Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

WellState Labs SB 1150 Screening (read-only)

REMOTE · MCP.WELLSTATELABS.COM

Signed Texas SB 1150 screens. Cost proxies, not ARO, not legal determinations, not bond amounts.

76 Trust /100

Last scanned (8 hours ago)

Scores higher than 66% of remote servers

Reachable. Last reached 5 Nov 2026.

Category Finance and Payments

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security80
  • The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
  • No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation. See how to fix → View diagnostics → Partial
  • HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
  • The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
  • DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
Schema Quality & AI Usability75
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 2786 tokens (~232/item across 12 items; 9 tools + 3 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management20
  • Stability observed for 6 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
What we tested

Checks we ran (13)

  • TLS certificate
  • Authorization
  • HTTPS
  • HSTS header
  • DNSSEC
  • Transport
  • Schema quality
  • Stability
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Does not apply to this hosted endpoint (2)

  • Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
  • Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +1
    • The server rewrote its instructions, which are the text every model session reads security
  • 2 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

  • 31 Oct 26 0
    • Stability: unverified → 0.03 ▲ functional
  • 30 Oct 26 74

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://mcp.wellstatelabs.com/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=*.wellstatelabs.com CN=YR1,O=Let's Encrypt,C=US 24 Sept 2026 23 Dec 2026 RSA 2048 SHA256-RSA 69a0a85179bb981b8b66a7748537743f784
SANs: *.wellstatelabs.com, wellstatelabs.com
CN=YR1,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA a20253f15f2691c05dc1ce13b9bcca4e
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of mcp.wellstatelabs.com. — Not signed

Zone DS Keys Algorithms Outcome
. Trust anchor 20326, 38696 8, 8 Verified
com. DS published 19718 13 Verified
wellstatelabs.com. No DS Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=63072000; includeSubDomains
content-security-policy default-src 'none'; frame-ancestors 'none'; base-uri 'none'
x-content-type-options nosniff
x-frame-options DENY
referrer-policy no-referrer
permissions-policy camera=(), microphone=(), geolocation=(), payment=(), usb=()

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://mcp.wellstatelabs.com/mcp Verified 200
http (plaintext) http://mcp.wellstatelabs.com/mcp HTTPS enforced 308 https://mcp.wellstatelabs.com/mcp
MCP tools · 9 exposed · ~1,918 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
get_operator_exposure ~155

Returns one operator's SB 1150 screening exposure from the publication, by six-digit Railroad Commission of Texas operator number: wellbore claim counts (affected, approaching by 2042-09-01 (compliance-plan horizon), review, contested, shared), the Commission-published plugging cost summed over affected wellbores with its rate label, the crossing schedule by year as published and, on editions that carry the Full Wellbore cross-check, the affected claims whose wellbore that file flags as plugged (a cross-check only; it changes no outcome, count or cost).

NameTypeReqDescription
operator_numberstringyesSix-digit Railroad Commission of Texas operator number, with leading zeros (e.g. 276959).
NameTypeReqDescription
affected_costobjectyes–
boundarystringyes–
count_unitstringyes–
countsobjectyes–
crossing_schedulearrayyes–
crossing_schedule_basisobjectyes–
display_namestringyes–
full_wellbore_crosscheck_notestringyes–
linkstringyes–
namestringyes–
operator_numberstringyes–
publication_rootstringyes–
termsstringyes–

No examples provided.

get_plug_record ~391

Returns the publication's plug record (contract 1.4.0 and later): W-3 plug dates on the Railroad Commission of Texas Full Wellbore file, counted by the calendar year the operator reported and by district, as published. Without a district it returns the statewide count for each year and each district's count for each year. With a district it returns that district's years with state-funded plug numbers, well types and district bases. With rows_limit it pages the per-wellbore rows one district and one year's count is made of, each with the line of the Full Wellbore file it was read from. Every response carries the publication's claims with their labels (DOCUMENTED_FACT, INFERENCE, UNKNOWN), the two UNKNOWN claims that travel with every count, and the publication's statement of what the record is not. This server computes no figure from these counts and combines none with the screening counts. On an edition without a plug record the plug_record field is null.

NameTypeReqDescription
districtstring–A district key of the plug record: a Commission district (e.g. 08, 7C, 8A) or NOT_IN_SOURCE for wellbore-years the file gives no district. Omit for the statewide years and every district's counts.
first_yearinteger–First calendar year returned. Default: the first year of the plug record's window.
last_yearinteger–Last calendar year returned. Default: the last year of the plug record's window.
rows_limitinteger–Per-wellbore rows to return, 0-200. Default 0 (counts only). Rows are served for one district and one year per call: pass district, and first_year equal to last_year.
rows_offsetinteger–Rows to skip before the first one returned, for paging. Default 0.
NameTypeReqDescription
boundarystringyes–
contract_versionstringyes–
notestringyes–
plug_record–yes–
publication_rootstringyes–
termsstringyes–

No examples provided.

get_publication ~153

Describes the WellState SB 1150 screening publication served here: root hash, publication id, contract (schema) version, evaluation date, the Railroad Commission of Texas source file with its SHA-256, the screening rule parameters and headline counts, the Commission rate table the plugging costs were computed from, the manifest's Full Wellbore cross-check counts and, from contract 1.4.0, the plug record's basis with its claims and their labels (DOCUMENTED_FACT, INFERENCE, UNKNOWN), each when the edition carries it. The verified field is true when the bundled copy of the manifest recomputes to the pinned root hash and the derived-data attestation matches the digest pinned at build time.

Input schema present but exposes no named parameters.

NameTypeReqDescription
affected_commission_published_costobjectyes–
basisstringyes–
boundarystringyes–
contract_versionstringyes–
cost_rate_basis–yes–
countsobjectyes–
data_file_countintegeryes–
evaluation_datestringyes–
full_wellbore_crosscheck–yes–
how_to_citestringyes–
plug_record_basis–yes–
produced_atstringyes–
publication_idstringyes–
publication_rootstringyes–
ruleobjectyes–
source_filesarrayyes–
termsstringyes–
verificationobjectyes–
verifiedbooleanyes–
vintageobjectyes–

No examples provided.

get_well ~188

Returns one wellbore's screening record by its 8-digit API number as the Commission's Inactive Well Aging Report records it (county code + unique number, no 42 state prefix): lease, well number, district, county, months inactive, oldest well record date (RRC), screening outcome, date affected, per-operator evaluations, Commission-published plugging cost with the per-foot rate it was computed from (fiscal year, district, USD per foot) when the edition publishes it, the Full Wellbore plug flag and latest W-3 plug date as a cross-check when the edition carries it (it changes no outcome, count or cost), and source line references.

NameTypeReqDescription
apistringyesEight-digit API number as recorded in the IWAR: county code + unique number, no 42 prefix, no dashes (e.g. 00100001).
NameTypeReqDescription
affected_fromobjectyes–
apistringyes–
approachingbooleanyesNot AFFECTED at the evaluation date, and AFFECTED on the same rule, with no other change, by 2042-09-01 (compliance-plan horizon).
boundarystringyes–
commission_costobjectyes–
cost_basis–yes–
county–yes–
district–yes–
evaluationsarrayyes–
field_name–yes–
full_wellbore_crosscheck–yes–
lease_name–yes–
linkstringyes–
months_inactive–yes–
oldest_well_record_dateobjectyes–
operatorobjectyes–
outcomestringyes–
plug_status–yes–
publication_rootstringyes–
source_linesarrayyes–
source_lines_totalintegeryes–
termsstringyes–
total_depth_ft–yes–
well_number–yes–
well_type–yes–

No examples provided.

list_operator_wells ~269

Lists one operator's wellbore claims from the publication, filtered by outcome (AFFECTED, APPROACHING or ALL; default AFFECTED) and sorted by Commission-published plugging cost descending, unpriced wellbores last, then by API number. Returns one page of at most 100 rows plus the number matching and the Commission-published cost total over all matching rows (the same on every page). When more rows remain, next_cursor is set: pass it back as cursor, with the same operator_number and outcome, for the next page. A cursor is bound to the publication root that issued it.

NameTypeReqDescription
cursorstring–next_cursor from the previous page, unchanged. Omit for the first page. Refused when it was issued for another publication root, operator or outcome.
limitinteger–Maximum rows on this page, 1-100. Default 25.
operator_numberstringyesSix-digit Railroad Commission of Texas operator number, with leading zeros (e.g. 276959).
outcomestring–AFFECTED: affected at the evaluation date. APPROACHING: not affected then but affected by 2042-09-01 (compliance-plan horizon). ALL: every claim. Default AFFECTED.
NameTypeReqDescription
boundarystringyes–
display_namestringyes–
linkstringyes–
matching_commission_published_totalobjectyes–
matching_unpriced_countintegeryes–
next_cursorstring|nullyesPass as cursor for the next page; null on the last page.
offsetintegeryesPosition of this page's first row in the full sorted listing, from 0.
operator_numberstringyes–
outcome_filterstringyes–
publication_rootstringyes–
returnedintegeryes–
sortstringyes–
termsstringyes–
total_matchingintegeryes–
truncatedbooleanyesTrue when rows remain after this page.
wellsarrayyes–

No examples provided.

screen_book ~284

Screens a surety broker's book of up to 25 Railroad Commission of Texas operator numbers (principals) with the surety-book-v1 semantics: one row per principal in request order with the P-5 letter verbatim (A labelled active, D delinquent, any other letter unlabelled), claims on file, AFFECTED on the evaluation date, approaching within 24 months, the Commission-published cost proxy with the priced claim count and the rate label read from the publication's cost_rate_basis (a fiscal year's Commission rates, or the publication's own label verbatim when it establishes no table year), unpriced claims, the Full Wellbore flagged counts (a cross-check only) and the 16 TAC §3.78 blanket floor from inactive wells only (a lower bound, not a bond amount). Book totals are given only where a sum is valid; unpriced claims and the floors are NOT_SUMMED, with the reason. Wellbores two principals of the book both claim are disclosed with the claims and cost the totals count more than once. A principal not in the publication refuses the whole book rather than leave a row out.

NameTypeReqDescription
operator_numbersarrayyes1-25 six-digit Railroad Commission of Texas operator numbers as strings, each once (e.g. ["276959", "760218"]). The rows keep this order.
NameTypeReqDescription
blanket_floor_notestringyes–
boundarystringyes–
cost_notestringyes–
count_unitstringyes–
evaluation_datestringyes–
format_versionstringyes–
full_wellbore_crosscheck_notestringyes–
iwar_as_ofstringyes–
overlapobjectyes–
p5_notestringyes–
principalsintegeryes–
publicationobjectyes–
publication_rootstringyes–
rate_basisobjectyes–
reliancestringyes–
rowsarrayyes–
termsstringyes–
totalsobjectyes–
within_24_months_bystringyes–

No examples provided.

screen_operators ~247

Screens up to 200 Railroad Commission of Texas operator numbers at once and returns one row per requested operator, in request order: inactive wellbores on the IWAR, affected, approaching by 2042-09-01 (compliance-plan horizon), contested, review and shared claims, Commission-published plugging cost on affected wellbores with its rate label, unpriced affected count, on editions that carry the Full Wellbore cross-check the affected claims whose wellbore that file flags as plugged (a cross-check only; it changes no outcome, count or cost), the crossing schedule by bucket (empty buckets left out of the rows), the raw P-5 status code, and a 16 TAC §3.78 blanket-assurance floor computed from inactive wells only (a lower bound, not a bond amount). Operators not in the publication come back as found:false rows. Includes totals over the found rows.

NameTypeReqDescription
operator_numbersarrayyes1-200 Railroad Commission of Texas operator numbers as strings (e.g. ["276959", "760218"]). Shorter numeric strings are left-padded to 6 digits; duplicates are removed, keeping the first occurrence.
NameTypeReqDescription
blanket_floor_basisobjectyes–
boundarystringyes–
cost_labelstringyes–
count_unitobjectyes–
duplicates_removedintegeryes–
full_wellbore_crosscheck_notestringyes–
p5_status_code_notestringyes–
publication_rootstringyes–
requestedintegeryes–
rowsarrayyes–
screenedintegeryes–
termsstringyes–
totalsobjectyes–

No examples provided.

search_operators ~100

Finds operators whose Railroad Commission of Texas name contains the given text, case-insensitive. Returns up to 20 matches with operator number, display name, wellbore claims and affected count, ordered by affected count descending, then by name.

NameTypeReqDescription
limitinteger–Maximum results, 1-20. Default 20.
querystringyesPart of the operator name, e.g. formentera. 2-64 characters.
NameTypeReqDescription
boundarystringyes–
publication_rootstringyes–
querystringyes–
resultsarrayyes–
returnedintegeryes–
termsstringyes–
total_matchesintegeryes–
truncatedbooleanyes–

No examples provided.

verify_publication ~131

Recomputes the publication root hash from the manifest copy bundled with this server, reports the SHA-256 and byte count of each manifest data file as verified against the manifest when the server was built (all files, or the given paths), and re-hashes every bundled derived index file against its build attestation. Also returns the manifest URL and file URL template for an independent check, and the manifest's Full Wellbore cross-check counts when the edition carries them.

NameTypeReqDescription
pathsarray–Manifest data_files paths to report (e.g. data/operator.ndjson). Omit to report every file.
NameTypeReqDescription
all_matchbooleanyes–
boundarystringyes–
derivedobjectyes–
elapsed_msintegeryes–
filesarrayyes–
files_checkedintegeryes–
files_matchedintegeryes–
full_wellbore_crosscheck–yes–
independent_checkobjectyes–
publication_rootstringyes–
rootobjectyes–
termsstringyes–

No examples provided.

Install

How do I install the WellState Labs SB 1150 Screening (read-only) MCP server?

WellState Labs SB 1150 Screening (read-only) is a hosted endpoint at https://mcp.wellstatelabs.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · mcp.wellstatelabs.com

# add to Claude Code
claude mcp add --transport http com-wellstatelabs-sb1150-screening 'https://mcp.wellstatelabs.com/mcp'
Common questions

What is the WellState Labs SB 1150 Screening (read-only) MCP server?

WellState Labs SB 1150 Screening (read-only) is an MCP server listed in the public MCP registry as com.wellstatelabs/sb1150-screening. Signed Texas SB 1150 screens. Cost proxies, not ARO, not legal determinations, not bond amounts. This page covers its hosted endpoint (https://mcp.wellstatelabs.com/mcp).

Is the WellState Labs SB 1150 Screening (read-only) MCP server safe to use?

WellState Labs SB 1150 Screening (read-only) scores 76 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the WellState Labs SB 1150 Screening (read-only) MCP server expose?

WellState Labs SB 1150 Screening (read-only) exposes 9 tools: get_publication, verify_publication, get_operator_exposure, search_operators, get_well, and 4 more. Their descriptions and schemas cost roughly 1,918 tokens of context every time the server is loaded.

Does the WellState Labs SB 1150 Screening (read-only) MCP server require authentication?

No. We connected to WellState Labs SB 1150 Screening (read-only) without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the WellState Labs SB 1150 Screening (read-only) MCP server still maintained?

WellState Labs SB 1150 Screening (read-only) is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What did VerifyMCP test on the WellState Labs SB 1150 Screening (read-only) MCP server?

VerifyMCP ran 13 checks on WellState Labs SB 1150 Screening (read-only), covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.