CMD+RVL Receipts
REMOTE · RECEIPTS.CMDRVL.COM
Check claims against current public CMBS filings and NPORT-P coupons, with citations.
Available components
Last scanned (6 hours ago)
Scores higher than 54% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Finance and Payments
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security74
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability62
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2359 tokens (~196/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability check failed: schema churn in the 3 days we've observed: 2 tool removals, 0 breaking changes, 0 auth/transport breaks, 0 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Stability: 0.03 → fail ▼ security
- A breaking change shipped without a version bump: still 0.1.0 ▼ security
- Tool “verify_ending_balance” was removed ▼ security
- Tool “verify_servicer” was removed ▼ security
- The server rewrote its instructions, which are the text every model session reads security
- Tool “coverage” rewrote its description, which is the text the model reads security
- Tool “covered_deals” rewrote its description, which is the text the model reads security
- Tool “find_deals” rewrote its description, which is the text the model reads security
- Tool “quickstart” rewrote its description, which is the text the model reads security
- Tool “verify_appraised_value” rewrote its description, which is the text the model reads security
- Tool “verify_building_size” rewrote its description, which is the text the model reads security
- Tool “verify_claims” rewrote its description, which is the text the model reads security
- Tool “verify_counterparty” rewrote its description, which is the text the model reads security
- Tool “verify_deal_field” rewrote its description, which is the text the model reads security
- Tool “verify_loan_field” rewrote its description, which is the text the model reads security
- Schema quality: 176 → 196 ▼ functional
- Tool coverage: 95% → 100% ▲ functional
- 3 Nov 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “coverage” rewrote its description, which is the text the model reads security
- Tool “covered_deals” rewrote its description, which is the text the model reads security
- Tool “find_deals” rewrote its description, which is the text the model reads security
- Tool “verify_appraised_value” rewrote its description, which is the text the model reads security
- Tool “verify_building_size” rewrote its description, which is the text the model reads security
- Tool “verify_claims” rewrote its description, which is the text the model reads security
- Tool “verify_counterparty” rewrote its description, which is the text the model reads security
- Tool “verify_deal_field” rewrote its description, which is the text the model reads security
- Tool “verify_ending_balance” rewrote its description, which is the text the model reads security
- Tool “verify_fund_holding_coupon” rewrote its description, which is the text the model reads security
- Tool “verify_loan_field” rewrote its description, which is the text the model reads security
- Tool “verify_loan_status_counts” rewrote its description, which is the text the model reads security
- Schema quality: 310 → 176 ▲ functional
- Stability: unverified → 0.03 ▲ functional
- “verify_deal_field” reworded the description of “field” cosmetic
- “verify_loan_field” reworded the description of “field” cosmetic
- 2 Nov 26 68
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://receipts.cmdrvl.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=cmdrvl.com | CN=Amazon RSA 2048 M01,O=Amazon,C=US | 28 Oct 2026 | 13 May 2027 | RSA 2048 | SHA256-RSA | dca4059027bddcdb03c19932cd23396 |
| SANs: cmdrvl.com, *.cmdrvl.com | ||||||
| CN=Amazon RSA 2048 M01,O=Amazon,C=US (CA) | CN=Amazon Root CA 1,O=Amazon,C=US | 23 Aug 2022 | 23 Aug 2030 | RSA 2048 | SHA256-RSA | 77312380b9d6688a33b1ed9bf9ccda68e0e0f |
| CN=Amazon Root CA 1,O=Amazon,C=US (CA) | CN=Starfield Services Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US | 25 May 2015 | 31 Dec 2037 | RSA 2048 | SHA256-RSA | 67f944a2a27cdf3fac2ae2b01f908eeb9c4c6 |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of receipts.cmdrvl.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| cmdrvl.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://receipts.cmdrvl.com/mcp | Verified | 200 | |
| http (plaintext) | http://receipts.cmdrvl.com/mcp | HTTPS enforced | 301 | https://receipts.cmdrvl.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
coverage Coverage — what this server can and cannot verify ~96
What this server covers: deals and loans against the universe, the field inventory with full bound definitions, counterparty roles, current-only scope, and dual-sourced agreement stats (single-source reported separately). An OUT_OF_COVERAGE answer means the deal or field is outside this coverage; UNVERIFIED means it is covered but could not be confirmed. Contact cairn@cmdrvl.com for deeper coverage, history, bonds, entitlements.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| bonds | – | yes | – |
| confirmation_breakdown | – | yes | – |
| confirmation_breakdown_note | string|null | yes | – |
| confirmation_statistics | – | yes | – |
| contact | – | yes | – |
| counterparty_roles | array | yes | – |
| coverage_source | string | yes | – |
| deals | object | yes | covered, named, fully_confirmed_ever, edgar_cmbs_universe. |
| fields | array | yes | Per field: field, grain, receipts, field_definition (the full bound definition). |
| generated_at | string|null | yes | – |
| limits | – | yes | – |
| loans | object | yes | – |
| securities | – | yes | – |
| temporal | – | yes | – |
No examples provided.
covered_deals Covered deals ~38
List every deal this server can verify, with CIKs, aliases and filing periods. Returns the full covered set, which can be long.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| deals | array | yes | – |
| field | string | yes | – |
No examples provided.
find_deals Find covered deals ~122
Search covered deals by id, trust name, CIK, alias, shelf, vintage or deal_ref. An EXACT query returns one dominant result. A fuzzy query returns a small ranked set with match reasons, periods and a suggested next call. Returns at most the requested number of matches.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum ranked candidates to return (default 5; 10 on the builtin fallback; max 25). |
| query | string | yes | Deal name, ticker-style id, CIK, alias, shelf/vintage fragment, or deal_ref to search. |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| limit | number | yes | – |
| matches | array | yes | Deal id, cik, name, shelf, vintage, aliases, score. |
| message | string | yes | – |
| next_actions | array | yes | – |
| query | string | yes | – |
| search_backend | – | – | – |
| total_matches | number | yes | – |
| truncated | boolean | yes | – |
No examples provided.
quickstart Quickstart capability manifest ~74
Compact capability manifest for clients: purpose, workflow, routing table, examples, vocabulary guard, scope caveats, next actions, and contact. A short, low-token summary of what this server does and what it returns.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | Default summary. Use routing for tool selection guidance, examples for more call examples. |
| Name | Type | Req | Description |
|---|---|---|---|
| caveats | array | yes | – |
| compact | boolean | yes | – |
| contact | string | yes | – |
| current_scope | string | yes | – |
| examples | array | yes | Worked calls: task plus {tool, arguments}. |
| next_actions | array | yes | – |
| purpose | string | yes | – |
| schemas | object | yes | sf-receipt v0: profile, version, schema_uri, context_uri, human_docs. |
| server | string | yes | – |
| tools | array | yes | Routing table: name, when_to_use, required_args, returns. |
| vocabulary | array | yes | term, meaning. |
| workflow | array | yes | – |
No examples provided.
verify_appraised_value Verify issuance appraised value ~146
Verify issuance appraised value (Annex A vs ABS-EE). Date/basis mismatches return DATE_INCOMMENSURATE or BASIS_INCOMMENSURATE, not CONFLICT/DENY. A deal or loan outside coverage returns OUT_OF_COVERAGE.
| Name | Type | Req | Description |
|---|---|---|---|
| claimed_basis | string | – | Optional valuation basis. |
| claimed_value | number|string | – | Claim to receipt. Required. |
| claimed_value_date | string | – | Optional valuation date. |
| deal | string | yes | Deal name or alias, e.g. 'WFCM 2020-C58'. |
| loan_id | string | yes | Loan / entity id within the deal, e.g. '25'. |
| Name | Type | Req | Description |
|---|---|---|---|
| as_of | string|null | yes | – |
| claim | object | yes | Adjudication: claimed_value, tolerance_*, within_tolerance, rationale. |
| claim_verdict | string | yes | Caller-claim verdict; DENY only here. |
| message | string | yes | – |
| receipt | object | yes | sf-receipt 0.3; schema https://cmdrvl.com/schemas/sf-receipt/v0/schema.json; context https://cmdrvl.com/contexts/obs-receipt/v0/context.json |
| resolved_deal | object | yes | Deal resolution: matched, id, cik, candidates. |
No examples provided.
verify_building_size Verify issuance building size ~138
Verify issuance building size (Annex A vs ABS-EE). Units matter: mismatched units return receipt status UNITS_INCOMMENSURATE, not CONFLICT/DENY. A deal or loan outside coverage returns OUT_OF_COVERAGE.
| Name | Type | Req | Description |
|---|---|---|---|
| claimed_unit | string | – | Optional unit, e.g. square_feet or units. |
| claimed_value | number|string | – | Claim to receipt. Required. |
| deal | string | yes | Deal name or alias, e.g. 'WFCM 2020-C58'. |
| loan_id | string | yes | Loan / entity id within the deal, e.g. '25'. |
| Name | Type | Req | Description |
|---|---|---|---|
| as_of | string|null | yes | – |
| claim | object | yes | Adjudication: claimed_value, tolerance_*, within_tolerance, rationale. |
| claim_verdict | string | yes | Caller-claim verdict; DENY only here. |
| message | string | yes | – |
| receipt | object | yes | sf-receipt 0.3; schema https://cmdrvl.com/schemas/sf-receipt/v0/schema.json; context https://cmdrvl.com/contexts/obs-receipt/v0/context.json |
| resolved_deal | object | yes | Deal resolution: matched, id, cik, candidates. |
No examples provided.
verify_claims Verify every checkable claim in a text (bulk) ~247
Bulk verifier: paste text, get per-claim statuses. ASSERTIONS ONLY: a QUESTION ('is it $9.4M?') binds nothing and returns total 0; single-value questions are not claims and are not checked here. Deterministic grammar, four families: loan fields, pool fields, servicer identity, loan-status counts. Unparsed text is listed in unchecked_spans, never dropped. EXACT deal references (id, alias, CIK) work best; matching is never fuzzy. Statuses (verified / contradicted / insufficient_evidence / out_of_scope) are answers, not errors. Each claim has a claim_id, citations and a confidence.
| Name | Type | Req | Description |
|---|---|---|---|
| deal_hint | string | – | Fallback deal context when a sentence names no deal (exact resolution only). |
| period_hint | string | – | YYYY-MM annotation only — latest-only server; a mismatch is noted and drops confidence one tier. |
| risk_tolerance | string | – | Default normal = max(ledger tolerance, stated precision); strict = ledger only; lenient = 2x stated precision. Counts and names are always exact. |
| text | string | yes | The paragraph / memo excerpt to check. |
| Name | Type | Req | Description |
|---|---|---|---|
| claims | array | yes | Per claim: normalized_claim, citations, notes, recommended_language. |
| material_issues | array | yes | – |
| search_backend | – | yes | – |
| summary | object | yes | Counts: total, verified, contradicted, insufficient_evidence, out_of_scope. |
| tool_version | string | yes | – |
| unchecked_spans | array | yes | Text no grammar rule could check, with reason and hint. |
No examples provided.
verify_counterparty Verify a deal counterparty (roster) ~169
Adjudicate 'who is the <role> on deal X' against the SEC 10-D counterparty roster (today: master and special servicer). A SINGLE-SOURCE roster fact. Master is the roster party, NOT the ABS-EE tape's primary servicer. Pass claimed_name: CONFIRM/DENY under the ledger's name normalization, never fuzzy. Says WHO the party is, not that a loan is in special servicing. Unknown deal or role: OUT_OF_COVERAGE.
| Name | Type | Req | Description |
|---|---|---|---|
| claimed_name | string | – | Name to adjudicate (normalized comparison). |
| deal | string | yes | Deal name or alias, e.g. 'WFCM 2020-C58'. |
| role | string | – | Default special_servicer. Full definitions ride each receipt's field_definition. |
| Name | Type | Req | Description |
|---|---|---|---|
| as_of | string|null | yes | – |
| claim | object | yes | Adjudication: claimed_value, tolerance_*, within_tolerance, rationale. |
| claim_verdict | string | yes | Caller-claim verdict; DENY only here. |
| message | string | yes | – |
| receipt | object | yes | sf-receipt 0.3; schema https://cmdrvl.com/schemas/sf-receipt/v0/schema.json; context https://cmdrvl.com/contexts/obs-receipt/v0/context.json |
| resolved_deal | object | yes | Deal resolution: matched, id, cik, candidates. |
No examples provided.
verify_deal_field Verify a deal-grain (pool) field ~259
Verify one pool-level field of a deal: the ABS-EE loan-tape rollup against the 10-D trustee's reported fact. These are COLLATERAL (loan-pool) balances and flows, NOT bond or certificate balances, and SCHEDULED and ACTUAL are different fields. No loan_id. Always the CURRENT period. Pass claimed_value; no claim: UNVERIFIED; an unknown deal or field: OUT_OF_COVERAGE.
| Name | Type | Req | Description |
|---|---|---|---|
| claimed_value | number|string | – | Claim to receipt. Required: no claim = refusal, no value. |
| deal | string | yes | Deal name or alias, e.g. 'WFCM 2020-C58'. |
| field | string | yes | The deal-grain (pool) field to verify. One of (full definitions: coverage, or the receipt's field_definition): • beginning_scheduled_collateral_balance — pool SCHEDULED collateral balance at period s… |
| Name | Type | Req | Description |
|---|---|---|---|
| as_of | string|null | yes | – |
| claim | object | yes | Adjudication: claimed_value, tolerance_*, within_tolerance, rationale. |
| claim_verdict | string | yes | Caller-claim verdict; DENY only here. |
| message | string | yes | – |
| receipt | object | yes | sf-receipt 0.3; schema https://cmdrvl.com/schemas/sf-receipt/v0/schema.json; context https://cmdrvl.com/contexts/obs-receipt/v0/context.json |
| resolved_deal | object | yes | Deal resolution: matched, id, cik, candidates. |
No examples provided.
verify_fund_holding_coupon Verify NPORT cross-filer fund-holding coupon ~221
Verify the NPORT cross-filer annualized coupon rate (annualized_rate) for one security identifier. Security-grain, N-source receipt: citations are peer NPORT-P filings by registrant CIK, dissenters included. CURRENT-ONLY (latest NPORT period exported). Ticker matches are not unique: set require_hard_identifier=true when a claim needs ISIN, CUSIP or other hard identity.
| Name | Type | Req | Description |
|---|---|---|---|
| as_of | string | – | Optional NPORT period guard (YYYY-MM). The public corpus is latest-period-per-security, not historical. |
| claimed_value | number|string | – | Claim to receipt. Required: no claim = refusal, no value. |
| identifier | string | yes | Security identifier to look up: ISIN, CUSIP, other identifier, or ticker. |
| require_hard_identifier | boolean | – | When true, exclude ticker-sourced matches because tickers are not unique hard identifiers. |
| security_id_source | string | – | Optional source filter. Default any. Use ticker only for ticker-sourced matches. |
| Name | Type | Req | Description |
|---|---|---|---|
| as_of | string|null | yes | – |
| claim | object | yes | – |
| claim_verdict | string | yes | Caller-claim verdict; DENY only here. |
| message | string | yes | – |
| receipt | object | yes | sf-receipt 0.3; schema https://cmdrvl.com/schemas/sf-receipt/v0/schema.json; context https://cmdrvl.com/contexts/obs-receipt/v0/context.json |
| resolved_security | object | yes | Security resolution: matched, security_id, hard_identifier, candidates. |
No examples provided.
verify_loan_field Verify a loan-grain field ~349
Verify one loan-grain field of a CMBS loan against the SEC 10-D and ABS-EE filings. Values are TRUST-LEVEL (this trust's piece, not the whole loan). Always the CURRENT period; the receipt stamps its as-of. Pass claimed_value: you get CONFIRM / DENY / CONFLICT / UNVERIFIED plus an sf-receipt. No claim: UNVERIFIED. An unknown deal, loan or field: OUT_OF_COVERAGE.
| Name | Type | Req | Description |
|---|---|---|---|
| claimed_value | number|string | – | Claim to receipt (number, or date string for paid_through_date). Required: no claim = refusal, no value. |
| deal | string | yes | Deal name or alias, e.g. 'WFCM 2020-C58' or 'Wells Fargo 2020-C58'. |
| field | string | yes | The loan-grain field to verify. One of (full definitions: coverage, or the receipt's field_definition): • beginning_balance — trust-level SCHEDULED balance at period start • ending_balance — trust-le… |
| loan_id | string | yes | Loan / entity id within the deal, e.g. '25'. |
| Name | Type | Req | Description |
|---|---|---|---|
| as_of | string|null | yes | – |
| claim | object | yes | Adjudication: claimed_value, tolerance_*, within_tolerance, rationale. |
| claim_verdict | string | yes | Caller-claim verdict; DENY only here. |
| message | string | yes | – |
| receipt | object | yes | sf-receipt 0.3; schema https://cmdrvl.com/schemas/sf-receipt/v0/schema.json; context https://cmdrvl.com/contexts/obs-receipt/v0/context.json |
| resolved_deal | object | yes | Deal resolution: matched, id, cik, candidates. |
No examples provided.
verify_loan_status_counts Verify a deal's loan-status counts (derived) ~214
Verify count claims over loan status ('N in special servicing / paid off / defeased') for a deal. Counts are DERIVED from the ABS-EE tape, not reported by any filing. Three grains, never mixed: activity (active, resolved_paid_off, defeased); servicing: in_special_servicing = loans CURRENTLY with the special servicer (the count for 'N in special servicing'; it OVERLAPS active, never sum); resolution reason (resolved_via_special_servicing and other payoff reasons) = loans that already LEFT the pool, NOT current counts. Pass `claimed` for exact per-status adjudication. Uncovered deal: UNVERIFIED.
| Name | Type | Req | Description |
|---|---|---|---|
| claimed | object | – | Optional claimed per-status counts, e.g. {"in_special_servicing": 10, "defeased": 2}. Each is adjudicated by EXACT match against the derived count. |
| deal | string | yes | Deal name or alias, e.g. 'WFCM 2020-C58'. |
| Name | Type | Req | Description |
|---|---|---|---|
| as_of | string|null | yes | – |
| claim_verdict | string | yes | – |
| message | string | yes | – |
| resolved_deal | object | yes | – |
| statuses | array | yes | Per status: status, grain, count, claimed, claim_verdict, receipt. |
No examples provided.
How do I install the CMD+RVL Receipts MCP server?
CMD+RVL Receipts is a hosted endpoint at https://receipts.cmdrvl.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · receipts.cmdrvl.com
claude mcp add --transport http com-cmdrvl-receipts 'https://receipts.cmdrvl.com/mcp'
What is the CMD+RVL Receipts MCP server?
CMD+RVL Receipts is an MCP server listed in the public MCP registry as com.cmdrvl/receipts. Check claims against current public CMBS filings and NPORT-P coupons, with citations. This page covers its hosted endpoint (https://receipts.cmdrvl.com/mcp).
Is the CMD+RVL Receipts MCP server safe to use?
CMD+RVL Receipts scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the CMD+RVL Receipts MCP server expose?
CMD+RVL Receipts exposes 12 tools: quickstart, coverage, find_deals, covered_deals, verify_loan_field, and 7 more. Their descriptions and schemas cost roughly 2,073 tokens of context every time the server is loaded.
Does the CMD+RVL Receipts MCP server require authentication?
No. We connected to CMD+RVL Receipts without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the CMD+RVL Receipts MCP server still maintained?
CMD+RVL Receipts is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.