{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T17:40:00.343Z","url":"https://verifymcp.io/servers/coffee-pwned-pwned-coffee/pwned","markdownUrl":"https://verifymcp.io/servers/coffee-pwned-pwned-coffee/pwned.md","server":{"slug":"coffee-pwned-pwned-coffee","name":"pwned.coffee","registryName":"coffee.pwned/pwned-coffee","description":"Live security incidents, updated hourly: fix status, fixed versions, lockfile and repo checks.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"pwned","type":"remote","identifier":"https://pwned.coffee/mcp","withdrawn":false,"url":"https://verifymcp.io/servers/coffee-pwned-pwned-coffee/pwned","version":"1.0.0","transport":null,"scoredAt":"2026-11-05T09:14:16.239Z"},"score":{"total":65,"tier":"medium","status":"scored","weekDelta":null,"history":[{"date":"2026-11-05","total":65},{"date":"2026-11-04","total":65},{"date":"2026-11-03","total":64},{"date":"2026-11-02","total":64}]},"categories":[{"name":"Endpoint Security","score":57,"verdict":"fail","reasons":["The endpoint's TLS certificate is valid, in date, and uses a strong key.","Authorisation not fully verified: no authorisation is required to call this server, and 1 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.","HTTPS is enforced; there's no plaintext access path.","HSTS check failed: the Strict-Transport-Security header is absent.","DNSSEC check failed: this domain isn't protected by DNSSEC."],"codes":[{"code":"tls.valid","args":{}},{"code":"auth.none_undeclared","args":{"undeclared_tools":"1"}},{"code":"https.enforced","args":{}},{"code":"headers.hsts_absent","args":{}},{"code":"dnssec.absent","args":{}}]},{"name":"Transport & Reachability","score":100,"verdict":"pass","reasons":["Verified streamable-http transport via a live MCP handshake."],"codes":[{"code":"transport.verified","args":{"transport":"streamable-http"}}]},{"name":"Schema Quality & AI Usability","score":81,"verdict":"fail","reasons":["100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).","AI-judged instruction clarity (good).","Context-footprint check failed: tool/resource definitions use about 879 tokens (~146/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.descriptions","args":{"pct":"100"}},{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_heavy","args":{"avg":"146","items":"6","tools":"6","tokens":"879","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":10,"verdict":"partial","reasons":["Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"3"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":75,"verdict":"fail","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; \"check_repo\" implies \"send\" and declares readOnlyHint instead, contradicting what its own name says it does.","An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_undeclared","args":{"pct":"0","tool":"check_repo","verb":"send","declared":"read_only","annotated":"0","destructive":"1"}},{"code":"toolsafety.manipulation_clean","args":{"units":"7","judged":"7"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":["Authorisation not fully verified: no authorisation is required to call this server, and 1 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe."],"malware":[],"components":[{"slug":"pwned","type":"remote","identifier":"https://pwned.coffee/mcp","withdrawn":false,"score":65,"current":true,"url":"https://verifymcp.io/servers/coffee-pwned-pwned-coffee/pwned","markdownUrl":"https://verifymcp.io/servers/coffee-pwned-pwned-coffee/pwned.md"}],"facts":[{"label":"Endpoint","value":"https://pwned.coffee/mcp"},{"label":"Transports","value":"streamable-http"},{"label":"Auth","value":"none"},{"label":"Version","value":"1.0.0"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"todays_specials","title":"Today's specials","description":"Live security incidents right now (CVEs, breaches, supply-chain compromises) with severity, patch status, fixed versions and ids. Pass stack ids to see only what touches your stack. Known ids: nextjs, react, node, bun, php, python, ruby, go, java, wordpress, drupal, magento, perl, proof-tools, dotnet, rust, npm, pypi, github-actions, docker, vscode, browser-ext, linux, linux-services, openssh, nginx, apache, kubernetes, postgres, mysql, redis, gitlab, ci, atlassian, self-hosted, selfhost-apps, paas, cloudflare, aws, gcp, azure, vps, databases-cloud, ai-gateways, ai-keys, ml-infra, mcp, chrome, apple, android, windows, office, password-managers, messaging, crypto-wallets, vpn-edge, ics, remote-support, vmware, security-tools, health-it, erp.","inputs":[{"name":"stack","type":"array","required":false,"description":"Stack ids to filter by, e.g. [\"nextjs\",\"npm\"]. Omit for everything."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":243},{"name":"lookup_cve","title":"Look up a CVE","description":"The incident covering a CVE or GHSA id, or a named bug (e.g. HTTP2Shell): summary, severity, patch status, fixed versions, timeline and sources.","inputs":[{"name":"id","type":"string","required":true,"description":"e.g. CVE-2026-12345, GHSA-xxxx-xxxx-xxxx or HTTP2Shell"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":77},{"name":"check_lockfile","title":"Check a lockfile","description":"Match the packages and versions in a lockfile against incidents that state fixed versions, and print a receipt: what you use, the version, affected or not, and the exact upgrade. Accepts package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, composer.lock, go.sum, go.mod, Cargo.lock, Gemfile.lock, a Dockerfile, an .nvmrc / .node-version (\"node\") or a GitHub Actions workflow (\"actions\"). For several files at once, use check_repo.","inputs":[{"name":"content","type":"string","required":true,"description":"The lockfile text, as-is."},{"name":"ecosystem","type":"string","required":false,"description":"Which reader to use. \"auto\" detects from the content. \"node\" is an .nvmrc or .node-version file, \"actions\" a GitHub Actions workflow."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":181},{"name":"check_repo","title":"Check a whole repo","description":"Send the files that describe what a project runs (lockfiles, Dockerfiles, .github/workflows/*.yml, wrangler.toml, vercel.json, next.config.*, compose files) in one call. Returns one receipt: every affected package with the exact command to fix it in the tool the repo already uses, actions and images to check, and live incidents for the detected stack that the files cannot rule out.","inputs":[{"name":"files","type":"array","required":true,"description":"Up to 40 files. Paths matter: they pick the reader and the fix command."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":117},{"name":"whats_new","title":"What's new since","description":"Incidents created or updated since a point in time, newest first. Use it to re-check only what changed since your last run. Accepts \"24h\", \"7d\", \"90m\" or an ISO timestamp.","inputs":[{"name":"since","type":"string","required":true,"description":"\"24h\", \"7d\", or an ISO timestamp like 2026-10-23T08:00:00Z"},{"name":"stack","type":"array","required":false,"description":"Optional stack ids to filter by."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":101},{"name":"diff_since","title":"What changed since, with sources","description":"Every correction, new ticket and fix-status change since a point in time, each with the source behind it (the same log as /corrections). Use it to audit what the board changed since your last run. Accepts an ISO 8601 timestamp, or \"24h\", \"7d\", \"90m\".","inputs":[{"name":"since","type":"string","required":true,"description":"An ISO 8601 timestamp like 2026-10-24T00:00:00Z, or \"24h\", \"7d\""},{"name":"stack","type":"array","required":false,"description":"Optional stack ids to filter by."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":124}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T09:14:16.000Z","track":"remote","endpoint":"https://pwned.coffee/mcp","declaredUrl":null,"truncated":false,"tls":{"outcome":"valid","label":"Valid","version":"TLS 1.3","cipherSuite":"TLS_AES_128_GCM_SHA256","chainError":null,"certificates":[{"subject":"CN=pwned.coffee","issuer":"CN=WE1,O=Google Trust Services,C=US","notBefore":"2026-10-23T10:12:13Z","notAfter":"2027-01-21T11:12:10Z","keyType":"ECDSA","keyBits":256,"isCa":false},{"subject":"CN=WE1,O=Google Trust Services,C=US","issuer":"CN=GTS Root R4,O=Google Trust Services LLC,C=US","notBefore":"2023-12-13T09:00:00Z","notAfter":"2029-02-20T14:00:00Z","keyType":"ECDSA","keyBits":256,"isCa":true},{"subject":"CN=GTS Root R4,O=Google Trust Services LLC,C=US","issuer":"CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE","notBefore":"2023-11-15T03:43:21Z","notAfter":"2028-01-28T00:00:42Z","keyType":"ECDSA","keyBits":384,"isCa":true}]},"dnssec":{"result":"insecure","label":"Not signed","name":"pwned.coffee.","steps":[{"zone":".","outcome":"verified","label":"Verified"},{"zone":"coffee.","outcome":"verified","label":"Verified"},{"zone":"pwned.coffee.","outcome":"insecure_proven","label":"Unsigned (proven)"}]},"auth":{"outcome":"none","label":"No authorisation required","gate":null,"gateLabel":null,"status":200,"authorizationServers":[]},"httpsRedirect":{"outcome":"https_enforced","label":"HTTPS enforced","status":301},"transports":[{"transport":"streamable-http","outcome":"verified","label":"Verified","status":200,"followed":false}],"provenance":null,"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-11-02","recent":[{"id":"chg_01a1a5d1-71fd-7d73-be10-6e584b193fe0","kind":"score.total_changed","summary":"Trust score (64 → 65)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/coffee-pwned-pwned-coffee/pwned#chg-chg_01a1a5d1-71fd-7d73-be10-6e584b193fe0"},{"id":"chg_01a1a0a9-ae21-7d33-a8a5-ec576003883c","kind":"check.reverified","summary":"Stability (unverified → 0.03)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/coffee-pwned-pwned-coffee/pwned#chg-chg_01a1a0a9-ae21-7d33-a8a5-ec576003883c"},{"id":"chg_01a19d34-37f9-7619-b6cc-736c0032b129","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/coffee-pwned-pwned-coffee/pwned#chg-chg_01a19d34-37f9-7619-b6cc-736c0032b129"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/coffee-pwned-pwned-coffee/pwned/changelog.json"},"links":{"html":"https://verifymcp.io/servers/coffee-pwned-pwned-coffee/pwned","markdown":"https://verifymcp.io/servers/coffee-pwned-pwned-coffee/pwned.md","changelogJson":"https://verifymcp.io/servers/coffee-pwned-pwned-coffee/pwned/changelog.json","changelogRss":"https://verifymcp.io/servers/coffee-pwned-pwned-coffee/pwned.xml","external":[{"label":"Remote endpoint","href":"https://pwned.coffee/mcp"},{"label":"Website","href":"https://pwned.coffee/mcp"}]}}