Atlas / MCP servers / beepboop2025 / seiche

seicheCAUTION

mcp/beepboop2025/seiche

Free AGPL funding and market-context research for international workflows. A LiquiLens product, connected to institution evidence and Undertow liquidity via API/MCP.

Verdict
CAUTION
Grade
F
Trust score
36 /100
Exposed tools
—
Transport
stdio · streamable-http
License
AGPL-3.0
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Connect and ask one question

Hosted Streamable HTTP MCP; no local server or API key for public read-only tools. Add the products you need to Claude Code:

claude mcp add --transport http seiche https://api.seiche.info/mcp
claude mcp add --transport http liquilens https://api.liquilens.in/mcp
claude mcp add --transport http undertow https://api.seiche.info/undertow/mcp

Try this first: What is the current US funding stress regime, and which dated funding events are next? Cite source dates and missing evidence.

Try it in your browser · Cursor configuration · Codex commands · Free three-product starter kit and skill

For a connected review, ask for institution evidence → funding context → BTC exit estimates, with each source date, coverage gap and limitation kept separate. Client/model costs and fair-use limits may apply. Research calls do not execute trades.

Public US dollar funding research from source-dated Fed and Treasury observations. Live board: seiche.info.

Dated answers to common research questions explain the numbers, source dates and limits.

LiquiLens, Seiche and Undertow are connected research products from LIQUILENS PRIVATE LIMITED, a registered company in India. Built for international review workflows: institution evidence → funding conditions → market liquidity. Market coverage, source clocks and authority remain specific to each product. Company and investors · Company profile · Try the connected workflow.

[](https://api.seiche.info/api/notary)

A seiche is a standing wave in
Read from source at commit 875350154927OBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (pypi)
claude mcp add seiche -- None seiche==0.16.2
03

Trust audit

CAUTIONgrade F · trust 36/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
declared (6 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
found

Findings (25)

MEDIUMInsecure crypto · crypto.weak_random · CWE-327, CWE-338
frontend/src/family-editorial.js:46
const token='editorial-'+Math.random().toString(36).slice(2,10);panel.id=token+'-panel';
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
backend/seiche/dispatch_pages.py:301
"<script type='module' src='https://static.cloudflareinsights.com/beacon.min.js' "
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
backend/seiche/dispatch_pages.py:302
'data-cf-beacon=\'{"token": "534f08f7270a4f4f9a9a10f90d723ca7"}\'></script>'
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
Dockerfile:79
CMD ["/home/nonroot/venv/bin/python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8787/api', timeout=4).read(1)"]
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
backend/seiche/palimpsest_china_activation.py:75
PRODUCTION_API_URL = "http://127.0.0.1:8787"
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
backend/seiche/palimpsest_china_activation.py:1413
not proof["api_url"].startswith("http://127.0.0.1:")
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
backend/seiche/palimpsest_china_activation.py:3319
if not paths.api_url.startswith("http://127.0.0.1:") or paths.api_url.endswith("/"):
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
frontend/src/funding-preview.ts:3
export const fundingPreview = 'data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiIHN0YW5kYWxvbmU9Im5vIj8+CjwhRE9DVFlQRSBzdmcgUFVCTElDICItLy9XM0MvL0RURCBTVkcgMS4xLy9FTiIKICAiaHR
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
ops/railway-automation/publisher/github-known-hosts:3
github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBy
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
backend/seiche/engines/book.py:64
"duration sleeves are PAPER PROXIES: r ≈ y/252 − D·Δy + 1⁄2C·Δy2 on constant-maturity "
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
backend/seiche/engines/harbors.py:229
f"renormalize, never score as calm; regime = 6m Δrate vs ±{HARBOR_REGIME_BP}bp"
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
backend/seiche/engines/spillover.py:118
frm = off.sum(axis=1)          # from others into i (row off-diагonal)
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
frontend/src/motion/WaveTank.tsx:25
const MODES = [1, 2, 3];       // driven standing modes (fixed-fixed: sin(kπx/L))
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
frontend/src/tabs/Proof.tsx:144
<thead><tr><th>toggle</th><th>what breaks</th><th>AUROC</th><th>ΔAUROC</th><th>recall</th><th>run-precision</th></tr></thead>
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
.github/workflows/market-platform-ci.yml:40
SEICHE_TEST_POSTGRES_URL: postgresql://seiche:[email protected]:5432/seiche_test
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
backend/tests/test_collector_reliability.py:709
"postgresql://private-user:private-password@db/seiche"
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
backend/tests/test_ingest_runtime.py:91
"postgresql://private-user:private-password@db/seiche?token=private"
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
backend/tests/test_market_validation_cli.py:210
secret_dsn = "postgresql://operator:[email protected]/seiche"
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
backend/tests/test_stateful_application.py:416
dsn = f"postgresql://desk:p%40ss%20word@test/{name}?sslmode=require"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
backend/tests/test_mcp_server.py:919
secret = "tool-error-secret-74"
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
.github/workflows/railway-stateful-recovery.yml:243
if not key.startswith("-----BEGIN OPENSSH PRIVATE KEY-----"):
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
.github/workflows/railway-stateful-recovery.yml:949
if not key.startswith("-----BEGIN OPENSSH PRIVATE KEY-----"):
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
backend/tests/test_agent_room.py:722
{"note": "-----BEGIN PRIVATE KEY-----\nabc"},
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
backend/tests/test_railway_stateful_workflow_transport.py:60
"PROBE_SSH_KEY": "-----BEGIN OPENSSH PRIVATE KEY-----\nfixture\n",
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
backend/tests/test_railway_stateful_workflow_transport.py:134
"PROBE_SSH_KEY": "-----BEGIN OPENSSH PRIVATE KEY-----\nfixture",

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 875350154927full audit observations/trust-audit/mcp-server/beepboop2025__seiche.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11875350154927CAUTIONF36first audit
05

Questions

What is the seiche MCP server?

Free AGPL funding and market-context research for international workflows. A LiquiLens product, connected to institution evidence and Undertow liquidity via API/MCP.

Is seiche safe to connect to an agent?

With care. The audit graded it F (36/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does seiche need?

It reads CLOUDFLARE_API_TOKEN, EDITORIAL_LLM_API_KEY, EXPECTED_AUTHORITY, FIXTURE_KEY, GH_TOKEN, GITHUB_TOKEN, KEY_MD5, RELEASE_SIGNING_KEY_FINGERPRINT, SEICHE_AGENT_ROOM_EXPECTED_KEY_ID, SEICHE_ASOF_AUTH, SEICHE_ATTEST_TRUSTED_PUBLIC_KEYS and SEICHE_AUTH_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does seiche run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as seiche-ui at 0.1.0.

How current is this page?

The grade is for one exact copy of the source (875350154927), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement