mcp.context7.com

mcpverified2026-09-17 20:18:35Z67ms

Clean scan — no agent-hijack patterns found.

sharepost on x share on linkedin hacker news reddit

your watchlist lives on the leaderboard →

what checked out

HTTPS enforced
Server instructions captured and reviewed
MCP surface verified — 2 tool(s) inspected

Check every tool before you connectthis one is fine — the next one might not be

Add one block, every session is guarded

Paste into claude_desktop_config.json (Settings → Developer → Edit Config), then restart Claude Desktop.

{
  "mcpServers": {
    "toolproof": {
      "command": "npx",
      "args": ["-y", "toolproof-mcp"]
    }
  }
}

The guard calls the same verdicts you just saw. No account, no key — and it never sends your conversations anywhere.

Show this grade in your READMEa badge is a link anyone can verify

[![Toolproof grade](https://toolproof-scan.vercel.app/api/v1/badge?target=https%3A%2F%2Fmcp.context7.com%2Fmcp&style=grade)](https://toolproof-scan.vercel.app/t?target=https%3A%2F%2Fmcp.context7.com%2Fmcp)

The badge re-renders on every scan, so it can never go stale silently — if the surface changes, the grade changes with it.

findings · 1

infoTP-202No authentication observed

initialize

Context7

The server completed an MCP handshake with no credentials. Fine for public data tools — dangerous for anything with write access.

fix Add auth if the tool touches anything private; if it is public by design, say so in the description.

passport · canonical JSON

{
  "v": 1,
  "kind": "mcp",
  "target": "https://mcp.context7.com/mcp",
  "host": "mcp.context7.com",
  "state": "verified",
  "scannedAt": "2026-09-17T20:18:35.368Z",
  "score": 100,
  "grade": "A+",
  "summary": "Clean scan — no agent-hijack patterns found.",
  "findingCounts": {
    "critical": 0,
    "high": 0,
    "medium": 0,
    "low": 0,
    "info": 1
  },
  "ruleIds": [
    "TP-202"
  ],
  "positives": [
    "HTTPS enforced",
    "Server instructions captured and reviewed",
    "MCP surface verified — 2 tool(s) inspected"
  ],
  "toolTextHash": "3b6c54ab4dc6fda17280aa8a412872dc",
  "scanner": {
    "name": "toolproof",
    "version": "0.1.0"
  }
}

consume as JSON

curl "{origin}/api/v1/verify?target=https%3A%2F%2Fmcp.context7.com%2Fmcp\&kind=auto" | jq

The verify endpoint returns the passport above plus an ed25519 signature over its canonical form. Verify offline with the public key.

Verification code →

badge

<img src="{origin}/api/v1/badge?target=https%3A%2F%2Fmcp.context7.com%2Fmcp\&kind=auto">

embed

<iframe src="https://toolproof-scan.vercel.app/embed?target=https%3A%2F%2Fmcp.context7.com%2Fmcp&kind=auto" style="border:0;width:340px;height:260px;border-radius:12px" loading="lazy"></iframe>

The live verdict card, framable on any site. It scans on load and links back to this full card.

← scan something else re-scan