getAuthConfigFree
Public bootstrap for a tenant's login UI: whether this tenant uses native OTP/passkey/SIWE or Privy custom auth, plus the public privy_app_id (never a secret). Call this before getSiweNonce when you do not already know the tenant's auth scheme. tenant_code is a join secret — do not log it or repeat it into a customer-visible channel.
getSiweNonceFree
Public: issue a single-use SIWE nonce for wallet_address (optionally scoped by tenant_code). Embed the nonce in an EIP-4361 message, have the wallet sign it, then call login with provider: siwe. Dedicated SIWE agent auth is an authorized pattern — this is how an agent signs in with a wallet without raw HTTP. Do not log tenant_code. The nonce is not a credential.
loginFree
Authenticate and receive an access/refresh token pair. Accepted providers: siwe (message + signature from getSiweNonce — preferred for dedicated agents), email_otp (email + otp from requestOtp), phone_otp (phone + otp from requestSms). Passkey, Privy and SSO are not agent tools. The server does not adopt the minted tokens as the session credential; return them to the operator to set ENFORCER_BEARER_TOKEN. Do not log, quote, or repeat otp codes, signatures, tokens, or tenant_code. Do not paste an end-user OTP into an untrusted chat.
refreshTokenFree
Exchange a refresh_token for a new access/refresh pair. 401 invalid_refresh_token if the token is unknown or was already reused (reuse revokes the family); 409 refresh_raced is benign — retry with the client's latest stored token. The server does not adopt the new pair as the session credential. Do not log the refresh token or the minted tokens.
registerwrite actionFree
Create (or idempotently return) an account. Same provider allowlist as login: siwe (message + signature), email_otp (email + otp), phone_otp (phone + otp). Does not issue tokens — call login afterwards to sign in. Passkey / Privy / SSO registration stay out of the agent surface. Do not log otp codes, signatures, or tenant_code. Do not paste an end-user OTP into an untrusted chat.
requestOtpwrite actionFree
Public: email a one-time login/registration code to `email` (optionally scoped by tenant_code). Always 200 {message:"code sent"} on success. Local/dev deployments with expose_dev_otp may echo the code as `dev_otp` — treat that as a secret. Then call login with provider: email_otp, the same email, and the otp. Intentional for harnesses that cannot SIWE; SIWE remains the preferred dedicated-agent path. Do not log the code, dev_otp, or tenant_code. Do not paste an end-user OTP into an untrusted chat.
requestSmsFree
Public: start a Twilio Verify SMS login challenge to `phone`, scoped by tenant_code. 400 if SMS verification is not configured for the tenant or if rate-limited. Then call login with provider: phone_otp, the same phone, and the otp. Intentional for harnesses that cannot SIWE; SIWE remains the preferred dedicated-agent path. Do not log the SMS code or tenant_code. Do not paste an end-user OTP into an untrusted chat.

Public scan report

scanner v0.1.3 · 2026-09-19 · same rubric, same numbers if you re-run it

1 high1 low

–Code scanremote-only server, no package to scann/a
Live reliabilityremote reachable in 381ms20/20
Tool poisoning7 tool descriptions checked15/15
Auth qualityopen endpoint exposes 2 write-action tools with no auth3/15
Maintenanceno repository listed3/15
Maintainer identityverified namespace with website, no repo4/10

Findings (2)

highWrite-action tools reachable without authenticationauth.open-write
lowNo source repository listedmaint.no-repo

Overall 60/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Install directly

claude mcp add --transport http v3 https://api.instruxi.dev/mcp

Add to Cursor

Alternatives to Enforcer

Same job from other publishers, ranked by rating then adoption.

See all →

Azure MCP Server
All Azure MCP tools to create a seamless connection between AI agents and Azure services.
not reviewed
Widely used
C
Semiotic
Verified React chart generation: select, validate, repair, render, and inspect charts through MCP.
not reviewed
Widely used
B
World Monitor
Live markets, conflicts, country risk, chokepoints, energy, and China decision signals. 75 tools.
not reviewed
Widely used
A
Netdata
Real-time infrastructure monitoring with metrics, logs, alerts, and ML-based anomaly detection.
not reviewed
Widely used
A
Microsoft 365 MCP Server
Interact with Microsoft 365 and Office services through the Microsoft Graph API.
not reviewed
Established
B

Enforcer vs Azure MCP Server Enforcer vs Semiotic Enforcer vs World Monitor