MCP Observatory: one read only walk over every https endpoint in the official registry MCP Server

What the code does

We read the source, 9 h ago · tools taken from the live server · rules 995398eba69f

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

    p = subprocess.run(cmd, cwd=os.path.join(ROOT, cwd), capture_output=True, text=True, timeout=300)

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

    p = subprocess.run(cmd, cwd=os.path.join(ROOT, cwd), capture_output=True, text=True, timeout=300)

    return io.open(os.path.join(ROOT, rel), encoding="utf-8").read()

const canonicalJson = new Function(m[0] + "; return canonicalJson;")();

        val = eval(expr, {"__builtins__": {}})

  document.getElementById('main').innerHTML = fns[state.tab]();

  for (const f of fs.readdirSync(feedDir)) {

<script src="https://www.paypal.com/sdk/js?client-id=AVePXfDeP_YDUgmcFEJNjFHuYkbXZ-VQcLEecJs5Li2la9qDbtZJamy-iXzTxWlPdUODt6KNV3nqUKHP&vault=true&intent=subscription&currency=USD"></script>

      "openings-vote-drilling-initially.trycloudflare.com",

env = dict(os.environ, GIT_OPTIONAL_LOCKS="0")

Found in continuous integration, deployment or infrastructure files, or in a neighbouring package of the same monorepo. None of this is installed when you add the server: it describes how the project is built and released. We list it because a leaked key in a build pipeline is still a real problem, but it is not something this server does on your machine.

            curl -s -X POST -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" -H "Accept: application/vnd.github+json" https://api.github.com/repos/${{ github.repository }}/actions/workflows/static.yml/dispatches -d '{"ref":"main"}'

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 14 min ago.

claude mcp add hs-mcp-observatory --transport http https://observatory.horizonshield.dev/mcp

https://observatory.horizonshield.dev/mcp

[mcp_servers.hs-mcp-observatory]
url = "https://observatory.horizonshield.dev/mcp"

{
  "mcpServers": {
    "hs-mcp-observatory": {
      "url": "https://observatory.horizonshield.dev/mcp"
    }
  }
}

{
  "servers": {
    "hs-mcp-observatory": {
      "type": "http",
      "url": "https://observatory.horizonshield.dev/mcp"
    }
  }
}

Available tools 6

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

Endpoints