内部参考报告 / 仅元数据

GraphCanon MCP

匿名 MCP 端点的带日期快照。本报告记录协议和目录证据，并明确标示未测试的部分。

匿名端点配置2026-10-15 UTC测试程序 1.0.1

以下原始证据与技术观察保留英文。

这份报告证明了什么

The public endpoint advertised nine tools and passed four bounded metadata checks. This establishes metadata coverage only, not task success or client compatibility.

All nine tools omit readOnlyHint and destructiveHint. Those optional declarations remain unknown. This is not a protocol failure or proof of unsafe behavior.

通过的元数据检查: 4
工具执行次数: 0
ChatGPT / Claude: 未测试
总分: 未评分

已记录的检查

protocol-negotiation

Negotiated protocol 2025-11-25; this does not establish host compatibility.

证据: request-1

通过

initialized-notification

The initialization notification received HTTP 202 with an empty body.

证据: request-2

通过

tool-catalog

Observed the complete advertised catalog: 9 tools across 1 pages.

证据: request-3

通过

tool-metadata-shape

SDK metadata shape checked for 9 observed tools. This is not complete JSON Schema validation or behavior verification.

证据: request-3

通过

oauth-login

OAuth discovery, login, token refresh and authenticated access are outside this anonymous pilot.

未测试

观察到的工具目录

工具名称来自 tools/list。没有执行任何工具。

compare_tools
get_alternatives
get_compatibility
get_graph
get_tool
get_trust_report
list_categories
resolve_by_constraints
search_tools

端点与来源

端点: https://www.graphcanon.com/api/mcp
配置: Anonymous, public endpoint
协议: 2025-11-25
观察时间: 2026-10-15T02:05:55.294Z
运行 ID: 512702bd-b19c-4681-9fa1-01266bf93380
SHA-256: 03cd7efc1e13e57b7e1b2c37dfc01e79ce2511f8928b5d6da53e9217534f0c35

SHA-256 of all observed tool objects, recursively sorted object keys and sorted canonical tool strings; schema array order is preserved. Raw descriptions, schemas and headers are not persisted.

JSON 证据 Markdown 报告

这份报告无法证明什么

未验证 OAuth、认证后执行、完整 JSON Schema 语义、安全性、任务成功率、ChatGPT、Claude 或官方发布批准。

Metadata-only internal unpaid reference run. No tools/call, OAuth flow, API model calls, host UI or publication review was executed. No global quality or safety score is produced.
Annotations are server declarations, not verified behavior. Metadata success does not establish task success, security, usefulness or ChatGPT/Claude compatibility.
Only two exact owner-approved HTTPS URLs are accepted. Redirects, supplied credentials, arbitrary endpoints and OAuth URL fetching are disabled. DNS/TLS use the local runtime: this is not a hardened multi-tenant SSRF sandbox and must not be exposed as a public scanner.
Session identifiers are used only in memory. Request/response headers, raw error messages, raw descriptions and schemas are excluded from artifacts. Tool names and aggregate metadata remain untrusted server input.
Only the recorded protocol versions and bounded catalog prefix are supported. Reaching a bound or lacking access means unknown, not a failed server or a passing full audit.

有值得评审的 MCP 端点？

请通过邮件提供公开端点或代码库、关注的客户端，以及必须正常运行的一项任务。测试前我们会讨论范围和沙箱访问。

讨论评审范围

将打开邮件应用。请勿发送密钥、令牌或客户隐私数据。这是范围咨询，不是自动扫描或购买。