MCP Verification Gate: check an MCP server or an A2A agent before you connect or delegate

What the code does

We read the source, 50 min ago · tools taken from the live server · rules 995398eba69f

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

    path = os.path.join(FEED_DIR, fname)

        r = subprocess.run(["node", "--check", tf.name], capture_output=True, text=True)

  const r = spawnSync(process.execPath, ["--expose-internals", ...process.execArgv, script, ...process.argv.slice(2)], { stdio: "inherit" });

const canonicalJson = new Function(m[0] + "; return canonicalJson;")();

        val = eval(expr, {"__builtins__": {}})

  document.getElementById('main').innerHTML = fns[state.tab]();

  for (const f of fs.readdirSync(feedDir)) {

<script src="https://www.paypal.com/sdk/js?client-id=AVePXfDeP_YDUgmcFEJNjFHuYkbXZ-VQcLEecJs5Li2la9qDbtZJamy-iXzTxWlPdUODt6KNV3nqUKHP&currency=JPY&locale=ja_JP"></script>

env = dict(os.environ, GIT_OPTIONAL_LOCKS="0")

    "dl.dropboxusercontent.com", "pastebin.com", "web.archive.org",

Found in continuous integration, deployment or infrastructure files, or in a neighbouring package of the same monorepo. None of this is installed when you add the server: it describes how the project is built and released. We list it because a leaked key in a build pipeline is still a real problem, but it is not something this server does on your machine.

            curl -s -X POST -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" -H "Accept: application/vnd.github+json" https://api.github.com/repos/${{ github.repository }}/actions/workflows/static.yml/dispatches -d '{"ref":"main"}'

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 12 min ago.

claude mcp add hs-verify-gate --transport http https://hs-verify-gate.oga-surf-project.workers.dev/mcp

https://hs-verify-gate.oga-surf-project.workers.dev/mcp

[mcp_servers.hs-verify-gate]
url = "https://hs-verify-gate.oga-surf-project.workers.dev/mcp"

{
  "mcpServers": {
    "hs-verify-gate": {
      "url": "https://hs-verify-gate.oga-surf-project.workers.dev/mcp"
    }
  }
}

{
  "servers": {
    "hs-verify-gate": {
      "type": "http",
      "url": "https://hs-verify-gate.oga-surf-project.workers.dev/mcp"
    }
  }
}

This server publishes 1 more address. The block above uses the one we reach during checks; the full list is under Endpoints below, and the author may intend a particular one for your client.

Available tools 6

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

Endpoints