# com.secdim/mcp (remote · mcp.secdim.com)

Personalised developer security learning pathways from SecDim's challenges and courses.

- Trust score: 67/100 (medium)
- Change this week: +6
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `mcp.secdim.com`: 67/100 (this document), [markdown](https://verifymcp.io/servers/com-secdim-mcp/mcp.md), [page](https://verifymcp.io/servers/com-secdim-mcp/mcp)

## Channel facts

- Endpoint: `https://mcp.secdim.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 66/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 7 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 75/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2780 tokens (~163/item across 17 items; 7 tools + 10 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 67/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http com-secdim-mcp https://mcp.secdim.com/mcp
```

### Codex

```toml
[mcp_servers.com-secdim-mcp]
url = "https://mcp.secdim.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-secdim-mcp": {
      "type": "remote",
      "url": "https://mcp.secdim.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-secdim-mcp --url https://mcp.secdim.com/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-secdim-mcp:
    url: "https://mcp.secdim.com/mcp"
```

### Other

```json
{
  "mcpServers": {
    "com-secdim-mcp": {
      "type": "http",
      "url": "https://mcp.secdim.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 66, +3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 63, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 62, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 61, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 60)

First indexed and scored.

## MCP tools (7)

### `get_secdim_profile` (~223 tokens)

Fetch a SecDim player's profile: scores, completed challenges, skills,
    security interests and an experience estimate.

    Use this tool to understand a player's demonstrated secure coding ability
    before building a learning pathway. The profile includes actual challenge
    completion data (by difficulty level) and security topics the player has
    practised — weight this demonstrated performance over a user's self-reported
    level when deciding what difficulty and topics to recommend.

    The 'guidance' field provides a ready-to-use summary of what difficulty and
    topics to target next, and whether the player is new, intermediate or
    experienced.

    Args:
        secdim_username: The player's SecDim username (e.g. "alice")

    Returns:
        Dictionary with scores, challenges_solved breakdown, skills (languages
        and technologies), completed_challenges list, security_interests,
        experience_estimate and guidance. If the user doesn't exist or an error
        occurs, returns an error dict.

Input parameters:

- `secdim_username` (string, required)

### `search_play_challenges` (~583 tokens)

Return a list of hands-on SecDim Play secure coding challenges (labs) related to a detected or suspected vulnerability.

    SecDim Play challenges are scored, hands-on labs: find and fix a real vulnerability
    in running code to earn points and badges.

    Use this tool to:
    - Find hands-on SecDim Play labs for specific vulnerabilities like XSS, SQL Injection, etc.
    - Explore OWASP Top 10 vulnerabilities and related labs
    - Provide additional resources and guides to help developers improve their secure coding skills

    For structured tutorial content (text, video, and lab-based courses) on the same
    vulnerability, use search_learn_courses (SecDim Learn) instead or in addition.

    Args:
        search: Search term for the vulnerability (e.g., 'xss', 'sql-injection', 'injection')
        cwe: Common Weakness Enumeration (CWE) ID to filter by
        owasp: OWASP category to filter by (e.g., 'a03:2021')
        technology: Technology or framework to filter by (e.g., 'react', 'django')
        language: Programming language to filter by (e.g., 'javascript', 'python')
        difficulty: Difficulty level to filter by (e.g., 'trivial', 'easy', 'medium', 'hard')
        type: Challenge format to filter by (e.g., 'battle', 'exploitation', 'incident-response')
        mitre: MITRE ATT&CK ID to filter by (e.g., 'T1102.003')

    SecDim Play challenges (labs) each simulate a real vulnerability. They are scored according to
    the following difficulty levels:
        - Trivial: Easy to find and path vulnerabilities. It can be completed in 5-10 minutes. 1-15 points.
        - Easy: Known vulnerabilities. It can be completed in 10-30 minutes. 16-35 points.
        - Medium: Known vulnerabilities but require defence-in-depth patch. It can be completed in 20-30 minutes. 36-70 points.
        - Hard: Hard to find or patch vulnerabilities. It can be completed in 30-60 minutes. 71-100 points.
        - Battle: SecDim Flagship attack and defence challenge tha…

Input parameters:

- `cwe`
- `difficulty`
- `language`
- `mitre`
- `owasp`
- `search` (required)
- `technology`
- `type`

### `search` (~226 tokens)

Search for SecDim Play secure coding labs (hands-on, scored challenges).

    This tool searches across SecDim Play's hands-on secure coding labs based on the
    search query. The backend API handles parsing of vulnerability names, CWE IDs, and OWASP IDs.

    Language can be specified using the format "lang:javascript".

    Args:
        query: Search query that may include:
               - Vulnerability names (e.g., "XSS", "SQL injection")
               - CWE IDs (e.g., "79")
               - OWASP IDs (e.g., "A03:2021")

               Examples:
               - "XSS lang:javascript" - searches for XSS labs in JavaScript
               - "SQL injection lang:Python" - searches for SQL injection labs in Python
               - "79" - searches for labs related to CWE-79

    Returns:
        Dictionary with search results containing:
        - results: List of matching SecDim Play labs with id, title, snippet, and metadata

Input parameters:

- `query` (string, required)

### `fetch` (~99 tokens)

Fetch detailed content for a specific SecDim Play lab (hands-on, scored challenge).

    Args:
        id: Lab ID in format "lab:slug" (e.g., "lab:xss-dom")

    Returns:
        Dictionary containing:
        - id: The lab ID
        - title: Lab title
        - content: Detailed content in markdown format
        - metadata: Additional lab information

Input parameters:

- `id` (string, required)

### `search_learn_courses` (~239 tokens)

Search SecDim Learn courses.

    SecDim Learn provides tutorial-based courses (mixing video, text and hands-on
    lab topics) covering secure coding, secure design, vibe coding security, devsecops,
    and cloud security. Many courses are complementary or prerequisite to hands-on,
    scored SecDim Play challenges/labs.

    Use this tool to:
    - Browse the SecDim Learn course catalogue
    - Find courses related to a topic, language, or technology (e.g. "OWASP Top 10",
      "fuzzing", "Python")

    Args:
        search: Optional search term to filter courses by title, description, or tags.
            If omitted, returns the full course catalogue.

    Returns:
        Dictionary with a "courses" list. Each course includes its title, description,
        image, slug, tags, numeric "level" (1=beginner, 2=intermediate, 3=advanced) and
        a "difficulty" label.
        Use get_learn_course with a course's slug to view its syllabus of topics.

Input parameters:

- `search`

### `get_learn_course` (~151 tokens)

Get a SecDim Learn course's details, including its syllabus of topics.

    Args:
        course_slug: The course's slug, as returned by search_learn_courses
            (e.g. "owasp-top-10")

    Returns:
        Dictionary with the course's title, description, image, slug, "difficulty"
        label and a "topics" list. Each topic includes its title, description,
        category, slug, kind (e.g. text/video/lab), level, subscription tier,
        duration and completion status.
        Use get_learn_topic with the course slug and a topic's slug to view its content.

Input parameters:

- `course_slug` (string, required)

### `get_learn_topic` (~175 tokens)

Get a SecDim Learn topic's content.

    Args:
        course_slug: The course's slug, as returned by search_learn_courses
            (e.g. "owasp-top-10")
        topic_slug: The topic's slug, as returned by get_learn_course
            (e.g. "introduction-secure-coding")

    Returns:
        Dictionary with the topic's title, description, category, kind, level,
        subscription tier, duration, completion status and "file_content" (the
        topic's content in AsciiDoc format).
        If the topic requires a SecDim Learn subscription that the current account
        does not have, an "error" explaining this is returned instead.

Input parameters:

- `course_slug` (string, required)
- `topic_slug` (string, required)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-secdim-mcp/mcp#diagnostics

## Score history

- 2026-08-03: 67
- 2026-08-02: 67
- 2026-08-01: 66
- 2026-07-31: 66
- 2026-07-30: 63
- 2026-07-29: 62
- 2026-07-28: 62
- 2026-07-27: 61
- 2026-07-26: 60

## Links

- Remote endpoint: https://mcp.secdim.com/mcp
- Repository: https://github.com/secdim/mcp
- Changelog RSS feed: https://verifymcp.io/servers/com-secdim-mcp/mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-secdim-mcp/mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-secdim-mcp/mcp