PeppolStatus
REMOTE · MCP.PEPPOLSTATUS.COM · SCANNED SEP 24
Peppol market intelligence and network monitoring: migrations, provider churn, leads, and uptime.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 62 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability65
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 12933 tokens (~208/item across 62 items; 62 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 62 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 63 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the PeppolStatus MCP server?
PeppolStatus is a hosted endpoint at https://mcp.peppolstatus.com/, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.peppolstatus.com
claude mcp add --transport http com-peppolstatus-api 'https://mcp.peppolstatus.com/'
{
"mcpServers": {
"com-peppolstatus-api": {
"url": "https://mcp.peppolstatus.com/"
}
}
} {
"servers": {
"com-peppolstatus-api": {
"type": "http",
"url": "https://mcp.peppolstatus.com/"
}
}
} [mcp_servers.com-peppolstatus-api] url = "https://mcp.peppolstatus.com/"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-peppolstatus-api": {
"type": "remote",
"url": "https://mcp.peppolstatus.com/",
"enabled": true
}
}
} openclaw mcp add com-peppolstatus-api --url 'https://mcp.peppolstatus.com/' --transport streamable-http
mcp_servers:
com-peppolstatus-api:
url: "https://mcp.peppolstatus.com/" {
"McpServers": {
"com-peppolstatus-api": {
"Transport": "http",
"Url": "https://mcp.peppolstatus.com/"
}
}
} assistant mcp add com-peppolstatus-api -t streamable-http -u 'https://mcp.peppolstatus.com/'
{
"mcpServers": {
"com-peppolstatus-api": {
"type": "http",
"url": "https://mcp.peppolstatus.com/"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 0
- New tool “get_participants_mix” functional
- 19 Sept 26 0
- Schema quality: 176 → 195 ▼ functional
- New tool “get_access_point_roster_mix” functional
- “list_participants” added an optional parameter “not_country” cosmetic
- “list_participants” added an optional parameter “not_entity_type” cosmetic
- “list_participants” added an optional parameter “not_region” cosmetic
- “list_participants” added an optional parameter “not_sector” cosmetic
- “list_participants” added an optional parameter “not_size” cosmetic
- “list_participants” added an optional parameter “not_smp” cosmetic
- “get_adoption” reworded the description of “country” cosmetic
- 18 Sept 26 −1
- Tool “get_host_software” rewrote its description, which is the text the model reads security
- Tool “get_participant_stats” rewrote its description, which is the text the model reads security
- Tool “get_software” rewrote its description, which is the text the model reads security
- Tool “list_host_software” rewrote its description, which is the text the model reads security
- Tool “list_smps” rewrote its description, which is the text the model reads security
- Tool “list_software” rewrote its description, which is the text the model reads security
- “get_adoption” reworded the description of “country” cosmetic
- 16 Sept 26 0
- New tool “get_software” functional
- New tool “list_software” functional
- “list_compliance_findings” reworded the description of “since” cosmetic
- 15 Sept 26 0
- Tool “get_access_point” rewrote its description, which is the text the model reads security
- Tool “get_host” rewrote its description, which is the text the model reads security
- 11 Sept 26 0
- Tool “list_access_points” rewrote its description, which is the text the model reads security
- Schema quality: 8488 → 9429 ▼ functional
- New tool “list_cohort_move_participants” functional
- New tool “list_cohort_moves” functional
- “list_access_points” added an optional parameter “country” cosmetic
- 10 Sept 26 0
- Tool “get_compliance_stats” rewrote its description, which is the text the model reads security
- Tool “get_compliance_stats_history” rewrote its description, which is the text the model reads security
- “get_compliance_stats” added an optional parameter “country” cosmetic
- “get_compliance_stats_history” added an optional parameter “country” cosmetic
- 9 Sept 26 0
- Tool “list_participants” rewrote its description, which is the text the model reads security
- Schema quality: 7018 → 8225 ▼ functional
- New tool “get_compliance_stats” functional
- New tool “get_compliance_stats_history” functional
- New tool “get_seat_compliance” functional
- New tool “list_compliance_findings” functional
- New tool “list_compliance_rules” functional
- “list_participants” added an optional parameter “sub_provider” cosmetic
- “list_participants” reworded the description of “sort” cosmetic
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Probed https://mcp.peppolstatus.com
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=peppolstatus.com | CN=WE1,O=Google Trust Services,C=US | 5 Aug 2026 | 3 Nov 2026 | ECDSA 256 | ECDSA-SHA256 | 151ba528f0866ef0133293c5497cc634 |
| SANs: peppolstatus.com, mcp.peppolstatus.com, *.mcp.peppolstatus.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.peppolstatus.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| peppolstatus.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=0; includeSubDomains |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.peppolstatus.com | Verified | 200 | |
| http (plaintext) | http://mcp.peppolstatus.com | HTTPS enforced | 301 | https://mcp.peppolstatus.com/ |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
list_host_software_history ~111
List a host's software-fingerprint history The closed (superseded) software rows for one host, newest-first, cursor-paginated. Each row is one axis transition with its evidence. Market tier.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque pagination cursor returned as `next_cursor` by the previous page. |
| hostname | string | yes | The host's fully-qualified hostname. |
| limit | integer | – | Page size, clamped to [1, 200]. Defaults to 50. |
No output schema declared.
No examples provided.
list_hosts ~42
List monitored hosts Every monitored host with its current verdict, latest hourly all-locations latency and 24h uptime, worst-first, plus a network-wide rollup.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_id_quality_malformed ~181
List malformed participant identifiers The individual identifiers that failed their scheme's structural rule, keyset-paginated on (scheme, value). The first page's `meta.facets` gives scheme and reason counts over the filtered set.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque pagination cursor returned as `next_cursor` by the previous page. |
| limit | integer | – | Page size, clamped to [1, 200]. Defaults to 50. |
| q | string | – | Case-insensitive substring match on the identifier value. |
| reason | string | – | Filter by the kind of structural failure. |
| scheme | string | – | Filter to one Peppol ICD scheme (e.g. `0208`). |
| smp | string | – | Filter to malformed ids homed on one SMP hostname (from `meta.facets.smp`). |
No output schema declared.
No examples provided.
list_incidents ~113
List incidents The global incident feed, newest-first, cursor-paginated.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque pagination cursor returned as `next_cursor` by the previous page. |
| host | string | – | Filter to one host's incidents. |
| limit | integer | – | Page size, clamped to [1, 200]. Defaults to 50. |
| since | string | – | Only include items at or after this ISO 8601 instant. |
| status | string | – | Filter by incident lifecycle state. |
No output schema declared.
No examples provided.
list_participant_events ~94
List a participant's change events The participant's typed change events, newest-first, cursor-paginated.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque pagination cursor returned as `next_cursor` by the previous page. |
| id | string | yes | Canonical `scheme::value` Peppol identifier. |
| limit | integer | – | Page size, clamped to [1, 200]. Defaults to 50. |
No output schema declared.
No examples provided.
list_participants ~1,672
List participants The participant set, keyset-paginated. Default sort is first-seen newest-first. Comma-array filters (`country`, `scheme`, `smp`, `ap`, `doctype`, `transport_profile`, `host`, `provenance`, and the company-register cuts `entity_type`, `sector`, `size`, `region`, `postcode`), the single-valued `sub_provider` cut, `registered` + `vat_liable` booleans, and a smart `q` (a `scheme::value`/bare value hits the ID index; free text runs a trigram name-contains). First-page `meta` carries estimated totals and rollup facets; `meta.filter_count` is a bounded exact count that degrades to null (never an error) if it exceeds the query timeout. Discovered participants carry no name/card fields (privacy).
| Name | Type | Req | Description |
|---|---|---|---|
| ap | array | – | Comma-array of serving Access Point SeatIDs (`PBE000123,PNO000456`). |
| country | array | – | Comma-array of ISO country codes (`BE,NL`). |
| cursor | string | – | Opaque pagination cursor returned as `next_cursor` by the previous page. |
| doctype | array | – | Comma-array of Peppol document type ids. Matches a participant if ANY of its current endpoints declares one of the given doctypes. Used ALONE (no other filter) results are ordered by identifier and `… |
| entity_type | array | – | Comma-array of company legal-form families (`company`,`natural_person`,`association`,`public`), from the company-register enrichment denormalized onto the participant. |
| host | array | – | Comma-array of endpoint-URL hostnames (`ap.example.com`). Matches a participant if ANY of its current endpoints publishes an endpoint URL on one of the given hosts — the exact participant set an Acce… |
| limit | integer | – | Page size, clamped to [1, 200]. Defaults to 50. |
| not_country | array | – | Comma-array of country codes (`NO,SE`) to EXCLUDE. Rows with no value are KEPT — excluding a value never drops the un-enriched remainder. Combines with its include twin: `?region=NO-03¬_region=NO-… |
| not_entity_type | array | – | Comma-array of company legal-form families (`company`,`natural_person`,`association`,`public`) to EXCLUDE. Rows with no value are KEPT — excluding a value never drops the un-enriched remainder. Combi… |
| not_region | array | – | Comma-array of company seat region codes (`NO-32,BE-BRU`) to EXCLUDE. Rows with no value are KEPT — excluding a value never drops the un-enriched remainder. Combines with its include twin: `?region=N… |
| not_sector | array | – | Comma-array of 2-digit NACE divisions (`47,62`) to EXCLUDE. Rows with no value are KEPT — excluding a value never drops the un-enriched remainder. Combines with its include twin: `?region=NO-03¬_r… |
| not_size | array | – | Comma-array of company size classes (as stored; SIRENE only) to EXCLUDE. Rows with no value are KEPT — excluding a value never drops the un-enriched remainder. Combines with its include twin: `?regio… |
| not_smp | array | – | Comma-array of SMP hostnames to EXCLUDE. Rows with no value are KEPT — excluding a value never drops the un-enriched remainder. Combines with its include twin: `?region=NO-03¬_region=NO-32` applie… |
| postcode | array | – | Comma-array of company seat postcodes. |
| provenance | array | – | Comma-array of provenance values. |
| q | string | – | Smart search: `scheme::value`/bare value → ID lookup; else name-contains. |
| region | array | – | Comma-array of company seat region codes (`BE-BRU,BE-VLG`). |
| registered | boolean | – | Filter by current SML registration state. |
| scheme | array | – | Comma-array of Peppol identifier schemes. |
| sector | array | – | Comma-array of 2-digit NACE divisions (`47,62`). |
| size | array | – | Comma-array of company size classes (as stored; SIRENE only). |
| smp | array | – | Comma-array of current SMP hostnames (`smp1.example,smp2.example`). |
| sort | string | – | Sort + keyset key. `registered`, `entity_type` (the Type column) and `sector` (the Activity / NACE-division column) order over `(<col>, first_seen_at, id)`; the `entity_type`/`sector` views show only… |
| sub_provider | string | – | ONE curated sub-provider (reseller) slug (`codabox`) — the same slugs `GET /v1/aps/{key}` reports in `sub_providers[].sub_provider`. Matches a participant the daily rollup fingerprinted to that brand… |
| transport_profile | array | – | Comma-array of transport profile ids (`peppol-transport-as4-v2_0`). Matches a participant if ANY of its current endpoints uses one of the given profiles. Used ALONE (no other filter) results are orde… |
| vat_liable | boolean | – | Filter by company VAT-liable / mandate-scope flag. |
No output schema declared.
No examples provided.
list_provider_certs ~77
Get a provider's certificate posture A curated provider's whole-fleet certificate posture in one call: per-Seat cert counts, soonest expiry, expired / expiring-within-30-days counts, observed cert organisations and last identity shift, plus the rolled-up fleet summary.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | The curated provider slug. |
No output schema declared.
No examples provided.
list_providers ~55
List providers The OpenPeppol member registry with role flags, country, mapped hostnames and per-provider participant counts (market share), busiest first. Not paginated (the envelope's `next_cursor` is always null).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_public_providers ~151
List public provider profiles The FREE, crawlable public subset for each curated provider, busiest first: identity + role flags, the seat-directory columns (legal entity, commercial name, website, infra provider, hosting), mapped hostnames, participant count, roster country mix, the 30d/90d uptime headline, a cert-health summary and an `as_of` freshness stamp. Reachable with no API key. `limit` clamps to [1, 500] (default 100). Not paginated (the envelope's `next_cursor` is always null).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Number of providers to return, clamped to [1, 500]. Defaults to 100. |
No output schema declared.
No examples provided.
list_smps ~239
List SMPs The SMP directory: every current SMP hostname with the seat(s) and provider that sign its metadata, busiest first. A hostname is listed if it currently homes participants (from the participant rollup's `smp` facet) or carries an open `smp-signing` certificate. `participant_count` comes from that bounded top-N facet, so a hostname with a signing cert but outside the top-N carries a null count (unknown), not zero. The provider is resolved from the most-recent open signing cert with the precedence curated mapping (verified) → unverified cert-CN — the same as `/v1/aps`. `provider` is who OPERATES the host; `owner` names the party the curated registry says OWNS it, and is set only when that is a different party (a shared registry SMP served under another party's cert), else null. Not paginated (the envelope's `next_cursor` is always null).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Cap on returned rows (non-negative integer). Defaults to all. |
| q | string | – | Case-insensitive substring filter on the SMP hostname. |
No output schema declared.
No examples provided.
list_software ~424
List the software library (Market) The signature catalogue's PRODUCT taxonomy joined to what the network shows: for every engine, its display name, vendor, category and homepage, the current host count broken down by observed role, when it was first and last seen, a compliance signal for the seats running it, and a host-count trend of up to 90 UTC days. Every catalogue engine appears, including one the network does not currently show (`hosts: 0`, a flat trend) — the library is the catalogue, not only today's sightings. `category` is the vendor's own framing; `roles` is the OBSERVED fact and is the one to trust where the two disagree. `compliance.seats_linked` is deliberately not called "owned": an engine → seat link is MANY-TO-MANY, so a seat whose hosts run two engines is counted under both and its findings appear under both. Summing `open_findings` across engines therefore OVER-COUNTS the network total; the figure answers "how much compliance debt sits behind this engine", never "who is to blame". `compliance` is null when no seat is linked to the engine, and `snapshot_date` always travels with the numbers because the daily rollup can be a day stale. `lanes[]` (issue #798) reports each tracked upstream LANE of the engine — a lane is not an engine: `oxalis` covers three independent release ladders — with its `latest_release` and the `hosts_current` / `hosts_behind` / `hosts_unknown` split of the hosts running it. `advisories` summarises the live advisories published for the product by CVSS severity. Both are NULL — never `[]` or zero counts — for the engines the catalogue tracks no upstream feed for. Market tier.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Trend window in trailing UTC days, 1..90 (default 90). The ceiling is part of the contract — `days` can only narrow the window, never widen it. |
No output schema declared.
No examples provided.
list_software_anomalies ~201
List software anomalies The software-fingerprinting anomaly feed (spec §6): version downgrades and vendor swaps, both graded `notice`. A `market` carve-out — the general `/v1/anomalies` feed (network) excludes these detectors. Same shape as that feed.
| Name | Type | Req | Description |
|---|---|---|---|
| acknowledged | boolean | – | Filter by acknowledgement state. |
| cursor | string | – | Opaque pagination cursor returned as `next_cursor` by the previous page. |
| detector | string | – | Filter by detector (a software detector; others yield an empty page). |
| grade | string | – | Filter by grade. |
| host | string | – | Filter to anomalies targeting one host. |
| limit | integer | – | Page size, clamped to [1, 200]. Defaults to 50. |
| seat | string | – | Filter to anomalies targeting one seat. |
| since | string | – | Only include items at or after this ISO 8601 instant. |
No output schema declared.
No examples provided.
What is the PeppolStatus MCP server?
PeppolStatus is an MCP server listed in the public MCP registry as com.peppolstatus/api. Peppol market intelligence and network monitoring: migrations, provider churn, leads, and uptime. This page covers its hosted endpoint (https://mcp.peppolstatus.com).
Is the PeppolStatus MCP server safe to use?
PeppolStatus scores 79 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the PeppolStatus MCP server expose?
PeppolStatus exposes 62 tools: list_hosts, get_host, list_host_incidents, get_host_uptime, list_host_software, and 57 more. Their descriptions and schemas cost roughly 12,776 tokens of context every time the server is loaded.
Does the PeppolStatus MCP server require authentication?
No. We connected to PeppolStatus without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the PeppolStatus MCP server still maintained?
PeppolStatus is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.