welance/directory
REMOTE · WELANCE.COM
Match a project brief with small vetted software teams, anonymously; sign in to manage your own.
Available components
Last scanned (11 hours ago)
Scores higher than 58% of remote servers
Reachable. Last reached 5 Nov 2026.
Category CRM and Sales
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security74
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability66
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2356 tokens (~117/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
- Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage75
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 24% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
- 27 Oct 26 67
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://welance.com/directory/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=welance.com | CN=WE1,O=Google Trust Services,C=US | 30 Oct 2026 | 28 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | 2d39bbf84f7223800e2a894be15272f1 |
| SANs: welance.com, *.welance.com, *.staging.welance.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of welance.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| welance.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| content-security-policy | default-src 'self'; base-uri 'self'; object-src 'none'; form-action 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://*.googletagmanager.com https://www.google.com https://www.googleadservices.com https://adservice.google.com https://*.googlesyndication.com https://*.doubleclick.net https://*.google-analytics.com https://consent.cookiebot.com https://consentcdn.cookiebot.com https://*.hotjar.com https://app.chatwoot.com https://static.cloudflareinsights.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https:; font-src 'self' https: data:; img-src 'self' data: blob: https:; media-src 'self' blob: https:; connect-src 'self' https: wss:; worker-src 'self' blob:; manifest-src 'self'; frame-src 'self' https://app.chatwoot.com https://consentcdn.cookiebot.com https://challenges.cloudflare.com https://*.doubleclick.net https://www.google.com https://www.youtube.com https://www.youtube-nocookie.com; frame-ancestors 'self' https://otto.welance.com; upgrade-insecu |
| x-content-type-options | nosniff |
| referrer-policy | strict-origin-when-cross-origin |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://welance.com/directory/mcp | Verified | 200 | |
| http (plaintext) | http://welance.com/directory/mcp | HTTPS enforced | 301 | https://welance.com/directory/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
brief_rules The public scoring rules ~37
The rule catalogue a brief is scored against before teams see it: ids, labels, weights and the acceptance threshold that decides whether a brief publishes.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
directory_capabilities What welance/directory is ~73
What the directory is, who it is for (small vetted software teams for digital projects, especially ones rooted in the physical world), how pricing works (0% of the project; €30 + VAT from each side only to meet, charged once both accept a time), and the rule that the human stays the principal.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_open_briefs Open briefs and delivered projects ~70
The public briefs: open ones looking for a team, ones in vetting, and the archive of delivered projects with budget, sector and delivery team. Anonymised server-side. Filter by status or to tangible-world projects only.
| Name | Type | Req | Description |
|---|---|---|---|
| status | string | – | – |
| tangible | boolean | – | – |
No output schema declared.
No examples provided.
match_brief Shortlist teams for a draft brief ~118
Match a draft brief (80–20000 characters) against the real, eligible anonymous teams: only teams the brief matches come back, with reasons and the defaults inferred from the brief. Same derivation and matcher as publishing, stores nothing, calls no LLM. Ends with a "Start this brief" link that opens the guided flow prefilled.
| Name | Type | Req | Description |
|---|---|---|---|
| brief | string | yes | The draft brief, markdown or plain text |
| language | string | – | ISO 639-1 language the team must speak |
| title | string | – | – |
No output schema declared.
No examples provided.
preview_teams A protected preview of the team board ~68
Two anonymous, vetted teams as specimens (rotating daily) and the size of the supply — never the whole board. The board is brief-first: the teams that fit a project are listed only against a draft brief. Names and members are revealed only after a mutual €30-per-side handshake.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
propose_booking Propose meeting times ~179
As the client of a pitch on the person's own brief (appId): a proposed 30-minute call with at least 3 concrete slots (ISO 8601; weekdays, on the hour, 09–18 CET, 3–10 business days ahead) and an optional note. Confirming holds €30 from the client's side for up to 7 days; nothing is charged until both sides accept a time. A no-show's €30 is not returned; the side that showed gets a credit. Stores a proposal only. Nothing happens until the person confirms it on welance.com/directory; the result includes the review link.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | integer | yes | – |
| note | string | – | – |
| slots | array | yes | – |
| summary | string | yes | One sentence, in the conversation language, saying what happens on confirm. |
No output schema declared.
No examples provided.
propose_booking_accept Propose accepting a meeting time ~133
As the team on a booking (bookingId): a proposal to accept one of the client's offered slots (slotId). Accepting charges €30 from each side; if the client does not show, the team's €30 becomes a credit; if the team does not show, its €30 is not returned. Stores a proposal only. Nothing happens until the person confirms it on welance.com/directory; the result includes the review link.
| Name | Type | Req | Description |
|---|---|---|---|
| bookingId | integer | yes | – |
| slotId | integer | yes | – |
| summary | string | yes | One sentence, in the conversation language, saying what happens on confirm. |
No output schema declared.
No examples provided.
propose_brief_draft Propose a brief draft ~125
A proposed update to the person's local brief draft: title, markdown, and/or per-rule answers. Accepting it fills the brief editor; nothing is published. The whole proposal is limited to 64,000 UTF-8 bytes. Stores a proposal only. Nothing happens until the person confirms it on welance.com/directory; the result includes the review link.
| Name | Type | Req | Description |
|---|---|---|---|
| answers | object | – | – |
| markdown | string | – | – |
| summary | string | yes | One sentence, in the conversation language, saying what happens on confirm. |
| title | string | – | – |
No output schema declared.
No examples provided.
propose_brief_publish Propose publishing a brief ~135
A proposal to publish a brief (title, markdown, optional language) to the board. On confirmation the server's live score gate decides whether it publishes; publishing emails a one-time link and signs no one in. The whole proposal is limited to 64,000 UTF-8 bytes. Stores a proposal only. Nothing happens until the person confirms it on welance.com/directory; the result includes the review link.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | – | – |
| markdown | string | yes | – |
| summary | string | yes | One sentence, in the conversation language, saying what happens on confirm. |
| title | string | yes | – |
No output schema declared.
No examples provided.
propose_pitch_draft Propose a pitch draft ~125
An anonymous pitch draft for one of the person's teams (teamKey) on an open brief (briefId). Accepting it fills the existing pitch editor; nothing is sent. Stores a proposal only. Nothing happens until the person confirms it on welance.com/directory; the result includes the review link.
| Name | Type | Req | Description |
|---|---|---|---|
| briefId | integer | yes | – |
| summary | string | yes | One sentence, in the conversation language, saying what happens on confirm. |
| teamKey | string | yes | – |
| text | string | yes | Anonymous: no names, emails, phone numbers or links. |
No output schema declared.
No examples provided.
propose_pitch_send Propose sending a pitch ~134
A proposal to send an anonymous pitch for one of the person's teams (teamKey) on an open brief (briefId); once confirmed, the brief owner sees it. Each brief accepts a limited number of pitches (10). Stores a proposal only. Nothing happens until the person confirms it on welance.com/directory; the result includes the review link.
| Name | Type | Req | Description |
|---|---|---|---|
| briefId | integer | yes | – |
| summary | string | yes | One sentence, in the conversation language, saying what happens on confirm. |
| teamKey | string | yes | – |
| text | string | yes | Anonymous: no names, emails, phone numbers or links. |
No output schema declared.
No examples provided.
propose_profile_update Propose profile changes ~446
Proposed field changes to one entity. entity "person": the signed-in person's own profile (job_role, years_experience, langs, skills, hourly_rate). entity "member" + teamKey + memberKey: a confirmed colleague on one of the person's teams (job_role, years_experience, langs, hourly_rate; skills are rated only by their owner). entity "team" + teamKey: intro, based, remote, availability, langs, shipped, hourly. entity "organisation" + organisationId: website, description of an organisation the person owns or administers (descriptive only; it verifies nothing). Skills: changes[{field:"skills", value:[{name, rating 1–10}]}] adds or re-rates (an existing name takes the new rating); removeSkills lists skill names to remove. Languages: addLangs / removeLangs take two-letter codes; alternatively a langs change carries the complete new list (not both). Scalars: changes[{field, value}]; hourly_rate is EUR/h, 10–2000; team hourly overrides the rate blended from members' rates, and null restores the blend; team size is not a field (it is the confirmed member count). Team shipped: value lists entries to add, each {title, url, desc}; existing entries are kept; removeShipped lists titles or links to remove. inferred=true marks a value derived from evidence rather than stated by the person; hourly rate, availability, languages and skill ratings are rejected when inferred. Each changed field becomes a separate card the person approves. Stores a proposal only. Nothing happens until the person confirms it on welance.com/directory; the result includes the review link.
| Name | Type | Req | Description |
|---|---|---|---|
| addLangs | array | – | – |
| changes | array | – | – |
| entity | string | yes | – |
| memberKey | string | – | – |
| organisationId | string | – | – |
| removeLangs | array | – | – |
| removeShipped | array | – | – |
| removeSkills | array | – | – |
| summary | string | yes | One sentence, in the conversation language, saying what happens on confirm. |
| teamKey | string | – | – |
No output schema declared.
No examples provided.
propose_team_invite Propose inviting someone to a team ~132
A proposal to invite a person to one of the signed-in person's teams (teamKey) by name and email, with an optional role. Once confirmed, the invitee receives an email; their skill ratings are theirs to set later. Stores a proposal only. Nothing happens until the person confirms it on welance.com/directory; the result includes the review link.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | – | |
| name | string | yes | – |
| role | string | – | – |
| summary | string | yes | One sentence, in the conversation language, saying what happens on confirm. |
| teamKey | string | yes | – |
No output schema declared.
No examples provided.
read_booking One booking ~42
One booking by its id (bookingId): the proposed slots, its state, and which side the signed-in person is on.
| Name | Type | Req | Description |
|---|---|---|---|
| bookingId | integer | yes | – |
No output schema declared.
No examples provided.
read_brief One brief ~34
One public brief in full, markdown body included, by its id (briefId).
| Name | Type | Req | Description |
|---|---|---|---|
| briefId | integer | yes | – |
No output schema declared.
No examples provided.
read_invoices My invoices ~158
The signed-in person's past invoices with their PDF and document links (pdfUrl / documentUrl). Without filters it covers every billing identity of the person (personal VAT plus companies they own or administer); each invoice is tagged with its identity {kind, id, label, vatMasked}. identity ("all", "personal" or "org:<organisationId>") or identities (several of "personal" / "org:<organisationId>") narrow by identity; from/to (YYYY-MM-DD, inclusive) narrow by date; limit caps the count (1–50).
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | – | – |
| identities | array | – | – |
| identity | string | – | – |
| limit | integer | – | – |
| to | string | – | – |
No output schema declared.
No examples provided.
read_my_pitches My briefs, pitches and bookings ~43
The signed-in person's pitches and bookings on both sides: applications sent by their teams (with handshake and booking state) and the anonymous pitches received on their own briefs.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
read_my_teams My teams ~95
The signed-in person's teams: key (teamKey), name, and the facts the system derives rather than stores (members = confirmed people; rate = blended from members' rates unless the team sets an override; languages from members unless set); each team's profile (based, remote, availability, shipped work), open and matching brief counts, and a checklist of what pitching and the public board require, each marked met or missing.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
read_pitchable_briefs Briefs my teams can pitch on ~43
For each of the signed-in person's teams, the open briefs that team can still pitch on: not yet pitched, pitch slots left, and a language match.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
read_profile My profile ~34
The signed-in person's own directory profile: job role, years of experience, languages, rated skills, hourly rate and verification state.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the welance/directory MCP server?
welance/directory is a hosted endpoint at https://welance.com/directory/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · welance.com
claude mcp add --transport http com-welance-directory 'https://welance.com/directory/mcp'
What is the welance/directory MCP server?
welance/directory is an MCP server listed in the public MCP registry as com.welance/directory. Match a project brief with small vetted software teams, anonymously; sign in to manage your own. This page covers its hosted endpoint (https://welance.com/directory/mcp).
Is the welance/directory MCP server safe to use?
welance/directory scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the welance/directory MCP server expose?
welance/directory exposes 20 tools: directory_capabilities, list_open_briefs, preview_teams, match_brief, brief_rules, and 15 more. Their descriptions and schemas cost roughly 2,224 tokens of context every time the server is loaded.
Does the welance/directory MCP server require authentication?
No. We connected to welance/directory without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the welance/directory MCP server still maintained?
welance/directory is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.