overwing-mcpCAUTION
Overwing MCP server: guardrails for LLM output. pass / fail / review verdicts with calibrated confidence for any MCP-capable agent.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Guardrails for LLM output, as MCP tools. Score any text for safety and quality. Get pass / fail / review verdicts with calibrated confidence, usually in under 500 ms.
简体中文 · 日本語 · 한국어
Overwing is an API that checks what your model said before it ships. This package exposes it to any MCP-capable agent: Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, OpenAI's Agents SDK, and anything else that speaks the Model Context Protocol.
- Real verdicts, not vibes. Every rule returns a typed answer, a probability, and a confidence.
failmeans a rule matched;reviewmeans it was unsure;passmeans neither. - Prebuilt `content-safety` and `outbound-message` rule sets: toxicity, personal data, confidential leaks, self-harm, sexual content, severity. Or write your own rules in plain language.
- Built for agents. Sign up, pay, evaluate, rotate keys, and cancel, all as JSON. No CAPTCHA, no
4846b7053b84OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add overwing-mcp --env OVERWING_API_KEY=${OVERWING_API_KEY} --env OVERWING_AGENT_KEY=${OVERWING_AGENT_KEY} -- npx -y [email protected]Exposed tools (39)
32 read · 6 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
atlas_agents | read | |
atlas_list_registrations | read | |
atlas_lookup | read | |
atlas_register_agent | read | |
atlas_summary | read | |
atlas_verify_registration | read | |
atlas_withdraw_registration | read | |
beacon_report | read | |
beacon_sample | read | |
beacon_start | write | |
create_account | write | |
create_rule_set | write | |
evaluate | read | |
evaluate_batch | read | |
get_evaluation | read | |
get_rule_set | write | |
get_usage | read | |
list_evaluations | read | |
list_plans | read | |
list_rule_sets | read | |
preflight_check | read | |
preflight_overview | read | |
preflight_record | read | |
preflight_report | read | |
preflight_verdict | read | |
prove_domain | read | |
tower_capabilities | read | |
tower_compensate | read | |
tower_create_agent | write | |
tower_decide | read | |
tower_get_action | read | |
tower_get_receipt | read | |
tower_list_agents | read | |
tower_load_template | read | |
tower_revoke_agent | destructive | |
tower_submit_action | write | |
tower_verify_receipts | read | |
verify_domain | read | |
whoami | read |
Trust audit
CAUTIONgrade B · trust 86/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (7 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (11)
if (r.status === "verified") return `${r.domain} is verified. The account now has the normal free limits, full Beacon reports, and key recovery by domain.`;"Create an Overwing account for yourself, with no email: an organization and an API key, returned once. Nothing is sent to anyone. Use it when OVERWING_API_KEY is not set and nobody has given you a ke
description: "Begin proving that your account controls a domain. For an account with no email the domain stands in for one: it raises the limits to the normal free tier, opens full Beacon reports, and
title: "Start a reachability check (Overwing Beacon)",
"Overwing Beacon answers one question about a site: is this product reachable by agents? It checks robots.txt rules for AI agents, llms.txt, the sitemap, the MCP server card, hosted MCP endpoint and M
tower_revoke_agent
@modelcontextprotocol/sdk, zod, @types/node, typescript
It works with no API key: `evaluate` and `atlas_lookup` each run 10 times a day free, and text sent without a key is not stored. For more, get a key at [overwing.ai/login](https://overwing.ai/login),
-d '{"email":"[email protected]","password":"at-least-12-chars"}'-d '{"email":"[email protected]","password":"at-least-12-chars"}'-d '{"email":"[email protected]","password":"at-least-12-chars"}'Gates applied: no_behavioural_pass.
4846b7053b84full audit observations/trust-audit/mcp-server/frod27__overwing-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 4846b7053b84 | CAUTION | B | 86 | first audit |
Questions
What is the overwing-mcp MCP server?
Overwing MCP server: guardrails for LLM output. pass / fail / review verdicts with calibrated confidence for any MCP-capable agent.
What tools does overwing-mcp expose?
39 in total: 32 read-only, 6 that write, and 1 that can delete or overwrite (tower_revoke_agent). Every one is listed on this page with its risk.
Is overwing-mcp safe to connect to an agent?
With care. The audit graded it B (86/100) and found 11 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does overwing-mcp need?
It reads OVERWING_AGENT_KEY and OVERWING_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does overwing-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as overwing-mcp at 0.13.0.
How current is this page?
The grade is for one exact copy of the source (4846b7053b84), read on 2026-10-11. The repository is watched and re-audited when it changes.