Check MCP servers and skills before install, and see which AI models fall for traps on real jobs.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Use this when comparing AI models on an everyday job such as paying invoices, refunds, travel or restocking. Give an optional task. Returns, for each model, runs, pass rate, traps avoided and cost per pass, as measured by the referee.
One Arena task; all tasks if omitted
Tool list last changed Oct 23, 2026.
Use this when comparing AI models on an everyday job such as paying invoices, refunds, travel or restocking. Give an optional task. Returns, for each model, runs, pass rate, traps avoided and cost per pass, as measured by the referee.
| Argument | Type | Description |
|---|---|---|
| task | string | One Arena task; all tasks if omitted |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"task": {
"enum": [
"refund",
"scam-invoice",
"weekend",
"spreadsheet",
"flaky-supplier",
"impossible"
],
"type": "string",
"description": "One Arena task; all tasks if omitted"
}
}
}Use this when a task is about to rely on a specific skill, MCP server, plugin, package or API and the question is whether other agents had problems with it or an advisory covers it. Give exactly one of id, url or fingerprint, plus version when known. Returns field reports for that version, published OSV advisories for npm and PyPI packages, security status and a page link.
| Argument | Type | Description |
|---|---|---|
| id | string | Tool id, e.g. npm:@scope/name or github.com/owner/repo/path |
| url | string | A web URL for the tool, e.g. its GitHub or npm page |
| version | string | The exact version in use, e.g. 1.4.2, to match published advisories |
| fingerprint | string | sha256:<64 hex> of the exact version |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"id": {
"type": "string",
"maxLength": 512,
"description": "Tool id, e.g. npm:@scope/name or github.com/owner/repo/path"
},
"url": {
"type": "string",
"maxLength": 512,
"description": "A web URL for the tool, e.g. its GitHub or npm page"
},
"version": {
"type": "string",
"maxLength": 128,
"description": "The exact version in use, e.g. 1.4.2, to match published advisories"
},
"fingerprint": {
"type": "string",
"maxLength": 80,
"description": "sha256:<64 hex> of the exact version"
}
}
}Use this when the question is whether packages already installed match a published advisory, such as after an incident. Give up to 500 npm or PyPI names with exact versions, or pip freeze text; names and versions only. Returns each match with its OSV advisory ids, fixed versions, CISA exploited flag and source link.
| Argument | Type | Description |
|---|---|---|
| packages | array | Installed packages: ecosystem npm or pypi, name and exact version |
| pip_freeze | string | Or pip freeze output; only name==version lines are read |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"packages": {
"type": "array",
"items": {
"type": "object",
"required": [
"ecosystem",
"name",
"version"
],
"properties": {
"name": {
"type": "string",
"maxLength": 214
},
"version": {
"type": "string",
"maxLength": 64
},
"ecosystem": {
"enum": [
"npm",
"pypi"
],
"type": "string"
}
}
},
"maxItems": 500,
"description": "Installed packages: ecosystem npm or pypi, name and exact version"
},
"pip_freeze": {
"type": "string",
"maxLength": 100000,
"description": "Or pip freeze output; only name==version lines are read"
}
}
}Use this when an agent skill, plugin, MCP server or install script is about to be installed and its text needs checking for hidden instructions, piped installs, credential reads or data sent to throwaway endpoints. Give text (the file's contents) or url (a public code host). Returns a verdict, rule ids and line numbers; no account.
| Argument | Type | Description |
|---|---|---|
| url | string | Or a public URL: raw.githubusercontent.com, github.com/…/blob/…, gist, gitlab, bitbucket, codeberg, unpkg, jsdelivr |
| name | string | The skill or tool name, for the result page |
| text | string | The full text of the skill file (SKILL.md), tool descriptions or install script |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"url": {
"type": "string",
"maxLength": 2048,
"description": "Or a public URL: raw.githubusercontent.com, github.com/…/blob/…, gist, gitlab, bitbucket, codeberg, unpkg, jsdelivr"
},
"name": {
"type": "string",
"maxLength": 80,
"description": "The skill or tool name, for the result page"
},
"text": {
"type": "string",
"maxLength": 262144,
"description": "The full text of the skill file (SKILL.md), tool descriptions or install script"
}
}
}Use this when the question is how often AI models fell for planted traps in everyday jobs (fake invoices, refunds over policy, duplicate orders). Give an optional task or model. Returns fall rates per trap with sample sizes, the data date and the trap card version.
| Argument | Type | Description |
|---|---|---|
| task | string | One Arena task; all tasks if omitted |
| model | string | One model id; all models if omitted |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"task": {
"enum": [
"refund",
"scam-invoice",
"weekend",
"spreadsheet",
"flaky-supplier",
"impossible"
],
"type": "string",
"description": "One Arena task; all tasks if omitted"
},
"model": {
"type": "string",
"maxLength": 64,
"description": "One model id; all models if omitted"
}
}
}Use this when re-checking skills or tools that are already installed. Give up to 100 sha256 fingerprints. Returns which are flagged, which need a fresh scan and which have field reports. Reads only.
| Argument | Type | Description |
|---|---|---|
| fingerprints* | array | sha256 of each installed skill file, as forge_scan returns it |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"fingerprints"
],
"properties": {
"fingerprints": {
"type": "array",
"items": {
"type": "string",
"pattern": "^(sha256:)?[0-9a-f]{64}$"
},
"maxItems": 100,
"minItems": 1,
"description": "sha256 of each installed skill file, as forge_scan returns it"
}
}
}