reachpad.dev
Is the reachpad.dev MCP server safe to use?
Independent trust grade B+ (87/100). No blocking issues found in the static + spec checks. wmcp.sh continuously watches reachpad.dev for tool drift and rug-pulls. The grade is free and identical whether or not the operator pays.
What it offers — 17 tools · Finance & Crypto
list_docsList documents available on the reach server (public; private too if a read token is configured).
get_docGet the raw source of a document (markdown or HTML). Optionally a specific version.
get_doc_metaGet a document's manifest: metadata, version list, and the tamper-evident ledger (with chainValid).
get_historyGet the full version + ledger history of a document.
verify_docRecompute and verify the document's ledger hash chain.
get_diffGet a bounded unified diff between two versions of a document (defaults to previous → head). Cheaper than fetching both versions and diffing locally.
create_docCreate a new document. Returns its slug, URLs, and a one-time manageToken.
share_docShare a document so another agent can read it: creates a doc and returns its URL + one-time manageToken (alias of create_doc).
handoff_docHand a document off to another agent: creates a doc and returns its rawUrl to pass along (alias of create_doc).
edit_docCreate a new version of a document. Pass baseVersion for optimistic concurrency (409 if it is not the current head).
update_shared_docUpdate a shared document with a new version (alias of edit_doc).
edit_sectionEdit ONE section (a heading and its body) of a markdown doc, merged onto the current head. Conflict-free: agents editing DIFFERENT sections never clob
delete_docSoft-delete a document (recorded in the ledger; restorable via restore_doc).
restore_docRestore a soft-deleted document (recorded in the ledger).
mint_tokenMint a scoped, optionally-expiring capability token for a doc so you can hand a peer agent least-privilege access (read / edit / manage) instead of th
list_tokensList the (non-secret) capability tokens minted for a doc. Requires manage capability.
revoke_tokenRevoke a previously minted capability token by id. Requires manage capability.
- ✓ initialize → protocolVersion 2025-06-18
- ✓ initialize HTTP 200
- ✓ unknown method → -32601
- ✓ tools/list → 17 tools
- ✓ every tool has name + inputSchema
- 17 tools scanned
- no injection markup
- no secret-path refs
- single-probe latency 782ms (PRELIMINARY — continuous uptime/p95 from proxy telemetry lands in v2)
- 94% of tools have typed inputSchema
- 0/17 declare outputSchema
- 2 destructive-by-name tools lack safety annotations
- HTTPS ✓
- advertises protocol 2025-06-18
Observed behavior
No proxied traffic observed for this host yet. Connect it at /connect and its grade gains a measured Reliability score + per-tool behavioral evidence — the half a static scan can't produce.
Findings
We re-grade reachpad.dev on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.
Run reachpad.dev? Claim it (free) to get drift alerts and show an independently-verified trust badge. The grade stays free — claiming just ties it to you.
Share this report card
A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.
Embed this grade
A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.
[](https://www.wmcp.sh/mcp/grade/reachpad.dev)
<a href="https://www.wmcp.sh/mcp/grade/reachpad.dev"><img src="https://www.wmcp.sh/mcp/grade/reachpad.dev/badge.svg" alt="MCP Trust Grade B+ · wmcp.sh"></a>
Agents: check this before connecting
Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:
https://www.wmcp.sh/mcp/trust
readOnly vs observed behavior) layer on via the wmcp.sh proxy.