Is the codebook-mcp.dokasukadon.workers.dev MCP server safe to use?
Independent trust grade A- (92/100). No blocking issues found in the static + spec checks. wmcp.sh continuously watches codebook-mcp.dokasukadon.workers.dev for tool drift and rug-pulls. The grade is free and identical whether or not the operator pays.
✓ Watched since 2026-07-18 — behavioral baseline locked, no drift for 7 days. We re-check this server's tool surface on a schedule; if it adds, removes, or silently rewrites a tool (rug-pull), we record it.
What it offers — 4 tools · Finance & Crypto
country_info
Look up a country by ISO 3166-1 alpha-2 or alpha-3 code. Returns both codes, English name, and the primary ISO 4217 currency. Use instead of recalling
currency_info
Look up an ISO 4217 currency: name and minor units (decimal places). Critical for payment APIs — e.g. JPY has 0 minor units (¥500 is amount=500, NOT 5
http_status
Look up the official reason phrase for an HTTP status code, or list all codes in a class (e.g. 4xx). Use instead of recalling status semantics from me
mime_type
Look up the MIME type for a file extension, or find extensions for a MIME type. Use instead of guessing Content-Type values.
Spec conformance20%100
✓ initialize → protocolVersion 2025-06-18
✓ initialize HTTP 200
✓ unknown method → -32601
✓ tools/list → 4 tools
✓ every tool has name + inputSchema
Security (OWASP MCP)30%100
4 tools scanned
no injection markup
no secret-path refs
Reliability / performance20%84
single-probe latency 1300ms (PRELIMINARY — continuous uptime/p95 from proxy telemetry lands in v2)
Tool hygiene15%80
100% of tools have typed inputSchema
0/4 declare outputSchema
no unannotated destructive tools
Transparency / provenance15%90
HTTPS ✓
RFC 9728 oauth-protected-resource metadata ✓
advertises protocol 2025-06-18
Observed behavior
No proxied traffic observed for this host yet. Connect it at /connect and its grade gains a measured Reliability score + per-tool behavioral evidence — the half a static scan can't produce.
Findings
No blocking issues found in the static + spec checks.
We re-grade codebook-mcp.dokasukadon.workers.dev on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.
Run codebook-mcp.dokasukadon.workers.dev? Claim it (free) to get drift alerts and show an independently-verified trust badge. The grade stays free — claiming just ties it to you.
Share this report card
A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.
A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.
Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:
https://www.wmcp.sh/mcp/trust
How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.