io.github.arturogarrido/claudinho
NPM · @CLAUDINHO/MCP · SCANNED SEP 20
Live 2026 World Cup scores, fixtures & standings for your AI agent. No keys. Unofficial fan project.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to arturogarrido/claudinho). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 3 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability81
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2187 tokens (~243/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.arturogarrido/claudinho MCP server?
io.github.arturogarrido/claudinho runs locally as an npm package, launched with npx -y @claudinho/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @claudinho/mcp
claude mcp add arturogarrido-claudinho -- npx -y @claudinho/mcp
{
"mcpServers": {
"arturogarrido-claudinho": {
"command": "npx",
"args": [
"-y",
"@claudinho/mcp"
]
}
}
} {
"servers": {
"arturogarrido-claudinho": {
"command": "npx",
"args": [
"-y",
"@claudinho/mcp"
]
}
}
} codex mcp add arturogarrido-claudinho -- npx -y @claudinho/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"arturogarrido-claudinho": {
"type": "local",
"command": [
"npx",
"-y",
"@claudinho/mcp"
],
"enabled": true
}
}
} openclaw mcp add arturogarrido-claudinho --command npx --arg -y --arg @claudinho/mcp
mcp_servers:
arturogarrido-claudinho:
command: "npx"
args: ["-y", "@claudinho/mcp"] {
"McpServers": {
"arturogarrido-claudinho": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@claudinho/mcp"
]
}
}
} assistant mcp add arturogarrido-claudinho -t stdio -c npx -a -y @claudinho/mcp
{
"mcpServers": {
"arturogarrido-claudinho": {
"command": "npx",
"args": [
"-y",
"@claudinho/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
- Security disclosure: unverified → pass ▲ functional
- 18 Sept 26 0
- Security disclosure: pass → unverified ▼ functional
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −3
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Stability: pass → 0.80 functional
- Package version: 0.10.0 → 0.10.1 functional
- 15 Sept 26 +26
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Stability: 0.97 → pass security
- Dependency health: unverified → 0.84 ▲ functional
- 14 Sept 26 −25
- Stability: 0.93 → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Known CVEs: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Dependency health: 0.84 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 0.9.4 → 0.10.0 functional
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 −2
- Stability: pass → 0.83 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@claudinho/mcp@0.10.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | arturogarrido/claudinho |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/arturogarrido/claudinho/.github/workflows/publish.yml@refs/tags/v0.10.1 |
| Rekor log index | 2865176107 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:edc3cda13f0e522c6753bd1856a52d19f5cca0734f81320a4b5b6b542996d6ef233488f220c5326a5424eccf284c9a13fbf8b36748f293fccb02a63d2 |
Background: How many MCP packages publish verified provenance →
Dependencies 95 packages
| Packages resolved | 95 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_bracket Knockout bracket ~183
Knockout bracket from the Round of 32 through the final, with live scores overlaid. Group slots project from live standings once a group has started; winner slots need a confirmed FT result. Pass an optional stage (R32, R16, QF, SF, 3P, F) to filter one round. Falls back to structure-only when live data is unavailable.
| Name | Type | Req | Description |
|---|---|---|---|
| flavor | string | – | Commentary flair: off, subtle, full (default: full) |
| lang | string | – | Locale for dates, provider attribution, and commentary: en, es, pt, fr (the summary scaffold stays English; other locales fall back to en) |
| stage | string | – | Knockout round to show (omit for the full bracket) |
| tz | string | – | IANA timezone for kickoff times, e.g. America/Mexico_City |
| Name | Type | Req | Description |
|---|---|---|---|
| degraded | boolean | – | – |
| responseTruncated | boolean | – | – |
| responseTruncation | string | – | – |
| source | string|null | – | – |
| standingsDegraded | boolean | – | – |
| view | – | yes | – |
No examples provided.
get_live Live matches ~137
Only matches in play right now — each with current score and minute (empty when nothing is live). Use during matches for in-play state; for a full day's schedule including upcoming and finished, use get_today. tz/lang/flavor affect formatting only.
| Name | Type | Req | Description |
|---|---|---|---|
| flavor | string | – | Commentary flair: off, subtle, full (default: full) |
| lang | string | – | Locale for dates, provider attribution, and commentary: en, es, pt, fr (the summary scaffold stays English; other locales fall back to en) |
| tz | string | – | IANA timezone for kickoff times, e.g. America/Mexico_City |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| degraded | boolean | yes | – |
| matches | array | yes | – |
| responseTruncated | boolean | – | – |
| responseTruncation | string | – | – |
| source | string|null | yes | – |
| truncated | boolean | yes | – |
No examples provided.
get_market_signal Prediction-market signal ~253
Read-only prediction-market signals for a match (by id), a team's current-or-next fixture, or a date (default: today). Returns market-implied percentages with attribution; complete:false means the provider read was incomplete, not that no signal exists. Shown only before and during a match — finished matches have no market read. Informational only — relay the numbers factually; do not add betting, trading, or 'value' advice, and do not invent links.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date as YYYY-MM-DD (default: today) for all that day's signals |
| flavor | string | – | Commentary flair: off, subtle, full (default: full) |
| lang | string | – | Locale for dates, provider attribution, and commentary: en, es, pt, fr (the summary scaffold stays English; other locales fall back to en) |
| matchId | string | – | Match id (most specific) |
| team | string | – | 3-letter team code, e.g. MEX — resolves to the team's in-play match when one is live, else their next fixture |
| tz | string | – | IANA timezone for kickoff times, e.g. America/Mexico_City |
| Name | Type | Req | Description |
|---|---|---|---|
| complete | boolean | – | False when the market provider did not complete every relevant read |
| count | number | – | – |
| date | string | – | – |
| degraded | boolean | – | – |
| informationalOnly | boolean | yes | – |
| matchId | string|null | – | – |
| responseTruncated | boolean | – | – |
| responseTruncation | string | – | – |
| signal | – | – | – |
| signals | array | – | – |
| team | string | – | – |
| truncated | boolean | – | – |
No examples provided.
get_match Match detail ~166
One match by its id, with live score/minute overlaid when it's in play. Optional prediction-market enrichment carries marketComplete; false means the read was incomplete, not that no signal exists. Get the id from get_today or get_live; to find a team's match without an id, use get_next_fixture. tz/lang/flavor affect formatting.
| Name | Type | Req | Description |
|---|---|---|---|
| flavor | string | – | Commentary flair: off, subtle, full (default: full) |
| id | string | yes | Match id |
| lang | string | – | Locale for dates, provider attribution, and commentary: en, es, pt, fr (the summary scaffold stays English; other locales fall back to en) |
| tz | string | – | IANA timezone for kickoff times, e.g. America/Mexico_City |
| Name | Type | Req | Description |
|---|---|---|---|
| degraded | boolean | – | – |
| marketComplete | boolean | – | False when optional market enrichment did not check this fixture |
| marketSignal | – | – | – |
| match | – | yes | – |
| responseTruncated | boolean | – | – |
| responseTruncation | string | – | – |
| source | string|null | – | – |
No examples provided.
get_next_fixture Next fixture for a team ~169
A team's next match, live-resolved: a confirmed knockout tie (Round of 32 onward) is read from the live overlay, group fixtures from the bundled schedule. Use a 3-letter code, e.g. MEX, BRA, USA. Falls back to the bundled schedule if the provider is unreachable.
| Name | Type | Req | Description |
|---|---|---|---|
| flavor | string | – | Commentary flair: off, subtle, full (default: full) |
| lang | string | – | Locale for dates, provider attribution, and commentary: en, es, pt, fr (the summary scaffold stays English; other locales fall back to en) |
| team | string | yes | 3-letter team code, e.g. MEX |
| tz | string | – | IANA timezone for kickoff times, e.g. America/Mexico_City |
| Name | Type | Req | Description |
|---|---|---|---|
| degraded | boolean | yes | – |
| fixture | – | yes | – |
| responseTruncated | boolean | – | – |
| responseTruncation | string | – | – |
| source | string|null | yes | – |
| team | string | yes | – |
No examples provided.
get_share_snippet Shareable match snippet ~409
A polished, copy-pasteable card (plain text) for a match (matchId), a team's next fixture (team), a group's standings table (group, e.g. "A"), the knockout bracket (bracket: true), a date (default: today), or live matches (live: true). Returns the ready-to-paste snippet plus structured data — hand the snippet text to the user verbatim. marketComplete:false is stated inside the card as an incomplete optional read. No links; it carries a non-affiliation disclaimer, and any market line stays informational only.
| Name | Type | Req | Description |
|---|---|---|---|
| bracket | boolean | – | Knockout bracket card (use with optional knockoutStage) |
| date | string | – | Date as YYYY-MM-DD (default: today) |
| flavor | string | – | Commentary flair: off, subtle, full (default: full) |
| group | string | – | Group letter A–L for a standings card, e.g. A |
| includeHashtag | boolean | – | Include the #VibingLaVidaLoca tag (default true) |
| includeInstallLine | boolean | – | Include the "Try it: …" run cue (default true) |
| includeMarkets | boolean | – | Include the reliable market line when available (default true) |
| knockoutStage | string | – | Filter the bracket card to one round |
| lang | string | – | Locale for dates, provider attribution, and commentary: en, es, pt, fr (the summary scaffold stays English; other locales fall back to en) |
| live | boolean | – | Snapshot of matches in play right now |
| matchId | string | – | Match id (most specific) |
| style | string | – | social (default, full card) or compact (one line per match) |
| team | string | – | 3-letter team code for that team's next fixture, e.g. MEX |
| tz | string | – | IANA timezone for kickoff times, e.g. America/Mexico_City |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | – |
| degraded | boolean | – | – |
| group | string | – | – |
| informationalOnly | boolean | – | – |
| kind | string | yes | – |
| marketComplete | boolean | – | False when optional market enrichment did not check every relevant fixture |
| marketSignals | object | – | – |
| matches | array | – | – |
| responseTruncated | boolean | – | – |
| responseTruncation | string | – | – |
| snippet | string | – | – |
| source | string|null | – | – |
| stage | string | – | – |
| style | string | – | – |
| tables | – | – | – |
| target | string | – | – |
| team | string | – | – |
| truncated | boolean | – | – |
| view | – | – | – |
No examples provided.
get_standings Group standings ~186
Live cumulative group standings — pass a group letter A–L, or omit for all 12. Returns ranked rows (team, played, W/D/L, goal difference, points). Use get_today for fixtures/scores and get_next_fixture for one team. If unavailable, the default World Cup scope returns a roster at zero; competitions without a compatible bundled roster return no tables. Both are flagged degraded.
| Name | Type | Req | Description |
|---|---|---|---|
| flavor | string | – | Commentary flair: off, subtle, full (default: full) |
| group | string | – | Group letter A–L (omit for all) |
| lang | string | – | Locale for dates, provider attribution, and commentary: en, es, pt, fr (the summary scaffold stays English; other locales fall back to en) |
| tz | string | – | IANA timezone for kickoff times, e.g. America/Mexico_City |
| Name | Type | Req | Description |
|---|---|---|---|
| degraded | boolean | yes | – |
| responseTruncated | boolean | – | – |
| responseTruncation | string | – | – |
| source | string|null | yes | – |
| tables | – | yes | – |
No examples provided.
get_team Resolve a team ~164
Resolve a nation name or 3-letter code to its FIFA code, flag, and group. Fuzzy and forgiving: accepts "Mexico", "mex", "USA", "DR Congo", "Türkiye"/"Turkey", "Holland", etc. Use this FIRST to turn a user's team name into the code the other tools need (get_next_fixture, get_standings, get_market_signal, get_share_snippet). Returns the single confident match (team), plus candidates (matches) when the query is ambiguous (e.g. "south" → South Africa, South Korea). Offline — reads the bundled roster, never the network.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | Team name or 3-letter code, e.g. "Mexico", "MEX", "DR Congo" |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| matches | array | yes | – |
| query | string | yes | – |
| responseTruncated | boolean | – | – |
| responseTruncation | string | – | – |
| team | – | yes | – |
No examples provided.
get_today Today's matches ~210
All fixtures for a date (default: today), with live score and minute overlaid on any match in play. Optional prediction-market enrichment carries marketComplete; false means the read was incomplete, not that no signal exists. Use this for a whole day's card; for only in-play matches use get_live, for one team's match use get_next_fixture, for a single match's detail use get_match. Kickoffs render in tz; lang localizes dates, attribution, and commentary (en/es/pt/fr); flavor sets commentary tone.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date as YYYY-MM-DD (default: today) |
| flavor | string | – | Commentary flair: off, subtle, full (default: full) |
| lang | string | – | Locale for dates, provider attribution, and commentary: en, es, pt, fr (the summary scaffold stays English; other locales fall back to en) |
| tz | string | – | IANA timezone for kickoff times, e.g. America/Mexico_City |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| date | string | yes | – |
| degraded | boolean | yes | – |
| marketComplete | boolean | – | False when optional market enrichment did not check every relevant fixture |
| marketSignals | object | – | – |
| matches | array | yes | – |
| responseTruncated | boolean | – | – |
| responseTruncation | string | – | – |
| source | string|null | yes | – |
| truncated | boolean | yes | – |
No examples provided.
What is the io.github.arturogarrido/claudinho MCP server?
io.github.arturogarrido/claudinho is an MCP server listed in the public MCP registry as io.github.arturogarrido/claudinho. Live 2026 World Cup scores, fixtures & standings for your AI agent. No keys. Unofficial fan project. This page covers its npm package (@claudinho/mcp).
Is the io.github.arturogarrido/claudinho MCP server safe to use?
io.github.arturogarrido/claudinho scores 95 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.arturogarrido/claudinho MCP server expose?
io.github.arturogarrido/claudinho exposes 9 tools: get_today, get_live, get_match, get_standings, get_bracket, and 4 more. Their descriptions and schemas cost roughly 1,877 tokens of context every time the server is loaded.
Is the io.github.arturogarrido/claudinho MCP server still maintained?
io.github.arturogarrido/claudinho is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.arturogarrido/claudinho MCP server under?
io.github.arturogarrido/claudinho declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.