# io.carrierscore/carrierscore (remote · mcp.carrierscore.io)

FMCSA motor-carrier risk scores, monitoring, and carrier-selection evidence reports for AI agents.

- Trust score: 65/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-20

## Components

- remote · `mcp.carrierscore.io`: 65/100 (this document), [markdown](https://verifymcp.io/servers/io-carrierscore-carrierscore/mcp.md), [page](https://verifymcp.io/servers/io-carrierscore-carrierscore/mcp)

## Channel facts

- Endpoint: `https://mcp.carrierscore.io/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.1.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-20.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 63/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3092 tokens (~386/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 13/100
  - Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http io-carrierscore-carrierscore https://mcp.carrierscore.io/mcp
```

### Codex

```toml
[mcp_servers.io-carrierscore-carrierscore]
url = "https://mcp.carrierscore.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-carrierscore-carrierscore": {
      "type": "remote",
      "url": "https://mcp.carrierscore.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-carrierscore-carrierscore --url https://mcp.carrierscore.io/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-carrierscore-carrierscore:
    url: "https://mcp.carrierscore.io/mcp"
```

### Other

```json
{
  "mcpServers": {
    "io-carrierscore-carrierscore": {
      "type": "http",
      "url": "https://mcp.carrierscore.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-20 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-18 (score 64, 0)

- [security] Tool “carrier_lookup” rewrote its description, which is the text the model reads
- [security] Tool “carrier_score” rewrote its description, which is the text the model reads
- [security] Tool “list_alerts” rewrote its description, which is the text the model reads
- [security] Tool “monitor_carriers” rewrote its description, which is the text the model reads
- [security] Tool “montgomery_file” rewrote its description, which is the text the model reads
- [security] Tool “save_carrier_list” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 317 → 386
- [functional] Server version: 0.2.0 → 0.4.0
- [functional] New tool “audit_entries”
- [functional] New tool “verify_evidence”
- [cosmetic] Tool “carrier_score” changed its title: Get Carrier Risk Score → Get Carrier Risk Indices

### 2026-08-17 (score 64, 0)

- [security] Tool “carrier_score” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 275 → 317
- [functional improvement] Stability: unverified → 0.03
- [functional] New tool “list_alerts”
- [functional] New tool “save_carrier_list”

### 2026-08-16 (score 64)

First indexed and scored.

## MCP tools (8)

### `carrier_lookup` (~210 tokens)

Look Up Carrier Identity

Look up an FMCSA-registered motor carrier's identity by US DOT number: legal name, DBA, operating status, FMCSA safety rating, fleet size (power units, drivers), physical address, and registration dates.

Use this first when a booking/dispatch agent needs to confirm WHO a carrier is — that a DOT number is real, active, and matches the company name on a rate confirmation. It does not return risk indices (use carrier_score for those).

Returns JSON: { dot_number, legal_name, dba_name, status_code, safety_rating, power_units, total_drivers, phy_street, phy_city, phy_state, phy_zip, add_date, mcs150_date }.

Errors: 404 if the DOT is not in the FMCSA census (likely a typo or a fraudulent/never-registered carrier — treat as a red flag for booking).

Input parameters:

- `dot_number` (string, required): US DOT number of the carrier, digits only (e.g. "1234567")

Output parameters:

- `add_date`: Date added to the FMCSA census (YYYY-MM-DD)
- `dba_name`: Doing-business-as name, if any
- `dot_number` (string): US DOT number
- `legal_name` (string|null): Registered legal name
- `mcs150_date`: Latest MCS-150 filing date (YYYY-MM-DD)
- `phy_city`
- `phy_state`
- `phy_street`
- `phy_zip`
- `power_units` (number|null): Fleet size: number of power units
- `safety_rating`: FMCSA safety rating code (e.g. "S" = satisfactory)
- `status_code`: FMCSA operating status code (e.g. "A" = active)
- `total_drivers`: Total drivers reported

### `carrier_score` (~582 tokens)

Get Carrier Risk Indices

Get the CarrierScore risk indices for a carrier by US DOT number: two first-class, separately validated indices (0-100, HIGHER = RISKIER), each with a full component breakdown.

This is the core "is this carrier safe to book?" signal for AI booking agents. Served methodology v0.5 returns TWO indices, both population-relative and built from point-in-time public FMCSA data:
  \- inspection_risk — inspection / compliance risk: violations and out-of-service rates per roadside inspection (24-month chronic, 6-month acute). Historically validated against the carrier's future out-of-service rate (validation block on the index).
  \- crash_risk — crash risk: reportable crashes, fatal/injury crashes and tow-away crashes per roadside inspection (24 months). Historically validated against future reportable crashes (validation block on the index).
Present BOTH indices; do not collapse them into one number. Hard flags (active out-of-service order, no active insurance filing, high-confidence reincarnated-carrier link) add explicit surcharges — a carrier with any flag deserves extra scrutiny regardless of index values.

Returns JSON: { dot_number, legal_name, inspection_risk: { label, description, score, base, surcharge, percentile_basis, band, band_note, data_sufficiency, components: { <name>: { label, value, percentile, weight } }, validation: { auc_holdout, label, holdout_origins, post_selection_origin, source, text } }, crash_risk: { ...same shape... }, legacy_composite: { score, base_score, surcharge, rule, rule_text, validated: false, note }, carrier_score (backward-compatible: == legacy_composite.score under v0.5), base_score, surcharge, score_version ("0.5"), methodology_note, components (flat, backward-compatible), flags: string[], data_sufficiency (0-1, share of the components resting on observed vs neutral-imputed data), scored_as_of, disclaimer }. Older opt-in methodologies keep their shapes: v0 (six components), v0.3 (sub_indices), v0.4 (indices + composite).

Interpret…

Input parameters:

- `dot_number` (string, required): US DOT number of the carrier, digits only (e.g. "1234567")

Output parameters:

- `base_score`: Score before hard-flag surcharges (v0.5: legacy composite base)
- `carrier_score` (number|null): 0-100, higher = riskier. Under v0.5 this equals legacy_composite.score (kept for backward compatibility); under v0/v0.3/v0.4 it is that version's headline score
- `components` (object): Flat component map keyed by component name (v0.5: within-index weights of both indices, for backward compatibility; the per-index components live under inspection_risk / crash_risk)
- `composite` (object): v0.4 only: how the headline carrier_score is derived from the two indices
- `crash_risk`: v0.5 (served default): CRASH RISK index 0-100 (higher = riskier) — crashes, fatal/injury and tow-away crashes per roadside inspection relative to the population; validated against future reportable c…
- `data_sufficiency`: 0-1: share of the score resting on observed vs neutral-imputed data
- `disclaimer` (string): Methodology disclaimer — relay verbatim
- `dot_number` (string): US DOT number
- `flags` (array): Hard flags (OOS order, no insurance, reincarnation link)
- `indices` (object): v0.4 only: inspection_risk / crash_risk first-class indices (0-100), each with components, percentile basis and band
- `inspection_risk` (object): v0.5 (served default): INSPECTION / COMPLIANCE RISK index 0-100 (higher = riskier) — violations and out-of-service rates per roadside inspection relative to the population; validated against future o…
- `legacy_composite` (object): v0.5: backward-compatible legacy composite (0.70 x higher index + 0.30 x lower index + surcharges). Not validated, not the headline — do not present it as the carrier's risk score.
- `legal_name` (string|null)
- `methodology_note`: One-line description of the weighting used
- `score_version`: Documented methodology version ("0.5" is the served default; "0", "0.3", "0.4" are opt-in)
- `scored_as_of`: Date of the scoring run (YYYY-MM-DD)
- `sub_indices` (object): v0.3 only: inspection_risk / crash_risk sub-indices (0-100) and their weights
- `surcharge`: Additional points from hard flags

### `montgomery_file` (~530 tokens)

Generate Montgomery Evidence File

Generate a timestamped Montgomery file — a carrier-selection evidence report — for a carrier by US DOT number.

Since Montgomery v. Caribe Transport II (SCOTUS, May 2026), freight brokers are exposed to state-law negligent-selection claims and need documented, timestamped, safety-data-based carrier selection. This report is that artifact: the two risk indices (inspection / compliance risk and crash risk, each with its components, percentiles, activity-band context and its own historical-validation line), the legacy composite (labelled backward-compatibility only), hard flags, FMCSA safety rating, and the methodology disclaimer, dated as of the scoring run. A booking agent should generate and retain this file at the moment a carrier is selected for a load.

Args:
  \- dot_number: US DOT number, digits only
  \- format: "text" (default; the filing-ready plain-text report, available on the free tier) or "json" (structured fields; requires an API key on the monitor or compliance tier)

Returns: format="text" gives the plain-text report (structured field report_text); format="json" gives structured fields { report, generated, dot_number, legal_name, dba_name, safety_rating, status_code, power_units, inspection_risk, crash_risk, legacy_composite (v0.5), carrier_score (backward-compatible), components, flags, data_sufficiency, score_version, scored_as_of, disclaimer } (v0.4 parquets return indices + composite instead). Every report embeds the disclaimer verbatim — keep it when storing or quoting the report.

Audit archive (paid tiers): every report generated with an API key is stored immutably server-side and the result carries audit_entry_id + sha256 (SHA-256 of the plain-text report). Quote both when citing the report; later, verify_evidence(entry_id) proves the archived copy is unchanged and audit_entries lists what was generated. Monitor keys can retrieve the last 90 days (2,000 reports/month); Compliance keys have unlimited retention and reports.

Errors: 403 if format…

Input parameters:

- `dot_number` (string, required): US DOT number of the carrier, digits only (e.g. "1234567")
- `format` (string): "text" = filing-ready report (free tier); "json" = structured fields (requires API key)

Output parameters:

- `audit_entry_id` (string): Paid tiers: id of the immutable archived copy of this report (use with verify_evidence / audit_entries)
- `base_score`
- `carrier_score`: 0-100, higher = riskier (v0.5: == legacy_composite.score)
- `components` (object)
- `composite` (object)
- `crash_risk`: v0.5: crash risk index with components and validation
- `data_sufficiency`
- `dba_name`
- `disclaimer` (string)
- `dot_number` (string)
- `flags` (array)
- `generated` (string|null): Report generation date (YYYY-MM-DD)
- `indices` (object)
- `inspection_risk` (object): v0.5: inspection / compliance risk index with components and validation
- `legacy_composite` (object): v0.5: legacy composite, backward compatibility only
- `legal_name`
- `methodology_note`
- `power_units` (number|null)
- `report` (string): Report title line (format="json")
- `report_text` (string): Filing-ready plain-text evidence report (format="text")
- `safety_rating`
- `score_version`
- `scored_as_of`
- `sha256` (string): Paid tiers: SHA-256 of the archived plain-text report — cite it alongside the entry id
- `status_code`
- `sub_indices` (object)
- `surcharge`

### `monitor_carriers` (~284 tokens)

Monitor Carrier List

Batch risk check for a list of carriers by US DOT number (max 100 per call): score summary and hard flags for each.

Use when an agent is screening multiple candidate carriers for a load, or re-checking a broker's active carrier roster ("did any of my carriers pick up an out-of-service order or drop insurance?"). For a full breakdown of any single carrier that looks risky here, follow up with carrier_score or montgomery_file.

Args:
  \- dot_numbers: array of DOT number strings, 1-100 entries

Returns JSON: { scored_as_of, requested, found, carriers: [{ dot_number, legal_name, inspection_risk (0-100 inspection / compliance risk index, higher = riskier), crash_risk (0-100 crash risk index), carrier_score (legacy composite under v0.5 — backward compatibility only; use the two indices), data_sufficiency, flags: string[] }], not_found: string[], disclaimer }. DOTs in not_found are absent from the scored population — verify them with carrier_lookup; an unknown DOT on your roster is itself a red flag.

Errors: 400 if the list is empty or exceeds 100 (split into batches); 503 if scores are not computed yet.

Input parameters:

- `dot_numbers` (array, required): US DOT numbers to check, 1-100 per call

Output parameters:

- `carriers` (array): Score summary per found carrier
- `disclaimer` (string): Methodology disclaimer — relay verbatim
- `found` (number): How many were found in the scored population
- `not_found` (array): Requested DOTs absent from the scored population
- `requested` (number): How many DOT numbers were requested
- `scored_as_of` (string|null): Date of the scoring run (YYYY-MM-DD)

### `save_carrier_list` (~456 tokens)

Save Carrier List for Daily Monitoring

Save a named list of carriers (by US DOT number) for continuous monitoring. Requires a paid CarrierScore API key (Monitor or Compliance tier) — connect with your key via OAuth (or set CARRIERSCORE_API_KEY on a self-hosted server); the free tier gets a 403 with an upgrade link.

Once saved, CarrierScore diffs every carrier on the list against the previous day's scoring run after each daily run and records alerts: new out-of-service order (critical), operating authority lost (critical), insurance filing lapsed (high), operating status leaving Active (high), risk score up 10+ points (medium), high-confidence reincarnated-carrier link appearing (medium). Alerts are always retrievable with list_alerts; optionally they are also pushed to a webhook (JSON POST, HMAC-signed via the X-CarrierScore-Signature header with the per-key secret from GET /v1/lists) and/or summarized in one daily digest email.

Use this when a broker asks to "watch" or "keep an eye on" their carrier roster. Caps: 500 DOTs total across all lists on the Monitor tier, 5000 on Compliance; up to 50 lists per key. Saving the same DOT twice in one list is deduped.

Args:
  \- name: short label for the list (1-100 chars)
  \- dot_numbers: array of DOT number strings (1-8 digits each)
  \- webhook_url (optional): https URL to POST new alerts to
  \- email (optional): address for the daily digest

Returns JSON: { list_id, name, dots, created, updated, webhook_url?, email? }. Keep list_id — list_alerts needs it.

Errors: 403 without a paid key; 400 on invalid DOTs, empty list, or exceeding the tier cap (message says which); 401 bad key.

Input parameters:

- `dot_numbers` (array, required): US DOT numbers to monitor
- `email` (string): Optional daily digest email
- `name` (string, required): List name, e.g. "Active roster Q3"
- `webhook_url` (string): Optional https URL to receive alert POSTs

Output parameters:

- `created` (string): Creation timestamp (ISO 8601 UTC)
- `dots` (array): US DOT numbers on the list (deduped)
- `email` (string): Daily digest email, if configured
- `list_id` (string): Saved list id (lst_...) — use with list_alerts
- `name` (string): List name
- `updated` (string): Last update timestamp (ISO 8601 UTC)
- `webhook_url` (string): Alert webhook URL, if configured

### `list_alerts` (~390 tokens)

Get Alerts for a Saved Carrier List

Retrieve the alert history for a saved carrier list (see save_carrier_list), newest first. Requires the same paid API key that saved the list.

Each alert records one change detected between consecutive daily scoring runs for one carrier: type (oos_order_activated, authority_lost, insurance_lapsed, status_changed, inspection_risk_jump, crash_risk_jump, score_jump, reincarnation_link), severity (critical / high / medium / low), the field that changed with its before/after values, the DOT and legal name, and the scoring dates compared. inspection_risk_jump / crash_risk_jump (index base up >= 10 points, medium) are the primary deterioration signals; score_jump on the legacy composite is emitted at low severity for backward compatibility. Use it to answer "did anything change on my carrier list?" — critical alerts (new OOS order, authority lost) mean the carrier should not be dispatched until verified; follow up with carrier_score or montgomery_file for the full picture.

Args:
  \- list_id: the lst_... id returned by save_carrier_list
  \- since (optional): YYYY-MM-DD; only alerts from scoring runs on/after this date

Returns JSON: { list_id, since, count, alerts: [{ ts, as_of, prev_as_of, list_id, list_name, dot, legal_name, type, severity, field, before, after }] }. An empty alerts array means no monitored change since the given date (alerts only exist once two daily scoring runs have happened).

Errors: 403 without a paid key; 404 if the list id is unknown for this key; 400 if since is not YYYY-MM-DD.

Input parameters:

- `list_id` (string, required): Saved list id from save_carrier_list
- `since` (string): Only alerts from scoring runs on/after this date (YYYY-MM-DD)

Output parameters:

- `alerts` (array): Alert history, newest first
- `count` (number): Number of alerts returned
- `list_id` (string)
- `since` (string|null): Lower bound applied (YYYY-MM-DD) or null

### `audit_entries` (~295 tokens)

List Archived Evidence Reports

List the immutable audit-archive entries for the caller's API key: every Montgomery evidence report the key generated (text or json), newest first, each with its entry id, generation timestamp, DOT number, scoring date, methodology version and the SHA-256 of the archived report text. Requires a paid CarrierScore API key.

Use it to answer "which carriers did we generate evidence for, and when?" and to find the entry id to cite or verify for a given carrier and date. Monitor keys see the last 90 days; Compliance keys see everything ever archived.

Args:
  \- dot_number (optional): only entries for this US DOT number
  \- since (optional): YYYY-MM-DD; only entries generated on/after this date (UTC)
  \- limit (optional): 1-500, default 50

Returns JSON: { tier, retention_days, total_entries, matched, count, entries: [{ entry_id, generated_at, dot_number, sha256, format_requested, scored_as_of, score_version }] }.

Errors: 403 without a paid key; 400 if since is malformed.

Input parameters:

- `dot_number` (string): US DOT number of the carrier, digits only (e.g. "1234567")
- `limit` (integer): Max entries to return (default 50)
- `since` (string): Only entries generated on/after this date (YYYY-MM-DD, UTC)

Output parameters:

- `count` (number): Entries returned (<= limit)
- `entries` (array): Newest first
- `matched` (number): Entries matching the filters within the retention window
- `retention_days` (number|null): Retrieval window in days (monitor 90; compliance null = unlimited)
- `tier` (string): Caller's tier (monitor / compliance)
- `total_entries` (number): All entries ever archived for this key

### `verify_evidence` (~345 tokens)

Verify Archived Evidence Report Hash

Verify an archived Montgomery evidence report by its audit entry id: CarrierScore re-reads the immutable stored copy, recomputes its SHA-256 and reports whether it matches the hash recorded at generation time (and, optionally, a hash the caller supplies — e.g. the sha256 printed on a broker's filed copy). Requires the same paid API key that generated the report.

Use it when a broker or auditor needs to prove that a filed evidence report is exactly what CarrierScore produced on the stated date. match=true means the archived report is byte-identical to what was served; match_supplied compares against the caller's own hash. Follow up with the audit_entries list to find ids, or with montgomery_file to generate a fresh report.

Args:
  \- entry_id: the audit_entry_id returned by montgomery_file (also listed by audit_entries)
  \- sha256 (optional): a 64-hex SHA-256 to compare against the archived report (text or canonical json)

Returns JSON: { entry_id, dot_number, generated_at, scored_as_of, score_version, format_requested, sha256_stored, sha256_computed, match, sha256_json_stored, sha256_json_computed, match_json, sha256_supplied?, match_supplied? }.

Errors: 403 without a paid key, or (Monitor tier) if the entry is older than the 90-day retrieval window; 404 if the entry id is unknown for this key.

Input parameters:

- `entry_id` (string, required): Audit entry id from montgomery_file / audit_entries
- `sha256` (string): Optional SHA-256 to compare against the archived report

Output parameters:

- `dot_number` (string|null)
- `entry_id` (string)
- `format_requested` (string|null)
- `generated_at` (string|null)
- `match` (boolean): true = the archived report is byte-identical to what was served
- `match_json` (boolean|null)
- `match_supplied` (boolean): Whether the supplied hash matches the archived report
- `score_version` (string|null)
- `scored_as_of` (string|null)
- `sha256_computed` (string): Hash recomputed now from the stored report text
- `sha256_json_computed` (string|null)
- `sha256_json_stored` (string|null)
- `sha256_stored` (string|null): Hash recorded when the report was archived
- `sha256_supplied` (string): Echo of the hash the caller supplied, if any

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-carrierscore-carrierscore/mcp#diagnostics

## Score history

- 2026-08-20: 65
- 2026-08-19: 64
- 2026-08-18: 64
- 2026-08-17: 64
- 2026-08-16: 64

## Links

- Remote endpoint: https://mcp.carrierscore.io/mcp
- Repository: https://github.com/csprout3/carrierscore-mcp
- Website: https://carrierscore.io/
- Changelog RSS feed: https://verifymcp.io/servers/io-carrierscore-carrierscore/mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-carrierscore-carrierscore/mcp.json
- HTML version of this page: https://verifymcp.io/servers/io-carrierscore-carrierscore/mcp