mcp-serverBLOCK
Verify AI outputs in real-time to ensure code and data accuracy before execution with this Model Context Protocol server.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The MCP Reliability Layer for AI Others deliver messages. We verify the content.
What is this?
Correctover is the first MCP server that verifies AI outputs in real-time.
While every other MCP server connects your AI tools to data sources, Correctover sits in the execution path and ensures every LLM response is correct, complete, and reliable — before it reaches your editor.
Your AI Tool (Cursor/Claude Desktop/Windsurf) │ ▼ ┌─────────────────────────────────┐ │ Correctover MCP Server │ │ │ │ 1 Route → picks best provider │ │ 2 Execute → calls LLM API │ │ 3 Verify → 6-dim check │ ← This is what nobody else does │ 4 Heal → auto-fix or failover │ │ 5 Deliver → verified output │ │ │ └─────────────────────────────────┘ │ ▼ LLM Providers (OpenAI / Anthropic / DeepSeek / ...)
Why you need this
AI APIs don't just fail with HTTP 500. The worst failures are silent:
- Response looks valid but contains hallucinated data
- JSON output is truncated mid-object
- Provider silently degrades output quality over time
- Token usage spikes without warning
Correctover catches all of these. Every response passes through 6-dimension validation:
b6006ad74e7bOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add correctover-mcp-server --env DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY} --env OPENAI_API_KEY=${OPENAI_API_KEY} --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env MOONSHOT_API_KEY=${MOONSHOT_API_KEY} -- npx -y [email protected]Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (16)
devto-payload.json
server_mcp_1.6.zip
mod = importlib.import_module(mod_path)
console.log(' Token 信息:', token.substring(0, 20) + '...');schtasks /CREATE /TN "Correctover\MCP Spec Monitor" /TR "C:\Program Files\Git\bin\bash.exe -l -c \"cd /c/d/workspace/correctover && bash scripts/check_mcp_spec_version.sh\"" /SC WEEKLY /D MON /ST 09:0
.mcp-version-state
.bd_state.json
.vscodeignore
sudo mv mcp-publisher /usr/local/bin/
@remotion/cli, react, react-dom, remotion, @types/react, typescript
@types/node, @types/vscode, typescript, @vscode/vsce, ovsx
video/demo.mp4
system="You are a senior architect.",
<p>Recommended for production: load API keys from environment variables.</p>
system use found in code, not declared in the description
Gates applied: no_behavioural_pass.
b6006ad74e7bfull audit observations/trust-audit/mcp-server/m8louist12-boop__mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | b6006ad74e7b | BLOCK | D | 69 | first audit |
Questions
What is the mcp-server MCP server?
Verify AI outputs in real-time to ensure code and data accuracy before execution with this Model Context Protocol server.
Is mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does mcp-server need?
It reads AGNES_API_KEY, ANTHROPIC_API_KEY, CUSTOM_API_KEY, DASHSCOPE_API_KEY, DEEPSEEK_API_KEY, KIMI_API_KEY, MOONSHOT_API_KEY, OPENAI_API_KEY and QUICKROUTER_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does mcp-server run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as correctover-vscode at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (b6006ad74e7b), read on 2026-10-12. The repository is watched and re-audited when it changes.