verify-mcp-server

verify-mcp-server is a skill for Claude Code, Codex from mcplookupdev/mcplookup-mcp. It costs 68 tokens per session (536 once invoked), scanned A, original, MIT.

A skill for finding the intended MCP server and checking publicly available identity and trust evidence. MCP servers are services that let an AI agent use outside tools or data.

In plain words
What is it for?
It is for checking a named server before recommending, installing, or connecting it, and for comparing possible matches.
Why use it?
It helps avoid choosing the wrong server when names, packages, repositories, or connection addresses are similar. Its results are evidence-based signals, not a safety guarantee.

Skill for Claude CodeCodex

Written for Claude Code and Codex: shipped in a Claude Code plugin, but also agents/openai.yaml present.

Part of the mcplookup plugin — 1 skill, 1 MCP server shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/mcplookupdev/mcplookup-mcp/verify-mcp-server
Any agent
npx skills add mcplookupdev/mcplookup-mcp --skill verify-mcp-server
Clone the repo
git clone --depth 1 https://github.com/mcplookupdev/mcplookup-mcp

Made for: Claude Code, Codex.

Or install mcplookup, the plugin that ships this one along with the rest of its 1 skill, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for verify-mcp-server

README.md
[![agentmods](https://agentmods.dev/badge/skills/mcplookupdev/mcplookup-mcp/verify-mcp-server.svg)](https://agentmods.dev/skills/mcplookupdev/mcplookup-mcp/verify-mcp-server)
Your own site
<a href="https://agentmods.dev/skills/mcplookupdev/mcplookup-mcp/verify-mcp-server"><img src="https://agentmods.dev/badge/skills/mcplookupdev/mcplookup-mcp/verify-mcp-server.svg" alt="Measured on agentmods" height="20"></a>
Per session 68 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 536 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00068 $0.00536
Opus 5 $0.00034 $0.00268
Sonnet 5 $0.00014 $0.00107
Haiku 4.5 $0.00007 $0.00054

Measured 5d ago against content hash 8f4791d4c464, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

verify-mcp-server scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/verify-mcp-server/SKILL.md · 38 lines

How it starts

The opening of the file, as written. The whole thing — 38 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Verify an MCP server

Use MCPLookup to identify the intended server and assess the public evidence available for it. Treat every result as a current evidence-based signal, never a safety certification or guarantee.

Choose the first tool

  • Use resolve_server when the user names a vendor, product, server, package, repository, Registry identifier, or endpoint.
  • Use find_servers when the user starts with a task or capability and has no particular product or server in mind.
  • Use trust_lookup directly only when the user already supplied an exact canonical MCPLookup server name and wants the complete trust record.

Follow the workflow

  1. Establish the intended identity.
    • Call resolve_server for a named artifact.
    • If the request is open-ended, call find_servers, present the bounded shortlist, and use the selected exact server.name with resolve_server before recommending a connection.
  2. Inspect the compact trust assessment and connection options returned by resolve_server.
  3. Call trust_lookup when the user asks whether the server is trustworthy, requests supporting evidence, or needs coverage, confidence, freshness, or citation details.
  4. Compare candidates on identity relationship, publisher evidence, trust assessment, coverage, confidence, freshness, and relevant connection options. Do not rank solely by name similarity or score.
  5. State uncertainty and abstain from a definitive recommendation when identity remains ambiguous, evidence is missing or stale, or the requested artifact is unsupported. Ask a focused question when it can resolve the ambiguity.

Report the result

Include:

  • the exact canonical server name;
  • why it matches the user's intended vendor, product, package, repository, or endpoint;
  • whether the publisher relationship is first-party, third-party, or unresolved when the evidence supports that distinction;
  • the trust assessment with confidence, coverage, freshness, and the most decision-relevant evidence gaps;
  • the MCPLookup citation;
  • connection options only when requested or useful.

Read the full file on GitHub · 38 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 38 lines · 68 tokens per session scan A 8f4791d4c464

Subscribe to this mod's changes

verify-mcp-server is a skill published in the GitHub repository mcplookupdev/mcplookup-mcp (0 stars, last pushed 20d ago), licensed MIT. It adds 68 tokens to every session and 536 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

datalens-dashboard-work

Create, inspect, diagnose, update, publish, and verify Yandex DataLens dashboards and charts through the DataLens MCP. Use for ordinary DataLens project work, including Wizard, Advanced Editor or JavaScript, formulas, data errors, references, visual corrections, and saved or published readback. Do not use for…

ADIKANT/datalens-dev-mcp · 87 tokens

discuss

Discuss with the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'discuss' trigger phrases.

beeltec/context-usage-mcp · 38 tokens

handoff

Save task-relevant conversation and workspace context to a temporary Markdown file in docs/handoffs, then provide the exact prompt another agent should use to resume. Use when handing unfinished work to a new agent or session.

beeltec/context-usage-mcp · 46 tokens

implement

Implement a task plan from start to finish, including branching, incremental commits, tests, documentation lookup, review, and local integration. Use when the user asks to execute an existing task breakdown or work plan.

beeltec/context-usage-mcp · 43 tokens

to-tasks

Turn a conversation or specification into linked task documents with bounded subtasks and progress checklists. Use when the user asks to plan work, break a spec into tasks, or create an implementation backlog.

beeltec/context-usage-mcp · 43 tokens

wiki

Create and maintain the project's llmwiki using the Open Knowledge Format. Use when the user asks to create, update, consult, or organize a project wiki or durable project knowledge.

beeltec/context-usage-mcp · 38 tokens