Security & Testing

wmcp.sh

Provides tools to grade, detect drift (CVE-2025-54136), and verify MCP servers before connecting or executing tools.

1 endpoint3 known toolsFirst detected July 25, 2026Last detected July 25, 2026

ENDPOINT 1

https://wmcp.sh/mcp/trust

No auth detected

Capabilities

tools

Independently grade an MCP server (A–F) BEFORE connecting an agent to it.

Inferred read-only

Check whether an MCP server's tool definitions have changed since it was last trusted (rug-pull / schema-drift detection, the CVE-2025-54136 class).

Inferred read-only

Verify an MCP server immediately BEFORE you execute any of its tools.

Potential side effects

CONNECT WITH APPROVAL

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.wmcp-sh-mcp-trust-oracle]
url = "https://wmcp.sh/mcp/trust"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "wmcp-sh-mcp-trust-oracle": {
      "type": "http",
      "url": "https://wmcp.sh/mcp/trust"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: wmcp-sh-mcp-trust-oracle
Remote MCP URL: https://wmcp.sh/mcp/trust

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "wmcp-sh-mcp-trust-oracle": {
      "url": "https://wmcp.sh/mcp/trust"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "wmcp-sh-mcp-trust-oracle": {
      "type": "http",
      "url": "https://wmcp.sh/mcp/trust"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "wmcp-sh-mcp-trust-oracle",
  "transport": "streamable-http",
  "url": "https://wmcp.sh/mcp/trust"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.