Ripostiq
REMOTE · RIPOSTIQ.COM · SCANNED SEP 24
Courses that argue back: learn adaptively, build real work, then defend it to an AI stakeholder.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security74
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability49
- 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2952 tokens (~101/item across 29 items; 24 tools + 5 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 24 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 26 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Ripostiq MCP server?
Ripostiq is a hosted endpoint at https://ripostiq.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · ripostiq.com
claude mcp add --transport http com-ripostiq-ripostiq 'https://ripostiq.com/mcp'
{
"mcpServers": {
"com-ripostiq-ripostiq": {
"url": "https://ripostiq.com/mcp"
}
}
} {
"servers": {
"com-ripostiq-ripostiq": {
"type": "http",
"url": "https://ripostiq.com/mcp"
}
}
} [mcp_servers.com-ripostiq-ripostiq] url = "https://ripostiq.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-ripostiq-ripostiq": {
"type": "remote",
"url": "https://ripostiq.com/mcp",
"enabled": true
}
}
} openclaw mcp add com-ripostiq-ripostiq --url 'https://ripostiq.com/mcp' --transport streamable-http
mcp_servers:
com-ripostiq-ripostiq:
url: "https://ripostiq.com/mcp" {
"McpServers": {
"com-ripostiq-ripostiq": {
"Transport": "http",
"Url": "https://ripostiq.com/mcp"
}
}
} assistant mcp add com-ripostiq-ripostiq -t streamable-http -u 'https://ripostiq.com/mcp'
{
"mcpServers": {
"com-ripostiq-ripostiq": {
"type": "http",
"url": "https://ripostiq.com/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 10 Sept 26 0
- Stability: 0.97 → pass security
- 9 Sept 26 0
- Stability: pass → 0.97 functional
- 30 Aug 26 0
- Stability: 0.97 → pass security
- 29 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 27 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 26 Aug 26 76
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 12 Aug 26 0
- Endpoint reachability: unreachable → reachable ▲ functional
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Probed https://ripostiq.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=ripostiq.com | CN=WE1,O=Google Trust Services,C=US | 11 Aug 2026 | 9 Nov 2026 | ECDSA 256 | ECDSA-SHA256 | 7028efd773e7ccd213dbe725b4070977 |
| SANs: ripostiq.com, *.ripostiq.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of ripostiq.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| ripostiq.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://ripostiq.com/mcp | Verified | 200 | |
| http (plaintext) | http://ripostiq.com/mcp | HTTPS enforced | 301 | https://ripostiq.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
begin_course Begin course ~56
Start a course. Returns the tutor protocol, intake guidance, and the module map. Call this first, run the intake, then call teach_section to teach Module 1.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| course | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
daily_drill Two-minute daily drill ~104
The two-minute drill — today's spaced-recall question + the learner's day streak. Call it to fetch today's question (deterministic per day, drawn from modules they've started); after they answer and you reveal it, call again with done=true to log it and bump the streak. A daily habit: one question, two minutes, keep the streak alive.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| course | string | yes | – |
| done | boolean | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_artifact Get artifact ~67
Fetch a saved Library artifact's full content (by id, or by key+course). Use to pull a prior deliverable forward and build on it in a new chat.
| Name | Type | Req | Description |
|---|---|---|---|
| artifact_id | – | – | – |
| auth_token | – | – | – |
| course | – | – | – |
| key | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_certificate Get certificate ~85
Ripostiq certificate status. Pass `module` for that module's certificate (earned when its boss battle is passed); omit it for the course certificate (earned when EVERY module's boss is passed). Both are viewable at /certificate and publicly verifiable at /verify/<code>.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| course | string | yes | – |
| module | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_entitlements Get entitlements ~32
List the logged-in account's entitlements across courses (OAuth bearer or auth_token).
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_lesson Get lesson ~67
Fetch a module's lesson content. Free module is open; paid modules require an active entitlement. Returns {locked, teaser, checkout_url} when not entitled.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| course | string | yes | – |
| module | string | yes | – |
| section | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_outline Get course outline ~56
Full course outline — every module + its section titles — so the learner can pick ANY module/section to start, in any order. Marks locked modules and their progress.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| course | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_progress Get progress ~72
Return the learner's progress for a course — the raw doc plus a display-ready summary (per-module sections done/total, boss status, overall percent, current position), and wind_down coverage (which modules have their cheatsheet + session summary saved).
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| course | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_recap Get recap ~54
Resume briefing for a returning learner — what they've covered, mastery levels, strong/weak topics, and recall questions to reactivate memory. Call at session start.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| course | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
interview_prep Mock interview ~146
Free 'Mock interview' — a realistic, calibrated interview for a role. `jd_or_skill` is the job description (paste it) or the skill/role to interview against; `role` and `experience` (e.g. 'senior backend engineer', '5 years') calibrate difficulty; `focus` narrows it (e.g. 'system design'). No login or course needed. Returns the interview protocol + a course recommendation. Great when someone is prepping for an interview and wants a real grilling.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| experience | – | – | – |
| focus | – | – | – |
| jd_or_skill | string | yes | – |
| role | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
list_artifacts List library ~66
List the learner's saved Library artifacts (titles + metadata, newest first). Use at session start (with get_recap) to reference prior work and continue seamlessly.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| course | string | yes | – |
| module | – | – | – |
| type | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
list_courses List courses ~103
List every available Ripostiq course (no login needed). Call this FIRST when a user wants to browse or start learning. Each course has a free Module 1 anyone can start immediately via begin_course(course) → teach_section. Returns the `course` id to pass to other tools. For a logged-in learner this also includes courses THEY authored (marked `mine`, with their `visibility`) — offer those alongside the catalog.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
list_interviews List interview-prep topics ~90
List the curated Interview-Prep topics (e.g. 'Agentic AI in Production'). Each is a realistic, adaptive mock interview on a fixed topic — concept→scenario question pairs across several areas — that ends in a candid scorecard. No login or course needed. Call this when someone wants to prep for an interview on a topic the catalog covers, then start_interview.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
login Log in ~84
Claude Code plugin login only (auth_token flow). On the web/desktop connector, identity comes from the connector's OAuth approval — do NOT ask the user to type their email/password into the chat; direct them to the connector's 'Log in with Ripostiq' or ripostiq.com instead.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | – | |
| password | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
mark_progress Update saved progress ~111
Record the learner's progress server-side (shows on their account + syncs across devices). Call when a section is genuinely completed (section_id), or after a boss battle (boss='passed'/'failed', boss_attempt=true), or on a lab status change (lab=...).
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| boss | – | – | – |
| boss_attempt | boolean | – | – |
| course | string | yes | – |
| lab | – | – | – |
| module | string | yes | – |
| section_id | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
recall_questions Recall questions ~43
Return spaced-recall questions drawn from the account's completed modules.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | string | yes | – |
| count | integer | – | – |
| course | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
roast Roast my work ~155
Free 'Roast my work' — a single tough-but-fair stakeholder grilling of ANY artifact the user pastes (PRD, architecture, code, pitch, resume, plan, essay…). No login or course needed. `work` is the artifact (or a solid description); `kind` optionally hints the type (prd/architecture/code/pitch/strategy/resume/design…) to pick the right persona; `focus` is what they most want pushback on. Returns the roast protocol + a course recommendation. Great as an entry point when someone wants honest, pointed feedback on real work.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| focus | – | – | – |
| kind | – | – | – |
| work | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
run_boss Run boss battle ~155
Get the module's boss-battle simulation + how to run it (in-character, real stakes, earned PASS). Gated like lessons. `difficulty` dials the intensity — 'friendly' (supportive coach), 'standard' (default), or 'brutal' (relentless, skeptical, high bar) — and optional `persona_style` sets a flavor (e.g. 'skeptical CTO', 'hostile board member'). The rubric is unchanged; only how hard the stakeholder presses. Offer the learner the choice first.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| course | string | yes | – |
| difficulty | – | – | – |
| module | string | yes | – |
| persona_style | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
start_exam Start practice exam ~138
Start the course's SCORED PRACTICE EXAM — a full, blueprint-aligned multiple-choice mock that returns a scaled score against the real pass line, a per-domain breakdown, and rationale for every question. Login + entitlement gated like the paid capstone (returns needs_login / locked if not). Returns a drawn `form` of questions WITHOUT the answers (the key is held server-side); proctor them one at a time, collect the learner's letters, then call submit_exam(course, answers) to score. Never reveal or answer the questions yourself.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| course | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
start_interview Start interview prep ~167
Begin a curated Interview-Prep session on a fixed topic. `interview` is the topic id from list_interviews (e.g. 'agentic-ai-in-production'); `role`/`experience` calibrate difficulty. LOGIN REQUIRED (free in the current beta, like a course): if the learner isn't logged in this returns needs_login — ask them to log in with the connector, don't run the questions. Once unlocked, returns the question bank + an adaptive protocol (one question at a time across ~4-5 areas, concept then scenario, hint when stuck, scorecard at the end). Save it with save_interview.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| experience | – | – | – |
| interview | string | yes | – |
| role | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
submit_artifact Submit lab deliverable ~97
Submit a lab deliverable. Stores it in the learner's Library (type='deliverable') and returns the module rubric so it can be reviewed against the bar. Call get_review next. For general note-taking use save_artifact instead.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| content_text | – | – | – |
| course | string | yes | – |
| module | string | yes | – |
| repo_ref | – | – | – |
| type | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
submit_exam Submit exam answers and score the attempt ~123
Score a practice exam started with start_exam. `answers` maps each question id to the learner's chosen letter, e.g. {"q001": "A", "q002": "C"}; unanswered questions score as incorrect. Returns the scaled score, PASS/FAIL vs the pass line, a per-domain breakdown, and the per-question rationale for review. Deliver it as an honest scorecard and point them to the weak domains' modules.
| Name | Type | Req | Description |
|---|---|---|---|
| answers | object | yes | – |
| auth_token | – | – | – |
| course | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
teach_section Teach section ~88
Get one lesson section's content + the teaching protocol for it. Free module is open; paid modules require an active entitlement (returns {locked, teaser} if not). Teach it socratically, then call again with section_index+1 to advance.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
| course | string | yes | – |
| module | string | yes | – |
| section_index | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
whoami Who am I ~29
Return the current logged-in user (via OAuth bearer or an auth_token).
| Name | Type | Req | Description |
|---|---|---|---|
| auth_token | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
What is the Ripostiq MCP server?
Ripostiq is an MCP server listed in the public MCP registry as com.ripostiq/ripostiq. Courses that argue back: learn adaptively, build real work, then defend it to an AI stakeholder. This page covers its hosted endpoint (https://ripostiq.com/mcp).
Is the Ripostiq MCP server safe to use?
Ripostiq scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Ripostiq MCP server expose?
Ripostiq exposes 24 tools: login, whoami, get_entitlements, get_lesson, list_courses, and 19 more. Their descriptions and schemas cost roughly 2,188 tokens of context every time the server is loaded.
Does the Ripostiq MCP server require authentication?
No. We connected to Ripostiq without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Ripostiq MCP server still maintained?
Ripostiq is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.