code | string | — | The generated implementation |
| generated | boolean | yes | False only when no provider returned code |
| protection | object | — | Deterministic gate result. A veto here is final — the model review cannot override it. |
| provider | string | — | — |
| validated | boolean | — | True if the protection gates approved the final attempt; false means the gate findings in 'protection' explain the veto |
| validation_score | number | — | Deterministic gate score, 0-100 |
No examples provided.
validate_ai_output Gate AI-written output (code or documents) ~312
The merge gate for ANY AI-written output — code, documentation, reports, emails, configs: returns a binary approve/reject verdict with veto power — e.g. it rejects code calling the nonexistent stripe.Inventory API, an N+1 loop with the latency arithmetic to prove it, or a doc claiming success with no evidence. Deterministic reality gates (mock/placeholder veto, gaming and bypass detection, invented-API checks) run first and cannot be overridden; a frontier-model review (ISO/IEC 25010) then scores quality, accuracy, reliability and tech debt. Read-only: nothing is executed. Call it on every AI-generated deliverable before accepting it; use validate_plan for plans, analyze_code for an advisory report without a verdict.
| Name | Type | Req | Description |
|---|---|---|---|
| ai_output | string | yes | The AI-generated output to gate — source code (a diff, function or whole file, any mainstream language) or prose (documentation, a report, an email, release notes). |
| context | object|string | — | Optional review context — an object like {"language": "cpp", "scale": "10k req/s"} ('language' sharpens SDK-reality checks) or a free-text sentence describing intent. |
| validation_type | string | — | What the output is: 'code_generation' (default) for source code; 'documentation', 'report', 'email', 'text', ... for prose (code-marker gates are skipped, integrity gates and the frontier review stil… |
| Name | Type | Req | Description |
|---|---|---|---|
| confidence | number | — | score / 100 |
| issues | array | yes | Severity-ranked findings, each 'severity|category|detail' with the reasoning |
| protection | object | — | Deterministic gate result. A veto here is final — the model review cannot override it. |
| provider | string | — | Model that ran the deep review, or 'protection-gates-only' |
| score | number | yes | Combined score 0-100 (gates fused with the model review) |
| suggestions | array | — | Concrete fixes to reach approval |
| valid | boolean | yes | The binary verdict: true = approved, false = rejected |
No examples provided.
validate_plan Gate an implementation plan ~184
The gate for PLANS, designs and specs — run BEFORE any code is written, the cheapest place to catch a bad design. Returns the same binary verdict shape as validate_ai_output, with findings on completeness, feasibility, performance and scalability implications, security risks and missing considerations (e.g. it rejects a plan that polls an API every 100ms per client, with the request-volume math). Read-only: nothing is executed or stored beyond the verdict. Use validate_ai_output for the code that follows.
| Name | Type | Req | Description |
|---|---|---|---|
| context | object | — | Optional constraints the review should weigh, e.g. {"system": "payments API", "scale": "1M users", "constraints": "PostgreSQL only"}. |
| plan | string | yes | The implementation plan, design or spec to validate, as plain text or markdown — e.g. a numbered migration plan or an architecture sketch. |
| Name | Type | Req | Description |
|---|---|---|---|
| confidence | number | — | score / 100 |
| issues | array | yes | Severity-ranked findings, each 'severity|category|detail' with the reasoning |
| protection | object | — | Deterministic gate result. A veto here is final — the model review cannot override it. |
| provider | string | — | Model that ran the deep review, or 'protection-gates-only' |
| score | number | yes | Combined score 0-100 (gates fused with the model review) |
| suggestions | array | — | Concrete fixes to reach approval |
| valid | boolean | yes | The binary verdict: true = approved, false = rejected |
No examples provided.