Mmcp.market

Is Robots.txt Policy Lint MCP server safe?

Probably. Read the findings first.

C67/100grade C

Use with care. Some checks failed or could not be verified.

Public scan report

scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it

2 low
  • Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 510ms20/20
  • Tool poisoning9 tool descriptions checked13/15
  • Auth qualityopen endpoint, read-only tools10/15
  • Maintenanceno repository listed3/15
  • Maintainer identityverified namespace with website, no repo4/10

Findings (2)

  • lowUnusually long tool description (over 2,000 characters)poison.long-description
    tool no_arguments_lint_this_hosts_robots_txt: …TAKES NO ARGUMENTS. POST {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"no_arguments_lint_this_hosts_robots_txt","arguments":{}}} to https://www.pathwren.workers.dev/mcp/robots — the answer is the full RFC 9309 lint of this host's OWN robots.txt and ai.txt, run for real on the bytes it serves — every finding with its severity, its line number and the fix, plus an allowed/disallowed verdict per crawler token per path with the exact rule and line that produced it, and the check that the two files still agree with each other. There is nothing to fill in: the input schema is literally empty, `arguments: {}` and no `arguments` key at all both work, and the subject is a file this host already publishes, so the answer does not depend on you at all. No key, no account, no OAuth, no session to open first, read-only, and nothing for you to invent. Nothing is fetched to build it — no request leaves this edge, and none is made to you. The other zero-argument call on this server is am_i_allowed, same empty arguments, which answers what this host's own robots.txt says to YOU — the group that matches your user-agent, the line that decided it, that group verbatim, and whether you are allowed each of three paths, evaluated by the same RFC 9309 engine as check_path_allowed. whoami and example are here too and take nothing either. Every other tool on this server wants a file pasted in; this one wants nothing. The siblings answer one question each under the tool named beside them: /mcp (whoami), /mcp/doctor (no_arguments_check_this_hosts_own_discovery_documents), /mcp/lint (whoami), /mcp/triage (no_arguments_triage_this_hosts_own_crawler_log), /mcp/netcheck (no_arguments_report_the_crawler_ip_ranges_this_host_mirrors), /mcp/markdown (markdown_lane_self_report). Example: the complete call, exactly as written, nothing to fill in — {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"no_arguments_lint_this_hosts_robots_txt","arguments":{}}} returns both files parsed and linted, their findings with line numbers and fixes, a verdict table naming the rule that decided each row, the roll-up of which indexed AI crawlers this host's file actually stops, and the agreement check between robots.txt and ai.txt.…
  • lowNo source repository listedmaint.no-repo
Overall 67/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Robots.txt Policy Lint reviews, tools and install