MCP.Market

Is Pipeworx MCP server safe?

Probably. Read the findings first.

C69/100grade C

Use with care. Some checks failed or could not be verified.

What to know before installing
  • highWrite-action tools reachable without authentication

How Pipeworx compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
69/100
higher than 33% of 48,255 servers
Tools that change things
7%
typical: 0%. Fewer write tools means less an agent can break
Uptime
100%
of our recent checks; the typical remote server answers 100%

What its tools let an agent do: 39 read · 1 create · 2 change · 1 delete

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

1 high1 low
  • –Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 3184ms17/20
  • Tool poisoning43 tool descriptions checked13/15
  • Auth qualityopen endpoint exposes 3 write-action tools with no auth3/15
  • Maintenancelast push 87 days ago12/15
  • Maintainer identityregistry namespace matches repository owner7/10

Findings (2)

  • highWrite-action tools reachable without authenticationauth.open-write
  • lowUnusually long tool description (over 2,000 characters)poison.long-description
    tool entity_profile: …"Tell me about X" / "research Acme" / "brief me on Tesla" / "what does Apple do" / "company profile for Microsoft" / "give me the rundown on NVDA" / "everything you know about $TICKER" — full cross-source profile of a US public company in ONE parallel call. ALWAYS PREFER over chaining single-pack SEC/XBRL/news lookups when the user asks for a holistic view. Fans out across SEC EDGAR, XBRL, USPTO patents, federal contracts (USAspending), FDA-licensed biologics (Purple Book), H-1B hiring (DOL LCA), news and GLEIF, and returns: cik + company_name (+ resolved_from/resolved_to when `value` was a name); recent_filings (up to 5 with pipeworx://edgar/company/{cik}/filings/{accession} URIs); fundamentals (LATEST 10-K Revenues + NetIncomeLoss + Cash, sorted period_end DESC); patents (USPTO PatentsView API sunset May 2025 — soft-fails until reactivated); federal_contracts (USAspending awards where the company is the recipient); fda_products (FDA-licensed biologics — vaccines, cell/gene therapies — from the Purple Book; a company with only small-molecule/generic drugs will show none here, that is expected, not a failure); hiring (H-1B sponsorship volume + salary range from DOL LCA filings); recent news mentions via GDELT→GNews fallback; LEI via GLEIF. `sources_used` / `sources_failed` say which of these actually returned data for THIS company — an empty section is a real "no data", not a bug. `sources_skipped` is the third state: a leg we deliberately did NOT run, each entry carrying a `reason` token and a plain-English `detail` (the Purple Book is skipped for a filer SEC classifies outside the life-science SIC bands, since it lists only 351(a)/(k) biologics licence holders). Pass a ticker ("AAPL"), zero-padded CIK ("0000320193"), OR a company name ("Moderna") — names now resolve via SEC EDGAR's company-name match; a private company (no CIK/ticker) returns resolved:false with an explicit `notes` line, not a bare failure. `type` accepts "company" or "ticker" interchangeably — both take the same `value` shapes above.…
Overall 69/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Pipeworx reviews, tools and install