That matters more here than in most places: a tool that inspects other servers' trust metadata should not also be able to act on them. The boundary is explicit — nothing that executes, deploys or deletes. Everything else about it comes down to whether you want card validation as a service rather than a script in your CI.
A paid remote MCP server that checks server cards: validation, auth checks, trust packets and readiness. It runs hosted, so there is no local process and no build.
- A fixed tool surface for MCP server-card validation, over Streamable HTTP
- Its own server card published at a `.well-known` URL, readable before you connect
- A stated capability boundary: no arbitrary shell execution, no arbitrary SQL, no deployment controls, no deletion tools, no edits to payment configuration
Version 0.1.0, hosted at `https://servercardtrust.space/mcp`. Any client that supports remote Streamable HTTP servers works; set the URL and pass `Authorization: Bearer <token>`. The token is claimed once after checkout — paste only the token value into your client's secret field, not the whole header.