io.github.CHANGCHINFU/mcp-gauge
REMOTE · API.TRUTHBEAR.CO
Verify official facts with Bitcoin-anchored proof. 180+ signals, x402 pay-per-call.
Available components
Last scanned (19 hours ago)
Scores higher than 93% of remote servers
Reachable. Last reached 4 Nov 2026.
Category Search and Retrieval
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability69
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1009 tokens (~201/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Stability: pass → 0.97 functional
- 13 Oct 26 +10
- Transport: fail → pass ▲ security
- 12 Oct 26 −10
- Transport: pass → fail ▼ security
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 19 Sept 26 0
- Stability: 0.97 → pass security
- 13 Sept 26 0
- HSTS header: fail → pass ▲ security
- 7 Sept 26 0
- Schema quality: 789 → 1009 ▼ functional
- New tool “verify_triangular” functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Probed https://api.truthbear.co/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=api.truthbear.co | CN=YE1,O=Let's Encrypt,C=US | 18 Oct 2026 | 16 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 5d4bcb7df5aa6ce2570503105b98f210c4b |
| SANs: api.truthbear.co | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of api.truthbear.co. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| co. | present | 7786 | 8 | Verified |
| truthbear.co. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| content-security-policy | default-src 'none'; frame-ancestors 'none' |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.truthbear.co/mcp | Verified | 200 | |
| http (plaintext) | http://api.truthbear.co/mcp | HTTPS enforced | 302 | https://api.truthbear.co/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
find_signal Find which signals/entities are covered (free) ~135
FREE coverage + freshness manifest: which signal_id lines exist, how many entities each covers, and fresh/recent/stale counts - so you can check "is my entity covered and how fresh" BEFORE paying. Optional filters: industry, signal_id, entity.
| Name | Type | Req | Description |
|---|---|---|---|
| entity | string | – | object id, e.g. a USGS site id |
| full | boolean | – | true = per-entity detail (larger); default compact summary |
| industry | string | – | restrict to one domain, e.g. hydrology, agriculture, energy |
| signal_id | string | – | e.g. hydrology.river-level |
| Name | Type | Req | Description |
|---|---|---|---|
| cache_note | string | – | What the cache does and does not affect. |
| cache_policy | string | – | Cache policy in force. |
| cache_ttl_s | number | – | Cache lifetime of this manifest in seconds. |
| detail | string | – | Present on some failures: the upstream endpoint's own error text. |
| error | string | – | Present only when the call failed; human-readable reason. |
| freshness_rule | string | – | How fresh/recent/stale are decided. |
| freshness_thresholds | object | – | The numeric thresholds behind freshness_rule. |
| nature | string | – | What this manifest is. |
| note | string | – | Screening-level disclaimer. |
| signals | array | – | One entry per signal line. Compact by default; pass full=true for per-entity detail. |
| totals | object | – | signal_ids / industries / distinct_entities / freshness counts across the whole catalogue. |
| update_status_rule | object | – | How on_schedule / overdue / not_published / unknown are decided. |
No examples provided.
get_official_record Get the x402 payment challenge for a paid record ~304
Returns the REAL x402 payment challenge (accepts[]: network / asset / payTo / amount) for the paid endpoint that serves a given signal_id+entity, or any listed endpoint addressed directly by `path`. This tool does NOT deliver paid data and does NOT take payment - MCP has no payment layer. Pay at the returned url with your own x402 client (USDC on Base or Solana, gasless EIP-3009; pay from a plain EOA) and you receive the record directly, with record_hash you can verify offline. This tool only fetches the 402 challenge; it delivers no paid data and collects no payment.
| Name | Type | Req | Description |
|---|---|---|---|
| dim | string | – | which product: full read (gauge) or a single add-on; the price of each is in the 402 challenge this tool returns, never here |
| entity | string | – | which object within that line, e.g. the USGS site id 07010000 |
| path | string | – | Alternative addressing: any listed endpoint path, optionally with its query string (e.g. "/gauge/chokepoint-region?loc=hormuz"). The full list of legal paths is the free /manifest?all=1. Use this for… |
| signal_id | string | – | which signal line, e.g. hydrology.river-level - use find_signal to list them |
| Name | Type | Req | Description |
|---|---|---|---|
| after_payment | string | – | What the paid response carries and how to verify it offline. |
| detail | string | – | Present on some failures: the upstream endpoint's own error text. |
| error | string | – | Present only when the call failed; human-readable reason. |
| expected | string | – | Present on failure: what was expected (an HTTP 402 challenge). |
| got | integer | – | Present on failure: the HTTP status actually returned. |
| hint | string | – | Present on failure: the next thing to try, e.g. find_signal. |
| how_to_pay | string | – | How to sign and send the X-PAYMENT header; pay from a plain EOA. |
| method | string | – | HTTP method to use at pay_at (always GET). |
| note | string | – | Standing statement that this server never takes payment. |
| pay_at | string | – | URL to send the paid GET to. |
| x402_challenge | object | – | The upstream 402 body verbatim: x402Version + accepts[] (scheme / network / asset / payTo / amount). |
No examples provided.
purchase_options How can I actually buy this? (free) ~170
FREE. Ask how to pay for a listed endpoint and get every channel with its REAL status - including the ones that are wired but not open yet. Three channels exist: x402 micropayment (for an agent with a funded USDC wallet on Base), a stateless subscription Bearer token (for a person or team - no wallet, no private key, no account), and a card rail. This tool takes no payment and holds no key; it only tells you which doors exist and which are open today.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | – | A listed endpoint path (e.g. "/gauge/grid-reliability-region") to get its price alongside the channels. Omit it to get the channel list on its own. The full list of legal paths is the free /manifest?… |
| Name | Type | Req | Description |
|---|---|---|---|
| asked_about | string|null | – | the path you asked about, or null if you asked for the channel list on its own |
| detail | string | – | the upstream error text, when there is one |
| endpoint | string | – | always "/buy" - which endpoint answered |
| error | string | – | present only when the buy endpoint could not be reached |
| free_first | string | – | what stays free and how to avoid paying for a lookup with no data |
| note_unknown_path | string | – | present only when asked_about matched no listed endpoint |
| price | string | – | the listed price, present only when asked_about matches a listed endpoint |
| title | string|null | – | the listing title of that endpoint, when it has one |
| ways_to_buy | array | – | every payment channel with its REAL status - including channels that are wired but not open yet |
No examples provided.
verify_citation Verify a Truth Bear record (free) ~107
FREE. Given a record_hash from any Truth Bear record, look it up and recompute the canonical hash server-side, returning whether it is a genuine Truth Bear official record plus a plain-language reverse lookup of what exactly that hash attests. Use this to check a citation you were handed by another agent or document BEFORE relying on it. No payment, no API key.
| Name | Type | Req | Description |
|---|---|---|---|
| record_hash | string | yes | sha256:<64 hex>, or a >=8-hex prefix as posted publicly |
| Name | Type | Req | Description |
|---|---|---|---|
| endpoint | string | – | Always "gauge/verify". |
| entity | string|null | – | Object id the reading is about. |
| error | string | – | Present only when the call failed; human-readable reason. |
| found | boolean | – | Whether a published Truth Bear reading matches this hash. |
| hash_core_version | integer|null | – | Version of the canonical hash core used. |
| how_to_check_a_claimed_value | string | – | Present when found: how to check a value someone claims. |
| is_truth_bear_record | boolean|null | – | true / false, or null when the check could not be run (see undetermined). |
| note | string | – | Screening-level disclaimer. |
| ots_status | string|null | – | Per-record field, unused: individual records are not stamped one by one. Anchoring happens per write-batch - see GET /gauge/anchor?hash= for the Merkle inclusion proof and, once the calendar confirms… |
| recomputed_hash | string|null | – | sha256:<64 hex> recomputed from the stored record. |
| record_status | object|null | – | Three-state disclosure. state="active" for a normal record; a non-active state (e.g. "quarantined") means the record is genuine and its hash still verifies, but we have since flagged it as not fit fo… |
| reverse_lookup | string | – | Plain-language statement of exactly what this hash attests. |
| scope | string | – | What this hash does and does not attest. |
| signal_id | string|null | – | e.g. hydrology.river-level |
| snapshot_date | string|null | – | YYYY-MM-DD of the reading. |
| source_ref | string|null | – | URL of the official source record. |
| undetermined | boolean | – | true when the lookup itself failed (e.g. DB unavailable) - NOT a verdict of "fake". |
| verified | boolean | – | Whether the canonical hash recomputed server-side matches the one supplied. |
No examples provided.
verify_triangular Cross-check a line of official series & recompute the verdict (free) ~220
FREE. Cross-verify one GAUGE interweave line: it returns each official series ("leg") in the line with its own record_hash, current/previous values, expected direction and per-leg minMove deadband, plus a count-style state (directions_matched / direction_mismatch / inverse_consistent / not_comparable / insufficient) and N-of-M. Everything needed to recompute the verdict OFFLINE is in the response - verify each leg hash with verify_citation, then recompute dir=sign(current-previous) with the minMove deadband. Descriptive only: no forecast, no causation, no advice. No payment, no API key.
| Name | Type | Req | Description |
|---|---|---|---|
| entity | string | yes | the object within the line, as US-<ST>, e.g. "US-TX" (case-insensitive). Required. |
| line | string | yes | which interweave line, e.g. "E" (state vs national unemployment) or "F" (drought vs crop). Public demo lines are E and F. |
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | Present on some failures: the upstream endpoint's own error text. |
| entity | string | – | the external contract code, e.g. US-TX. |
| error | string | – | Present only when the call failed; human-readable reason. |
| legs | array | – | one entry per official series in the line. |
| line | string | – | the line code you asked for, e.g. E or F. |
| matched | integer | – | N: how many REQUIRED legs had measured dir === expect this window. |
| nature | string|null | – | neutral English disclosure; may be null. |
| note | string | – | standing disclaimer: direction is observed, not a trend/forecast/causation claim. |
| pair_state | string|null | – | inverse-pair lines (F/FW) only: holds_stress | holds_relief | broken | insufficient | not_comparable; absent/null on other lines. |
| reason | string|null | – | stale | missing_current_or_previous | below_min_move | period_misaligned | no_active_drought | parallel_display | null. |
| required | integer | – | M: number of required legs. The public claim is exactly "N of M moved in the registered direction". |
| snapshot_window | object|null | – | the {from,to} window the legs were read over, or null. |
| state | string | – | directions_matched | direction_mismatch | inverse_consistent | not_comparable | insufficient. A count/observation, NOT an adjudication. |
| statement | string | – | the locked, neutral disclosure sentence with N/M substituted. |
| title | string | – | letter-only title (e.g. "線E"); never a phenomenon name. |
| verify_hint | string | – | exactly how to recompute the state offline from each leg (record_hash + dir=sign(Δ) with minMove deadband). |
No examples provided.
How do I install the io.github.CHANGCHINFU/mcp-gauge server?
io.github.CHANGCHINFU/mcp-gauge is a hosted endpoint at https://api.truthbear.co/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · api.truthbear.co
claude mcp add --transport http changchinfu-mcp-gauge 'https://api.truthbear.co/mcp'
What is the io.github.CHANGCHINFU/mcp-gauge server?
io.github.CHANGCHINFU/mcp-gauge is listed in the public MCP registry as io.github.CHANGCHINFU/mcp-gauge. Verify official facts with Bitcoin-anchored proof. 180+ signals, x402 pay-per-call. This page covers its hosted endpoint (https://api.truthbear.co/mcp).
Is the io.github.CHANGCHINFU/mcp-gauge server safe to use?
io.github.CHANGCHINFU/mcp-gauge scores 86 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.CHANGCHINFU/mcp-gauge server expose?
io.github.CHANGCHINFU/mcp-gauge exposes 5 tools: verify_citation, find_signal, get_official_record, purchase_options, verify_triangular. Their descriptions and schemas cost roughly 936 tokens of context every time the server is loaded.
Does the io.github.CHANGCHINFU/mcp-gauge server require authentication?
No. We connected to io.github.CHANGCHINFU/mcp-gauge without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the io.github.CHANGCHINFU/mcp-gauge server still maintained?
io.github.CHANGCHINFU/mcp-gauge is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.