Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.theluckystrike/onboarding-checklist-inspection-runs

MCPB · CHECKLIST.MCPB · 2 COMPONENTS · SCANNED SEP 30

Onboarding and inspection checklists you reuse: dated runs, who ticked what, and a sign-off.

0 this week 48 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security22
  • No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
  • Known CVEs were checked across the 153 of 153 dependencies we could resolve, so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • 63 of 153 dependencies flagged as unhealthy (2 deprecated). View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability87
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2060 tokens (~121/item across 17 items; 16 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage99
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 98% of tool parameters carry a description.Partial
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "checklist_item_remove" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

How do I install the io.github.theluckystrike/onboarding-checklist-inspection-ru… MCP server?

io.github.theluckystrike/onboarding-checklist-inspection-ru… ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. The MCP registry declares no SHA-256 for this bundle, so there is no published digest to check the download against.

mcpb · checklist.mcpb

Download bundle

The MCP registry declares no SHA-256 for this bundle, so there is no published digest to check it against. Open it with an MCPB-capable host such as Claude Desktop.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 28 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 23 Sept 26 48

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 30 Sept 2026 · Analysed mcpb/https://github.com/theluckystrike/mcp-servers/releases/download/v0.22.0/checklist.mcpb@0.22.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem mcpb
Reason No attestation published

Background: How many MCP packages publish verified provenance →

Dependencies 153 packages
Packages resolved 153
Deprecated 2
Stale 63
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 16 exposed · ~2,017 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
checklist_create ~132

Create a reusable checklist and return its CL-NNNN id: a name, a category and an optional description. Add the steps with checklist_item_add. Free tier: 3 checklists, and unlimited runs of them.

NameTypeReqDescription
categorystring–A grouping key, lower-cased and hyphenated, e.g. handover or safety. Default general
descriptionstring–What this checklist is for and when to run it, printed at the top of a blank copy
namestringyesWhat the checklist is, e.g. Pre-delivery vehicle check or Site handover

No output schema declared.

No examples provided.

checklist_delete ~97

Delete a checklist and its steps for good. Runs already started from it are untouched and stay readable: a run carries its own copy of the steps, so deleting the checklist does not erase what anybody signed.

NameTypeReqDescription
checkliststringyesThe checklist id, e.g. CL-0001, or its name when only one carries it
confirmbooleanyesMust be true. There is no undo and nothing is copied anywhere first

No output schema declared.

No examples provided.

checklist_item_add ~212

Add one step to a checklist and return its I01-style id: the text, an optional section heading, and whether it is required. A required step that is unanswered or failed blocks sign-off; an optional one does not.

NameTypeReqDescription
checkliststringyesThe checklist id, e.g. CL-0001, or its name when only one carries it
notestring–Guidance printed under the step, e.g. the tolerance or the standard it is checked against
positioninteger–Insert at this 1-based position instead of at the end. Existing steps keep their ids
requiredboolean–Whether sign-off is blocked while this step is unanswered or failed. Default true
sectionstring–A heading to group this step under, e.g. Exterior. Steps keep the order they were added within a section
textstringyesThe step, as the person doing it will read it, e.g. Tyre pressures checked and recorded

No output schema declared.

No examples provided.

checklist_item_remove ~96

Remove one step from a checklist by its I01-style id and bump the checklist version. Runs already under way keep the step they started with, so nothing anybody already ticked is rewritten.

NameTypeReqDescription
checkliststringyesThe checklist id, e.g. CL-0001, or its name when only one carries it
itemstringyesThe step id, e.g. I03, as shown by checklist_show

No output schema declared.

No examples provided.

checklist_list ~96

Every checklist with its category, version, step count and how many runs came from it. Filter by category or by a word in the name. Returns at most 500 rows, newest change first.

NameTypeReqDescription
categorystring–Only checklists in this category, matched after the same lower-case hyphenation applied on create
containsstring–Only checklists whose name contains this text, matched case-insensitively

No output schema declared.

No examples provided.

checklist_show ~102

One checklist with its steps in order, grouped by section, plus how many are required and how many runs have been started from it. Pass as_text for a blank printable copy with a box against each step.

NameTypeReqDescription
as_textboolean–Return a blank printable copy as plain text as well as the structured view. Default false
checkliststringyesThe checklist id, e.g. CL-0001, or its name when only one carries it

No output schema declared.

No examples provided.

license_activate ~71

Activate a Pro key (MCPL1.xxx.yyy) from checkout: verified offline against a built-in public key, saved to your config file. A wrong, malformed or expired key is refused, unsaved. license_status reads it back.

NameTypeReqDescription
keystringyesLicense key from the checkout confirmation page

No output schema declared.

No examples provided.

license_status ~54

Report this server's licence state: product, tier free or pro, licence id, expiry, the key source and the upgrade URL. No arguments, no network. Explains a free-tier refusal; license_activate installs a key.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

run_check ~202

Mark one step pass, fail or na, with who did it and when. na means the step did not apply; it counts as answered and never as passed. A step can be answered again while the run is open, and the last answer stands.

NameTypeReqDescription
atstring–The day it was answered, YYYY-MM-DD. Default the run's own date
bystring–Who answered it. Printed against the step on the report
itemstringyesThe step id, e.g. I03, as shown by run_show
notestring–What was found. Say why on a fail: the report prints this under the step
runstringyesThe run id, e.g. RUN-2026-0001, or its title when only one carries it
statestringyespass, fail, na for did not apply, or pending to put the step back to unanswered

No output schema declared.

No examples provided.

run_delete ~105

Delete a run for good, with every answer on it. A signed-off run is refused: it is the record of what somebody put their name to. Abandon a run you no longer want instead of deleting a signed one.

NameTypeReqDescription
confirmbooleanyesMust be true. There is no undo and nothing is copied anywhere first
runstringyesThe run id, e.g. RUN-2026-0001, or its title when only one carries it

No output schema declared.

No examples provided.

run_list ~139

Runs newest first, with their checklist, progress and sign-off state. Filter by checklist, by status, by reference or to open runs only. Returns at most 500 rows.

NameTypeReqDescription
checkliststring–Only runs of this checklist, by id or name
open_onlyboolean–Only open and complete runs, the ones still editable. Default false
referencestring–Only runs against this job, order or asset id, matched case-insensitively
statusstring–Only runs in this status
with_failuresboolean–Only runs that have at least one failed step. Default false

No output schema declared.

No examples provided.

run_report ~147

The run as plain text on every tier: every step with its mark, who answered it, the notes, the counts and a signature block or the recorded signature. Pro also writes it to out_path as a .txt file.

NameTypeReqDescription
out_pathstring–Where to write the .txt file. Pro only. Omit to get the report back as text, which every tier can do
overwriteboolean–Replace out_path if a file is already there. Default false, and an existing file is refused with nothing written
runstringyesThe run id, e.g. RUN-2026-0001, or its title when only one carries it

No output schema declared.

No examples provided.

run_show ~83

The whole run: every step with its answer, who answered it and when, grouped by section, plus the pass, fail and outstanding counts, the failures in full, and whether it can be signed off and why not.

NameTypeReqDescription
runstringyesThe run id, e.g. RUN-2026-0001, or its title when only one carries it

No output schema declared.

No examples provided.

run_sign_off ~169

Sign off a completed run with a name and a date, which freezes it. Refused while a required step is unanswered or failed, unless force is true, and either way the exceptions stay on the record and print on the report.

NameTypeReqDescription
bystringyesWho is signing it off, as it should read on the document
datestring–The day it was signed, YYYY-MM-DD. Default today
forceboolean–Sign off even though required steps are unanswered or failed. Default false; the reasons come back either way
notestring–What the signature covers, or the exception being accepted
runstringyesThe run id, e.g. RUN-2026-0001, or its title when only one carries it

No output schema declared.

No examples provided.

run_start ~170

Start a dated run of a checklist and return its RUN-YYYY-NNNN id. The steps are COPIED into the run, so editing the checklist afterwards never changes a run already under way. Runs are free and never capped.

NameTypeReqDescription
checkliststringyesThe checklist id, e.g. CL-0001, or its name when only one carries it
datestring–The day the run happened, YYYY-MM-DD. Default today
notestring––
referencestring–The job, order or asset id this run belongs to, e.g. WO-2026-0044. Named only; no sibling store is opened
titlestringyesWhat this run is against, e.g. Van BX21 KLM, February service

No output schema declared.

No examples provided.

run_status ~142

Move a run back to open so a step can be answered again, or abandon it when the job did not happen. A signed-off run is refused: a signature is the point at which a run stops moving.

NameTypeReqDescription
datestring–The day the step happened, YYYY-MM-DD. Default today
notestring–Why. Kept on the run's history and printed nowhere else
runstringyesThe run id, e.g. RUN-2026-0001, or its title when only one carries it
statusstringyesopen puts a complete run back into edit; abandoned closes it without a signature

No output schema declared.

No examples provided.

Common questions

What is the io.github.theluckystrike/onboarding-checklist-inspection-ru… MCP server?

io.github.theluckystrike/onboarding-checklist-inspection-ru… is an MCP server listed in the public MCP registry as io.github.theluckystrike/onboarding-checklist-inspection-ru…. Onboarding and inspection checklists you reuse: dated runs, who ticked what, and a sign-off. This page covers its MCPB bundle (https://github.com/theluckystrike/mcp-servers/releases/download/v0.22.0/checklist.mcpb).

Is the io.github.theluckystrike/onboarding-checklist-inspection-ru… MCP server safe to use?

io.github.theluckystrike/onboarding-checklist-inspection-ru… scores 48 out of 100 on VerifyMCP. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.theluckystrike/onboarding-checklist-inspection-ru… MCP server expose?

io.github.theluckystrike/onboarding-checklist-inspection-ru… exposes 16 tools: checklist_create, checklist_item_add, checklist_item_remove, checklist_show, checklist_list, and 11 more. Their descriptions and schemas cost roughly 2,017 tokens of context every time the server is loaded.

What licence is the io.github.theluckystrike/onboarding-checklist-inspection-ru… MCP server under?

io.github.theluckystrike/onboarding-checklist-inspection-ru… declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.