Cra Check is answering right now. Last checked 11 min ago. It exposes 1 tools. Last commit 1 Nov 2026.
Free read-only check of a public GitHub repo for eight security signals related to the EU CRA.
What the code does
We read the source, 12 h ago · tools taken from the live server · rules 995398eba69f
Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.
const match = AGENT_REGISTRY_REF_RE.exec(input.reputationRegistryRef);
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
const match = AGENT_REGISTRY_REF_RE.exec(input.reputationRegistryRef);
const res = await fetch(`https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage`, {
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
We found things in this code
Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch Cra Check and you get told the day something new turns up.
Connect this server
Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 11 min ago.
claude mcp add cra-check --transport http https://api.tokenizen.nl/mcphttps://api.tokenizen.nl/mcp[mcp_servers.cra-check]
url = "https://api.tokenizen.nl/mcp"{
"mcpServers": {
"cra-check": {
"url": "https://api.tokenizen.nl/mcp"
}
}
}{
"servers": {
"cra-check": {
"type": "http",
"url": "https://api.tokenizen.nl/mcp"
}
}
}Available tools 1
Read directly from the server with tools/list, grouped by what they act on.
If a tool disappears, we record the date.
check_github_repo
Endpoints
| URL | Transport | State | Latency | Checked |
|---|---|---|---|---|
| https://api.tokenizen.nl/mcp | streamable-http | answering | 108 ms | 11 min ago |
Alternatives to Cra Check
same job, measured the same wayScan a public GitHub repo, explain risks, get fix prompts and rescan to confirm fixes.
MCP server for the GitHub REST API: issues, PRs, repos; read always on, write env-gated.
Free security scan for AI-written GitHub repos: leaked keys, .env, eval, SQLi, CORS.
Audit GitHub repos for malicious and supply-chain code before you depend on them.
Is this GitHub issue free to take, is the project alive, will maintainers reply? Read-only.
Audit GitHub repos for security, compliance, and EU AI Act exposure from Claude or Cursor.
MCP server for the GitHub CLI (gh). Read-only by default; single Go binary.
Scan any public GitHub MCP-server repo for security issues. 37 MCP-specific L1 rules, 8 languages.
Cra Check — questions
Answers built from our own checks of this server.