Squire
OCI · GHCR.IO/REIDGOODBAR/SQUIRE-MCP:0.6.5
CLI-first remote runtimes for validation and offload tasks, exposed over MCP stdio.
Available components
Last scanned (23 hours ago)
Scores higher than 93% of OCI servers
Category Testing and QA
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security0
- No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
- Known CVEs could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.Unverified
- Install-script risk not yet assessed.Unverified
- Dependency health could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.Unverified
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 212 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability77
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1606 tokens (~100/item across 16 items; 16 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 16 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 1 Nov 26 +1
- Stability: 0.97 → pass security
- 31 Oct 26 −1
- Stability: pass → 0.97 functional
- 23 Oct 26 +1
- Stability: 0.97 → pass security
- 22 Oct 26 −1
- Stability: pass → 0.97 functional
- 16 Oct 26 +1
- Stability: 0.97 → pass security
- 14 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 87. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Oct 26 −2
No change was recorded against any check on this day. Stability & Change Management went from 93 to 80.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed oci/ghcr.io/reidgoodbar/squire-mcp:0.6.5
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | oci |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
audit Squire Audit ~152
Run the supported security-focused audit surfaces against staged local files. On the public service this currently means secret scanning and local-config static analysis.
| Name | Type | Req | Description |
|---|---|---|---|
| config | string | – | Static analysis config as a staged local file path. |
| files | array | – | Local file paths to stage. |
| language | string | – | Audit language. Dependency audit is currently disabled publicly. |
| paths | array | – | Local directory paths to stage recursively. |
| secrets | boolean | – | Run the built-in secret scanner. |
| static | boolean | – | Run static analysis. |
| targets | – | – | Audit targets as an array or CSV string. |
| timeout | integer | – | Audit timeout in seconds. |
| tool | string | – | Audit tool, such as semgrep. |
No output schema declared.
No examples provided.
bench Squire Bench ~109
Run small, short-lived benchmark jobs in clean runtimes to compare simple timing behavior without turning Squire into a full performance platform.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | – | Local file paths to stage. |
| iterations | integer | – | Number of benchmark iterations. |
| language | string | yes | Benchmark language: python, bash, or go. |
| paths | array | – | Local directory paths to stage recursively. |
| targets | – | – | Benchmark targets as an array or CSV string. |
| timeout | integer | – | Benchmark timeout in seconds. |
No output schema declared.
No examples provided.
browser Squire Browser ~141
Run headless Chromium in a constrained offline sandbox and optionally download screenshots or other generated browser artifacts locally.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | string | – | Browser engine, currently chromium. |
| download_artifacts_dir | string | – | Optional local directory to download screenshots or other browser artifacts into. |
| files | array | – | Local file paths to stage. |
| paths | array | – | Local directory paths to stage recursively. |
| screenshot | string | – | Optional screenshot filename to produce. |
| script | string | – | Path to a browser automation script to stage. |
| timeout | integer | – | Browser timeout in seconds. |
| url | string | – | Offline URL to open, such as a file:// URL. |
No output schema declared.
No examples provided.
build Squire Build ~106
Run offline packaging and build sanity checks in clean environments and optionally pull the resulting artifacts back locally.
| Name | Type | Req | Description |
|---|---|---|---|
| download_artifacts_dir | string | – | Optional local directory to download build artifacts into. |
| files | array | – | Local file paths to stage. |
| language | string | yes | Build language: python or node. |
| paths | array | – | Local directory paths to stage recursively. |
| targets | – | – | Build targets as an array or CSV string. |
| timeout | integer | – | Build timeout in seconds. |
No output schema declared.
No examples provided.
compile Squire Compile ~82
Run target-specific Go or Rust compilation checks in clean toolchains without turning Squire into a full CI or release system.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | yes | Local file paths to stage for compilation. |
| language | string | yes | Compile language: go or rust. |
| targets | – | – | Compile targets as an array or CSV string. |
| timeout | integer | – | Compile timeout in seconds. |
No output schema declared.
No examples provided.
data Squire Data ~104
Run Python data-processing jobs in a disposable remote runtime with pandas, polars, and pyarrow available.
| Name | Type | Req | Description |
|---|---|---|---|
| download_artifacts_dir | string | – | Optional local directory to download generated data artifacts into. |
| input | string | – | Path to an input file for multipart upload. |
| script | string | yes | Path to the Python script to execute. |
| stdin_text | string | – | Small inline input payload to send over stdin mode. |
| timeout | integer | – | Job timeout in seconds. |
No output schema declared.
No examples provided.
deps Squire Deps ~86
Validate whether dependency manifests install in a clean environment. The CLI surface exists, but the public zero-egress service currently rejects deps jobs.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Path to the dependency manifest to upload. |
| language | string | yes | Dependency language: python or node. |
| targets | – | – | Dependency targets as an array or CSV string. |
| timeout | integer | – | Dependency install timeout in seconds. |
No output schema declared.
No examples provided.
help Squire Help ~54
Show the top-level Squire command catalog or help for a specific command. This is the canonical discovery surface for humans and agents before choosing a command.
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | – | Optional command path, such as verify or quantum simulate. |
No output schema declared.
No examples provided.
lint Squire Lint ~109
Run fixed lint and static-analysis tools in a fresh toolchain so local environment drift does not affect the result.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | yes | Local file paths to stage for the lint run. |
| language | string | yes | Lint language: python, js, ts, or rust. |
| targets | – | – | Lint targets as an array or CSV string. |
| timeout | integer | – | Lint timeout in seconds. |
| tool | string | yes | Lint tool: ruff, eslint, or clippy. |
No output schema declared.
No examples provided.
media Squire Media ~104
Run Python media jobs in a disposable remote runtime with ffmpeg installed and optionally download the generated files locally.
| Name | Type | Req | Description |
|---|---|---|---|
| download_artifacts_dir | string | – | Optional local directory to download generated media artifacts into. |
| input | string | – | Path to an input file for multipart upload. |
| script | string | yes | Path to the Python script to execute. |
| stdin_text | string | – | Small inline input payload to send over stdin mode. |
| timeout | integer | – | Job timeout in seconds. |
No output schema declared.
No examples provided.
quantum_simulate Squire Quantum Simulate ~120
Stage a small Python/Qiskit file set, run the entry file inside an offline Qiskit Aer image, and optionally download generated artifacts locally.
| Name | Type | Req | Description |
|---|---|---|---|
| backend | string | – | Quantum backend. v1 supports only aer_simulator. |
| download_artifacts_dir | string | – | Optional local directory to download generated quantum artifacts into. |
| files | array | yes | Local file paths to stage. The first file is the Python entry script. |
| shots | integer | – | Shot count passed to the simulation. |
| timeout | integer | – | Simulation timeout in seconds. |
No output schema declared.
No examples provided.
solve Squire Solve ~79
Run bounded solver jobs for Z3 or MiniZinc in a fresh disposable sandbox.
| Name | Type | Req | Description |
|---|---|---|---|
| data | string | – | Optional MiniZinc .dzn data file. |
| file | string | yes | Path to the solver input file. |
| solver | string | yes | Solver: z3 or minizinc. |
| timeout | integer | – | Solver timeout in seconds. |
No output schema declared.
No examples provided.
sql Squire SQL ~134
Run SQLite or Postgres schema, query, and migration validation in a fresh disposable database sandbox.
| Name | Type | Req | Description |
|---|---|---|---|
| dialect | string | yes | SQL dialect: sqlite or postgres-16. |
| explain | boolean | – | Request an execution plan when the dialect supports it. |
| file | string | – | Path to a SQL file containing statements to apply. |
| query | string | – | Inline SQL query to execute after schema setup. |
| query_file | string | – | Path to a query file to execute after schema setup. |
| schema | string | – | Path to a schema file to apply before the query. |
| timeout | integer | – | SQL timeout in seconds. |
No output schema declared.
No examples provided.
test Squire Test ~103
Run small or medium test jobs in clean runtimes with a target matrix for Python, Node, or Bash.
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | – | Restricted test command such as pytest -q or npm test. |
| files | array | yes | Local file paths to stage for the test run. |
| language | string | yes | Test language: python, node, or bash. |
| targets | – | – | Runtime targets as an array or CSV string. |
| timeout | integer | – | Test timeout in seconds. |
No output schema declared.
No examples provided.
verify Squire Verify ~93
Run small inline snippets or staged scripts in fresh Linux containers across the supported target images.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | Inline code snippet to verify. |
| file | string | – | Path to a local script file to upload. |
| language | string | yes | Language to execute: bash, python, or node. |
| targets | – | – | Target matrix as an array or CSV string. |
| timeout | integer | – | Per-target timeout in seconds. |
No output schema declared.
No examples provided.
whoami Squire WhoAmI ~30
Return the current public or authenticated identity, trust tier, feature flags, token metadata, and server-side quotas.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the Squire MCP server?
Squire runs locally as a container image, launched with docker run --rm -i -e SQUIRE_TOKEN -e SQUIRE_API_BASE_URL ghcr.io/reidgoodbar/squire-mcp:0.6.5. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
oci · ghcr.io/reidgoodbar/squire-mcp:0.6.5
claude mcp add reidgoodbar-squire -- docker run --rm -i -e SQUIRE_TOKEN -e SQUIRE_API_BASE_URL ghcr.io/reidgoodbar/squire-mcp:0.6.5
This image reads SQUIRE_TOKEN and SQUIRE_API_BASE_URL. Set them in your client's env block for this server; docker run -e passes each one through to the container.
What is the Squire MCP server?
Squire is an MCP server listed in the public MCP registry as io.github.reidgoodbar/squire. CLI-first remote runtimes for validation and offload tasks, exposed over MCP stdio. This page covers its container image (ghcr.io/reidgoodbar/squire-mcp:0.6.5).
Is the Squire MCP server safe to use?
Squire scores 55 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Squire MCP server expose?
Squire exposes 16 tools: help, whoami, verify, deps, sql, and 11 more. Their descriptions and schemas cost roughly 1,606 tokens of context every time the server is loaded.
Is the Squire MCP server still maintained?
Squire is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Squire MCP server under?
Squire declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.