Cardog
REMOTE · MCP.CARDOG.IO · 2 COMPONENTS · SCANNED AUG 3
VIN decode, Canadian listings, market quotes, TC+NHTSA recalls. Full API: https://cardog.app/docs.md
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →
Endpoint Security46
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 5 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS not yet verified: we couldn't determine whether a plaintext access path exists. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability54
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3089 tokens (~617/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability check failed: schema churn in the 8 days we've observed: 14 tool removals, 0 breaking changes, 0 auth/transport breaks, 5 additions. See how to fix → Fail
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 97% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
remote · mcp.cardog.io
claude mcp add --transport http app-cardog-mcp https://mcp.cardog.io/mcp?api_key={api_key} [mcp_servers.app-cardog-mcp]
url = "https://mcp.cardog.io/mcp?api_key={api_key}" {
"$schema": "https://opencode.ai/config.json",
"mcp": {
"app-cardog-mcp": {
"type": "remote",
"url": "https://mcp.cardog.io/mcp?api_key={api_key}",
"enabled": true
}
}
} openclaw mcp add app-cardog-mcp --url https://mcp.cardog.io/mcp?api_key={api_key} --transport streamable-http mcp_servers:
app-cardog-mcp:
url: "https://mcp.cardog.io/mcp?api_key={api_key}" {
"mcpServers": {
"app-cardog-mcp": {
"type": "http",
"url": "https://mcp.cardog.io/mcp?api_key={api_key}"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 1 Aug 26 −1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Jul 26 +4
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 51
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Probed https://mcp.cardog.io/mcp?api_key={api_key}
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=cardog.io | CN=WE1,O=Google Trust Services,C=US | 16 Jul 2026 | 14 Oct 2026 | ECDSA 256 | ECDSA-SHA256 | cadc5a3bb2545a880ede15f53ba9b2b8 |
| SANs: cardog.io, mcp.cardog.io, *.mcp.cardog.io | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
DNSSEC insecure
Validation of mcp.cardog.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| io. | present | 57355 | 8 | Verified |
| cardog.io. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.cardog.io/mcp?api_key={api_key} | Verified | 200 | |
| http (plaintext) | http://mcp.cardog.io/mcp?api_key={api_key} | Inconclusive | 406 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
check_recalls ~600
The authoritative "is this vehicle under recall?" check — Transport Canada + NHTSA recall campaigns, fused and ref-keyed. Compliance guide: https://cardog.app/docs/compliance. Pass EXACTLY ONE of: - `vin` (17 characters) — the per-vehicle recall check. In the result, `resolved: false` means the VIN is not bridged into the graph yet — distinct from "no recalls" (`resolved: true, total: 0`). - `ref` — an entity ref scoping campaigns: "make:honda", "model:honda/cr-v", or "model-year:honda/cr-v/2026". A ref is `{domain}:{key}`, lowercase, with `/` separating composite key segments: "make:tesla", "model:mini/hardtop", "model-year:honda/cr-v/2026", "fuel-type:electric". (Exception: nano/squish keys are uppercase VIN charset — machine-derived, never typed from text.) Get refs from resolve_entity or identify_vehicle — never construct them from guessed names. Each campaign carries: authority (tc/nhtsa) + campaign number, component, defect/consequence summaries, the corrective action, recall date, units affected, and `affects` — the affected model-years as refs. `asOf` (VIN checks) is when the recall data was last updated, citable. Errors are instructions: every failure returns {code, message, hint, suggestions} — follow `hint` for the next call; `suggestions` lists nearest valid refs for a bad ref. Unknown-but-well-formed refs are a 400 naming the ref, NEVER a silent fuzzy match. Next: identify_vehicle({ vin }) for the vehicle's full identity; market_quote({ ref: "model-year:…" }); GET /v2/recalls/{recall-ref} for one campaign; GET /v2/recalls/feed for the newest campaigns.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVE… |
| limit | integer | — | Max campaigns for a ref-scoped query (default 25, max 100) |
| ref | string | — | Entity ref scope: "make:honda", "model:honda/cr-v", or "model-year:honda/cr-v/2026". Exclusive with `vin`. |
| vin | string | — | 17-character VIN — the per-vehicle recall check. Exclusive with `ref`. |
No output schema declared.
No examples provided.
identify_vehicle ~527
Decode a 17-character VIN into its full Cardog identity: canonical entity refs, the market grains (nano/squish), spec highlights, and links to adjacent resources. VIN ONLY — this tool never fuzzy-matches. If you hold free text ("2021 Civic", a make or model name), do NOT call this: call resolve_entity — free text enters the platform in exactly one tool. A non-VIN input returns a redirect hint, not a decode. A ref is `{domain}:{key}`, lowercase, with `/` separating composite key segments: "make:tesla", "model:mini/hardtop", "model-year:honda/cr-v/2026", "fuel-type:electric". (Exception: nano/squish keys are uppercase VIN charset — machine-derived, never typed from text.) The result's `refs` block (make/model/modelYear/fuelType/…) contains the join keys for every other tool; a null ref means "not derivable for this VIN", never "unknown ref". `squish` (WMI+VDS+year) is always derivable and is a valid market_quote instrument; `nano` is the fungible build grain for dedup/comparables. `specHighlights` is a best-effort skim of the canonical spec sheet (horsepower, economy, range, seating…) — the full sheet lives at GET /v2/specs/{refs.modelYear}. Errors are instructions: every failure returns {code, message, hint, suggestions} — follow `hint` for the next call; `suggestions` lists nearest valid refs for a bad ref. Unknown-but-well-formed refs are a 400 naming the ref, NEVER a silent fuzzy match. Next: check_recalls({ vin }) — outstanding recalls; market_quote({ ref: refs.modelYear ?? squish }); search_inventory({ models: [refs.model] }).
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVE… |
| vin | string | yes | The 17-character VIN. Free text is NOT accepted here — use resolve_entity for text. |
No output schema declared.
No examples provided.
market_quote ~502
The live market card for one instrument: quote (live listing count, best/p25/median/p75 price, average days-on-market, 30-day price cuts), a daily-bar history summary, and a bounded sample of the live listings behind the numbers. `ref` must be an INSTRUMENT ref — one of two grains: - "model-year:{make}/{model}/{year}" (e.g. "model-year:honda/cr-v/2026") — lowercase, /-separated; get it from resolve_entity (domain "model-year") or identify_vehicle's refs.modelYear. - "squish:{9 uppercase VIN chars}" (e.g. "squish:5TDGSKFCS") — the exact-config grain; get it from identify_vehicle. (squish/nano keys are the ONLY uppercase refs; every other domain is lowercase.) No other ref domain quotes. Errors are instructions: every failure returns {code, message, hint, suggestions} — follow `hint` for the next call; `suggestions` lists nearest valid refs for a bad ref. Unknown-but-well-formed refs are a 400 naming the ref, NEVER a silent fuzzy match. Optional `window` picks the history span: 1w, 1m, 3m, 6m, ytd, 1y, 3y, 5y, 10y, all. Next: search_inventory with the model's refs to walk the full book; check_recalls({ ref }) on a model-year ref; GET /v2/tape/history/{ref} for every daily bar.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVE… |
| ref | string | yes | Instrument ref: "model-year:honda/cr-v/2026" or "squish:5TDGSKFCS". Free text never quotes — resolve_entity first. |
| window | string | — | History window (server default when omitted) |
No output schema declared.
No examples provided.
resolve_entity ~540
Turn free text into canonical Cardog entity refs — THE text entry point for every other tool. A ref is `{domain}:{key}`, lowercase, with `/` separating composite key segments: "make:tesla", "model:mini/hardtop", "model-year:honda/cr-v/2026", "fuel-type:electric". (Exception: nano/squish keys are uppercase VIN charset — machine-derived, never typed from text.) Every other tool takes refs, never names. Call this FIRST whenever you hold text — "Civic", "2024 Model Y", a misspelling like "teslla" — then reuse the refs for the rest of the session. Returns candidates with confidence, best-first. `best` is the top candidate ONLY when it clears the confidence floor; otherwise it is null and YOU choose from `candidates` (or ask the user) — the API never guesses. Pass `domain` to constrain the search (use domain "model-year" when you need a market_quote instrument). Errors are instructions: every failure returns {code, message, hint, suggestions} — follow `hint` for the next call; `suggestions` lists nearest valid refs for a bad ref. Unknown-but-well-formed refs are a 400 naming the ref, NEVER a silent fuzzy match. Next steps (also echoed in each result's `next` block): search_inventory with make/model refs; market_quote with a model-year: ref; check_recalls with any make/model/model-year ref; dereference a ref (parents, children, counts) at GET /v2/entities/{ref}.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVE… |
| domain | string | — | Constrain candidates to one domain: "make", "model", "model-year", "body-style", "fuel-type", "drive-type", "transmission", "electrification-level", "vehicle-type". Omit to search across domains. |
| limit | integer | — | Max candidates (default 5) |
| query | string | yes | Free text to resolve, e.g. "2021 Civic", "teslla", "plug-in hybrid" |
No output schema declared.
No examples provided.
search_inventory ~920
Search live Canadian vehicle listings — ref-native. One call returns listings + facets + the total count. Filters take entity REFS from resolve_entity / identify_vehicle, never free-text names: makes: ["make:mini"], models: ["model:mini/hardtop"], fuelTypes: ["fuel-type:electric"] — plus year/price/odometer ranges and canonical spec filters, e.g. spec: {"fuelEconomyCombined": {"min": 35}, "heatedSeatsFront": ["standard"]} (numeric attrs take {min,max}; equipment attrs take ["standard"|"optional"|"unavailable"]). A ref is `{domain}:{key}`, lowercase, with `/` separating composite key segments: "make:tesla", "model:mini/hardtop", "model-year:honda/cr-v/2026", "fuel-type:electric". (Exception: nano/squish keys are uppercase VIN charset — machine-derived, never typed from text.) Errors are instructions: every failure returns {code, message, hint, suggestions} — follow `hint` for the next call; `suggestions` lists nearest valid refs for a bad ref. Unknown-but-well-formed refs are a 400 naming the ref, NEVER a silent fuzzy match. A typo'd or unknown ref 400s with code "unknown_entity_refs" naming it, with nearest-ref suggestions — correct the ref (usually via resolve_entity) and retry. Facets in the result are (ref, name, count) buckets over the MATCHING set — they double as the valid filter vocabulary for your next, narrower call. Every listing row carries its refs (makeRef/modelRef/nano). Next: market_quote({ ref: "model-year:…" }) for pricing context; check_recalls({ vin }) per listing; GET /v2/listings/vin/{vin} for the full canonical spec.
| Name | Type | Req | Description |
|---|---|---|---|
| bodyStyles | array | — | Entity refs in the "body-style" domain, e.g. ["body-style:sport-utility-vehicle-suv"] |
| context | string | yes | Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVE… |
| driveTypes | array | — | Entity refs in the "drive-type" domain, e.g. ["drive-type:awd-all-wheel-drive"] |
| electrificationLevels | array | — | Entity refs in the "electrification-level" domain, e.g. ["electrification-level:bev-battery-electric-vehicle"] |
| fuelTypes | array | — | Entity refs in the "fuel-type" domain, e.g. ["fuel-type:electric"] |
| limit | integer | — | Rows per page (default 10, max 50) |
| makes | array | — | Entity refs in the "make" domain, e.g. ["make:mini"] |
| models | array | — | Entity refs in the "model" domain, e.g. ["model:mini/hardtop"] |
| nanos | array | — | Entity refs in the "nano" domain, e.g. ["nano:5TDGSKFCRS"] |
| odometer | object | — | Odometer (km) range |
| page | integer | — | Page number (default 1) |
| price | object | — | Price (CAD) range |
| sort | object | — | — |
| spec | object | — | Canonical spec filters keyed by SpecAttributeId: numeric → {"min","max"}, equipment → ["standard"|"optional"|"unavailable"]. Example: {"fuelEconomyCombined": {"min": 35}, "heatedSeatsFront": ["standa… |
| transmissions | array | — | Entity refs in the "transmission" domain, e.g. ["transmission:automatic"] |
| vehicleTypes | array | — | Entity refs in the "vehicle-type" domain, e.g. ["vehicle-type:passenger-car"] |
| year | object | — | Model year range |
No output schema declared.
No examples provided.