Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Openreview

REMOTE · GATEWAY.PIPEWORX.IO · 2 COMPONENTS

OpenReview MCP — ML conference submissions and reviews (API v2)

+3 this week 77 Trust /100

Last scanned (17 hours ago)

Scores higher than 69% of remote servers

Reachable. Last reached 5 Nov 2026.

Category Education and Research

Recent critical change

Authorization (30 Oct 2026). See the changelog before you install this server.

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security81
Transport & Reachability100
Schema Quality & AI Usability82
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 23798 tokens (~475/item across 50 items; 50 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Tools include usage examples.Pass
Stability & Change Management33
  • Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (18% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 51 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities40
  • Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28. See how to fix → Fail
What we tested

Checks we ran (13)

  • TLS certificate
  • Authorization
  • HTTPS
  • HSTS header
  • DNSSEC
  • Transport
  • Schema quality
  • Stability
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Does not apply to this hosted endpoint (2)

  • Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
  • Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +15
    • Authorization: fail → pass ▲ security
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “ask_pipeworx_beta” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx_grounded” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx” rewrote its description, which is the text the model reads security
    • Tool “deep_research” rewrote its description, which is the text the model reads security
    • Stability: fail → 0.30 functional
  • 3 Nov 26 0
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “ask_pipeworx” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx_beta” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx_grounded” rewrote its description, which is the text the model reads security
    • Tool “deep_research” rewrote its description, which is the text the model reads security
  • 2 Nov 26 +1
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “ask_pipeworx_grounded” rewrote its description, which is the text the model reads security
    • Tool “deep_research” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx_beta” rewrote its description, which is the text the model reads security
  • 31 Oct 26 +1
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “ask_pipeworx_beta” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx_grounded” rewrote its description, which is the text the model reads security
    • Tool “deep_research” rewrote its description, which is the text the model reads security
  • 30 Oct 26 −14
    • Authorization: pass → fail ▼ critical
    • Stability: 0.10 → fail ▼ security
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “ask_pipeworx” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx_beta” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx_grounded” rewrote its description, which is the text the model reads security
    • Tool “compare_entities” rewrote its description, which is the text the model reads security
    • Tool “deep_research” rewrote its description, which is the text the model reads security
  • 29 Oct 26 +15
    • Authorization: fail → pass ▲ security
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “deep_research” rewrote its description, which is the text the model reads security
    • Tool “bet_research” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx_grounded” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx_beta” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx” rewrote its description, which is the text the model reads security
    • Stability: fail → 0.10 functional
    • “bet_research” reworded the description of “market” cosmetic
  • 28 Oct 26 0
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “polymarket_kalshi_spread” rewrote its description, which is the text the model reads security
    • Tool “deep_research” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx_grounded” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx_beta” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx” rewrote its description, which is the text the model reads security
    • New tool “updown_divergence_rate” functional
    • New tool “updown_venue_compare” functional
    • “polymarket_kalshi_spread” reworded the description of “topic” cosmetic
  • 27 Oct 26 −14
    • Authorization: pass → fail ▼ critical
    • Stability: unverified → fail ▼ security
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “deep_research” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx_beta” rewrote its description, which is the text the model reads security
    • Tool “ask_pipeworx_grounded” rewrote its description, which is the text the model reads security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://gateway.pipeworx.io/openreview/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=pipeworx.io CN=WE1,O=Google Trust Services,C=US 19 Sept 2026 18 Dec 2026 ECDSA 256 ECDSA-SHA256 907077ac952af983139424aa9b807ef7
SANs: pipeworx.io, gateway.pipeworx.io, *.gateway.pipeworx.io
CN=WE1,O=Google Trust Services,C=US (CA) CN=GTS Root R4,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 ECDSA 256 ECDSA-SHA384 7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 15 Nov 2023 28 Jan 2028 ECDSA 384 SHA256-RSA 7fe530bf331343bedd821610493d8a1b

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of gateway.pipeworx.io. — Not signed

Zone DS Keys Algorithms Outcome
. Trust anchor 20326, 38696 8, 8 Verified
io. DS published 38690 8 Verified
pipeworx.io. No DS Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer resource_metadata="https://gateway.pipeworx.io/.well-known/oauth-protected-resource/openreview/mcp" scope="pipeworx:read"

Bearer resource_metadata="https://gateway.pipeworx.io/.well-known/oauth-protected-resource/openreview/mcp" scope="pipeworx:read"

Protected resource metadata

Document https://gateway.pipeworx.io/.well-known/oauth-protected-resource/openreview/mcp
Retrieved Yes
Resource https://gateway.pipeworx.io/openreview/mcp
Authorisation server https://gateway.pipeworx.io

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://gateway.pipeworx.io/openreview/mcp Verified 200
http (plaintext) http://gateway.pipeworx.io/openreview/mcp Served over HTTP 200
MCP tools · 50 exposed · ~23,567 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
resolve_entity ~654

"What's the ticker for…" / "find the CIK for…" / "what's the LEI for…" / "what's the RxCUI for…" / "look up the ID for…" / "what is X's official identifier" / "who owns X" / "is X a subsidiary of Y" — resolve a user-spoken NAME to the canonical/official identifiers other tools require as input. Use FIRST whenever you have a name but need an ID. SUPPORTED TYPES: "company" (cross-source identity spine: 10-digit CIK + ticker + company_name from SEC EDGAR, legal-entity LEI from GLEIF with parent/ultimate-parent/children ownership when the LEI resolves, and security FIGI from OpenFIGI — by exact ticker map when a ticker is implied, and otherwise by name search, so NON-EQUITY instruments that never have a ticker (municipal and corporate bonds, notes, authority debt) DO resolve here; when a name matches more than one instrument it asserts nothing and returns `figi_candidates` to pick from, which is the correct answer to an issuer name that does not identify a single bond; every identifier is labelled with the source that established it, and an identifier that could NOT be resolved is stated explicitly under `unresolved` rather than omitted — accepts ticker, CIK, ISIN, or company name as input; an ISIN like "CH0038863350" resolves to the LEGAL ENTITY that issued the security via the GLEIF ISIN-to-LEI mapping, covering non-US issuers EDGAR cannot reach), "drug" (returns RxCUI + ingredient + brand from RxNorm + pipeworx://rxnorm/concept/{rxcui} citation; accepts brand or generic name). LEI/FIGI enrichment degrades gracefully — if GLEIF or OpenFIGI is unavailable, the EDGAR identifiers still return. Each call cascades through several lookup endpoints internally — using resolve_entity replaces 2-3 manual lookups.

NameTypeReqDescription
countrystring–OPTIONAL ISO 3166-1 alpha-2 of the country whose business register you mean ("NO", "FI", "JP", "GB", "FR", "EE", "BR"). Narrows the national-register fan-out and is often the difference between the r…
typestringyesEntity type: "company" or "drug".
valuestringyesFor company: ticker (AAPL), CIK (0000320193), or name. For drug: brand or generic name (e.g., "ozempic", "metformin"). Pass the ENTITY NAME ONLY — for a bond that is the ISSUER exactly as printed ("N…
NameTypeReqDescription
brandstring––
candidatesarray–Rivals, best first. Populated on "ambiguous" and on "matched" alike.
cik_withheldstring–A CIK that came back from a FUZZY SEC name match and is NOT asserted, because the spine matched a stronger non-US candidate, or `match_status` is "ambiguous" or "incomplete" and the SEC hit was not a…
company_name_withheldstring–The company name of a FUZZY SEC name match that is NOT asserted, withheld together with `cik_withheld`. See `unresolved.cik`.
fanout_incompleteobject–Present IFF at least one register in `searched[]` carried an `error` — set even when `match_status` stayed "ambiguous". `withheld_match` is the candidate this call declined to ASSERT because a regist…
figi_withheldstring–A FIGI that is NOT asserted. Either it matched this name in OpenFIGI (`figi_match: "name_search"`) while `match_status` is "incomplete" — a name search cannot tell a company apart from a security car…
idsobjectyesEvery identifier established: cik, ticker, company_name, lei, figi, isin, cusip, register_id, register_country. A key absent here appears in `unresolved` with a reason — never silently dropped.
ingredientstring––
lei_withheldstring–A LEI that is NOT asserted: it matched the bare string exactly in GLEIF, but `match_status` is "ambiguous" or "incomplete" so the registers cannot say which company that string means, and a GLEIF hit…
match_explanationstring–Plain words. Always present when the spine ran, and required on "ambiguous" and "no_match".
match_scoringobject–The margin rule's own inputs, so a caller can see WHY it fell where it did.
match_statusstring–The headline to branch on. "ambiguous" is an ANSWER, not a failure: two companies matched the name equally well and both are in `candidates`. "no_match" means every register in `searched` was asked a…
notesstring––
querystringyes–
registersarray–The matched entity as every register that carries it — the match (flagged `matched: true`) plus anything that collapsed into it. A Companies House number AND the LEI that crosswalks to it are the SAM…
relatedarray–Entities that collapsed INTO the match, each carrying `collapsed_by`.
resolvedbooleanyesAt least one identifier was established. Read `match_status` and `unresolved` for WHICH — a company can be resolved in a national register with no CIK at all.
resourcesobject––
searchedarray–EVERY register asked, with its own as-of date and row count. A register that could not be reached carries `error` — 0 rows with an error is "we could not ask", 0 rows without one is "nothing is there…
sec_alternativesarray–EDGAR's other name-matching candidates: distinct companies, deduped by CIK, excluding this issuer's own share classes — surfaced instead of dropped so a caller can tell a genuinely CONTESTED name mat…
sourcesobjectyesPer-identifier provenance. Every key in `ids` has a matching key here.
ticker_withheldstring–The ticker of a FUZZY SEC name match that is NOT asserted, withheld together with `cik_withheld` because it is the same guess. Carried so a caller who meant the US filer can still use it; see `unreso…
typestringyes–
unresolvedobjectyesPer-identifier reason an id could NOT be established — the honest twin of `ids`.
{"type":"company","value":"AAPL"}
scan_competitor_ai_presence ~225

Compare AI visibility across multiple entities side-by-side. Probes each entity (your brand + N competitors) with ai_visibility_check, ranks by score, surfaces which is most/least recognized. Useful for competitive AI-marketing audits: "does Claude know about us as well as our competitors?". Returns ranked list with score, confidence, signal density per entity.

NameTypeReqDescription
_apiKeystring–Optional Anthropic API key — only if "anthropic" is in models. Passed to api.anthropic.com per probe.
contextstring–Optional shared context applied to every probe (e.g. "B2B SaaS", "Boston restaurant"). Disambiguates common names.
entitiesarrayyesArray of 2-8 entities to compare (brand/business/product names). First entry treated as the "subject" for narrative; rest are competitors.
modelsarray–Which models to probe. Supported: "workers-ai" (free default), "anthropic" (requires _apiKey). Omit for just workers-ai.

No output schema declared.

{"entities":["Pipeworx","Zapier"]}
scan_dependency ~254

Composite "should I add this npm package to my project" check in ONE call — fans out across deps.dev (license + advisories + version history) and bundlephobia (gzipped/minified bundle size, dependency count, ESM/tree-shake support). Use whenever an agent asks "is X safe / popular / small" or "what does adding lodash cost me". Returns a summary block (is_latest, license, published_at, advisory_count, bundle_kb_min, bundle_kb_gz, dependency_count, has_esm, tree_shakeable), per-advisory detail, links, and a list of recent alternative versions. NPM ecosystem only in v1; PyPI / Maven / Cargo / Go fall under deps.dev:version directly. Partial failures degrade gracefully — bundlephobia's first measurement on a new version can take 5-30s; sources_failed will list it if it times out, the rest still returns.

NameTypeReqDescription
packagestringyesnpm package name. Scoped packages (e.g. "@types/node") are accepted.
versionstring–Specific version to check (e.g., "18.3.1"). Defaults to the latest published version when omitted.

No output schema declared.

{"package":"left-pad"}
search_notes ~171

Full-text search across OpenReview notes (papers, reviews, decisions) by query string; optionally restrict to a content field (e.g. title, abstract) or filter by author signature; returns matching note ids, titles, and venues.

NameTypeReqDescription
content_fieldstring–Restrict to a content field (e.g. "title", "abstract")
limitnumber–1-1000 (default 25)
offsetnumber–0-based offset
querystringyesFree-text query
signaturestring–Filter by signature group (e.g. author profile id)
venue_idstring–Restrict to one venue group id, e.g. "ICLR.cc/2024/Conference" (use list_venues to find it).
NameTypeReqDescription
countnumber–Total number of matching notes
notesarray–Search results
{"query":"transformer attention mechanism"}
{"limit":10,"query":"diffusion","venue_id":"ICLR.cc/2024/Conference"}
{"content_field":"abstract","limit":50,"query":"neural scaling laws"}
search_within ~238

Semantic search INSIDE a fetched record. Pass the text you already pulled (e.g. a SEC 10-K body, an article, a long tool result) plus a natural-language query; get back the top-N passages with character offsets and similarity scores. Use when the record is too big to cram into the prompt — search_within saves context, returns only the passages that matter, and every passage carries an offset so the agent can verify a verbatim quote. Pairs with ask_pipeworx_grounded: fetch with the gateway, ground over the relevant passages instead of the whole document. BGE-base-en embeddings + cosine over 500-char overlapping windows; cap is 200K chars (longer inputs are truncated and flagged).

NameTypeReqDescription
limitnumber–Max passages to return (1-20, default 5).
querystringyesNatural-language query — what passages do you want? E.g. "supply-chain risk", "fiscal year 2024 revenue", "drug interactions with warfarin".
textstringyesThe document text to search inside (max ~200K chars).

No output schema declared.

{"query":"supply-chain risk","text":"Apple Inc. reported fiscal 2023 revenue of $383.285 billion, driven by strong iPhone and Services growth. Net income was $96.995 billion. The company faced supply-chain risk in China during the quarter."}
subscribe ~943

Create a proactive monitoring subscription to a live-data event stream. Returns the new subscription id. Requires a Pipeworx OAuth account (anonymous + BYO cannot persist subscriptions). Supported types: "sec_8k" (8-K filings matching ticker + item codes — e.g. items:["5.02"] = officer change), "polymarket_edge" (Polymarket↔Kalshi cross-venue mispricings — params:{topic:"fed"}), "fred_series" (new FRED observations — params:{series_id:"UNRATE"}), "patent_grant" (new USPTO grants for an applicant), "clinical_trial" (new/updated ClinicalTrials.gov studies), "form_d" (new SEC Form D fundraise notices — params:{state?, industry?, min_amount?, exemption?}, all optional), "news_keyword" (GDELT keyword news alerts, metadata+link only — params:{query, lang?, domains?}), "job_post" (new public job-board postings — params:{ats?, board_token?} or {domain?}, plus optional title_query/location_query), "tool_diff" (re-runs any read-only tool on a schedule and fires on change — params:{tool, args?, fields[], schedule}), "new_entity" (new business registrations from a state business-entity registry — params:{state:"CO", name_query?, entity_type?}), "tech_change" (a watched domain's website technology stack adds or drops a technology — params:{domains:["acme.com"], technologies?}). Delivery channels: feed (always on — pull via recent_alerts or GET registry.pipeworx.io/alerts.json), and optionally email (set delivery:{email:"you@x.com"}) or sms (delivery:{sms:"+15551234567"} — phone must be verified at /account first; 10/day cap).

NameTypeReqDescription
deliveryobject–Optional delivery channels in addition to the always-on persistent feed. {email:"you@x.com"} sends a templated alert per fired event. {sms:"+15551234567"} sends an SMS per event — must match the veri…
paramsobjectyesType-specific filter. sec_8k: {ticker:"AAPL", items?:["5.02","1.01"]}. polymarket_edge: {topic:"fed", min_spread_bps?:500}. fred_series: {series_id:"UNRATE"}. patent_grant: {applicant:"Apple Inc."}.…
typestringyesSubscription type.

No output schema declared.

No examples provided.

suggest_questions ~240

What can I ask Pipeworx? / what is Pipeworx good for? / what can you do? / give me ideas / show me examples / getting started / what data do you have? — the onboarding entry point for an agent that just connected and wants to know what is worth asking. Returns category-bucketed example questions (company financials, drugs & clinical trials, economics, real estate, prediction markets, weather, government & patents, science & academia, news) — each with the exact tool + argument shape that answers it, drawn from the live catalog of thousands of tools. Call with no arguments for the full spread, or pass `topic` (e.g. "finance", "pharma", "betting") to focus. Use this FIRST when you do not yet know what Pipeworx can do for you, or to learn how to call the meta-tools (ask_pipeworx, entity_profile, compare_entities, etc.).

NameTypeReqDescription
topicstring–Optional focus area: finance | pharma | economics | real-estate | betting | weather | government | science | news. Omit for a cross-category spread.

No output schema declared.

{"topic":"finance"}
unsubscribe ~60

Cancel a subscription by id. Ownership is enforced — you can only cancel your own subscriptions. The row is deactivated (not deleted) so its historical events stay available via recent_alerts.

NameTypeReqDescription
idstringyesSubscription id (uuid) returned by subscribe.

No output schema declared.

No examples provided.

updown_divergence_rate ~586

How often two venues settled the SAME 15-minute crypto window differently, over every settled window on record. Compares polymarket.com (Chainlink TWAP) with Kalshi and with Polymarket US (both CF Benchmarks BRTI), and Kalshi with Polymarket US as the same-feed control. Per pair: windows both venues settled, divergent count, the rate with its 95% Wilson interval (withheld under 30 paired windows), which direction they split, and what was excluded (unsettled on a side, 50-50). A HEADLINE RATE IS A CONCENTRATION QUESTION, so every pair also carries `concentration` (UTC days and hours the divergent windows fell in, the busiest day, the top-3-day share, and a plain reading) and `by_how_decided` (the rate by how far the reference venue's mid was from 50 at its last priced minute: the rate is a fraction of a percent for windows that were decided by the end and tens of percent for the ones that were not). `divergent_path` gives the mean Up mid by minute on both venues over the divergent windows only, split by who said Up, so the "early spike that fades" story can be checked rather than assumed. Measured on the archive 2026-10-27 over 30 days of btc: polymarket.com vs Kalshi diverged on 48 of 2,847 windows (1.69%, interval 1.27-2.23), spread over 27 of 31 UTC days, 0.19% of windows decided by the end and 17-29% of the ones still undecided; Polymarket US vs Kalshi on 0 of 1,838. asset btc | eth | sol | xrp | bnb (bnb has no pair: Kalshi only); days 1-90 (default 30), capped by what the archive holds (it starts 2026-09-22 for polymarket.com and Kalshi, 2026-10-07 for Polymarket US). Read-only; cheap enough to call, it reads several thousand archive rows.

NameTypeReqDescription
assetstring–btc (default) | eth | sol | xrp | bnb. The archive holds btc/eth on all three venues, sol/xrp on polymarket.com and Polymarket US, bnb on Kalshi only (no pair).
daysnumber–Look-back in days, 1-90 (default 30). The archive starts 2026-09-22 (polymarket.com, Kalshi) and 2026-10-07 (Polymarket US, btc), so a longer span is capped by what is held; coverage is reported per…

No output schema declared.

{"asset":"btc","days":30}
{"asset":"eth","days":14}
updown_venue_compare ~719

The same 15-minute crypto "up or down" window priced on polymarket.com, Polymarket US and Kalshi, side by side, with whether each pair is actually the same contract. Pass asset (btc | eth | sol | xrp | bnb) and window ("current" default, "next", "previous", or the window START as ISO such as 2026-10-27T14:15:00Z, on a 15-minute boundary). Per venue: question, Up bid / ask / mid / last, spread_pp, quote_state, volume WITH ITS UNIT, open interest, liquidity, settlement source, comparison basis, when it settles. THE VENUES ARE NOT ONE CONTRACT. Kalshi and Polymarket US settle on CF Benchmarks' BRTI (60-second average at the end against the same at the start): the same bet, so a gap between them is a real disagreement. polymarket.com settles on a Chainlink 60-second TWAP, end against start: same comparison shape, different feed, so a gap against either is partly the contract. `pairs[]` gives equivalent ("true"|"false"|"unclear"|"not_comparable") from resolution_diff for every pair, material_differences, mid_diff_pp (a minus b, in percentage points) and read_as in words. Measured over 30 days of settled windows the Chainlink and BRTI feeds settle a window differently about 1.2-1.8% of the time, almost entirely windows that ended near the threshold (see updown_divergence_rate). `net_spread` is computed only for the pair that is equivalent: the gap in mid terms and at top of book (buy Up where cheaper at the ask, Down where Up is dearer at 1 minus the bid) after BOTH venues' taker fees, each fee carrying its verified-as-of date. Top-of-book size is shown where the venue publishes it (Polymarket US); the Kalshi figure is not in its market payload, so read its order book before sizing. A venue with no market for the window is {status:"not_listed", reason}; one that could not be read is {status:"unavailable", refusal} -- never an empty object, and never the same thing. A one-sided book (typical Polymarket US just before a window is decided) has quote_state "bid_only", a null…

NameTypeReqDescription
assetstring–btc (default) | eth | sol | xrp | bnb. Coverage differs by venue; a venue that does not list the asset answers not_listed.
horizonstring–15m (default and the only value offered).
windowstring–"current" (default), "next", "previous", or the window START as an ISO-8601 timestamp on a 15-minute boundary, e.g. 2026-10-27T14:15:00Z. An unaligned timestamp is refused, not rounded.

No output schema declared.

{"asset":"btc","horizon":"15m","window":"current"}
{"asset":"eth","window":"previous"}
{"asset":"btc","window":"2026-10-27T14:30:00Z"}
validate_claim ~370

"Is it true that…" / "fact check" / "verify the claim that…" / "did X really…" / "was Y actually…" / "confirm or refute" / "true or false" — natural-language claim verification against authoritative sources. Use whenever the agent needs to check whether something a user said is factually correct. Company-financial claims (revenue, net income, cash for public US companies) verify via the structured SEC EDGAR + XBRL fast path with exact percent-delta math; ANY OTHER factual claim (macro statistics, rates, prices, drug data, records) automatically falls through to the grounded pipeline — routed to the right live source, answered with verbatim evidence, then judged. Returns a verdict (confirmed / approximately_correct / refuted / inconclusive / unsupported / could_not_verify), the grounded or structured actual value with pipeworx:// citation, and reasoning. IMPORTANT for callers: could_not_verify means the check did not happen (our LLM or source failed) and carries verification_error{stage,detail} — it is NOT evidence for or against the claim, and must not be shown as one. unsupported means we looked and cover no source for it. Replaces 4–6 sequential calls (NL parsing → entity resolution → data lookup → comparison).

NameTypeReqDescription
claimstringyesNatural-language factual claim, e.g., "Apple's FY2024 revenue was $400 billion" or "Microsoft made about $100B in profit last year".
tolerance_pctnumber–Max percent deviation still graded approximately_correct (0.5–50). Overrides the tolerance implied by the claim wording — set 1–2 for hallucination detection where any material error must be refuted.…

No output schema declared.

{"claim":"Apple's fiscal 2023 revenue was $383 billion"}
Install

How do I install the Openreview MCP server?

Openreview is a hosted endpoint at https://gateway.pipeworx.io/openreview/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · gateway.pipeworx.io

# add to Claude Code
claude mcp add --transport http pipeworx-io-openreview 'https://gateway.pipeworx.io/openreview/mcp'
Common questions

What is the Openreview MCP server?

Openreview is an MCP server listed in the public MCP registry as io.github.pipeworx-io/openreview. OpenReview MCP, ML conference submissions and reviews (API v2). This page covers its hosted endpoint (https://gateway.pipeworx.io/openreview/mcp).

Is the Openreview MCP server safe to use?

Openreview scores 77 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Openreview MCP server expose?

Openreview exposes 50 tools: ask_pipeworx, ask_pipeworx_beta, ask_pipeworx_grounded, search_within, deep_research, and 45 more. Their descriptions and schemas cost roughly 23,567 tokens of context every time the server is loaded.

Does the Openreview MCP server require authentication?

Yes. Openreview asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the Openreview MCP server still maintained?

Openreview is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What did VerifyMCP test on the Openreview MCP server?

VerifyMCP ran 13 checks on Openreview, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.