machinegrade-validateSAFE
Deterministic validation for AI-generated artifacts: JSON Schema, OpenAPI response, SQL. Typed verdicts with fix hints. Metered API + MCP.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Validate AI-generated artifacts against a contract before you act on them:
- `json_schema` — validate
artifactagainst a JSON Schema (all errors collected). - `openapi_response` — validate a response body against the response schema for a given
path+method+statusin an OpenAPI spec. - `sql` — check a SQL string for syntax errors in a given dialect.
Every check returns a verdict, not an error: {valid, errors, latency_ms}, HTTP 200 whether the artifact is valid or not. Only genuinely wrong requests (bad key, unsupported type, malformed body, over your limit) get typed HTTP errors.
Live at https://api.machinegrade.dev — free tier, self-service key, try it in 30 seconds (first example below). Built on Hono; the same codebase runs on Cloudflare Workers (production) and plain Node (local dev), and is MIT-licensed if you'd rather self-host.
Why
Agents that generate JSON, API responses, or SQL need a fast, cheap, machine-checkable pass/fail before they ship the result — cheaper than a full LLM-as-judge call, and deterministic.
Run it locally
npm install npm run dev # machinegrade validate listening on http://localhost:8787
3 runnable examples
1. curl
# Get an API key (live service — works as-is)
curl -s -X POST https://api.machinegrade.dev/keys \
-H 'content-type: application/json' \
-d '{"email": "[email protected]"}'
# => {"key":"sk_..."}
# Validate a JSON artifact against a JSON Schema
curl -s -X POST https://api.machinegrade.dev/v1/validate \
-H 'content-type: application/json' \
-H 'X-Api-Key: sk_...' \
-d '{
"type": "json_schema",
"artifact": {"name": "Ada", "age": 30},
"contract": {
"schema": {
"type": "object",
"required": ["name", "age"],
"properties": {"name": {"type": "string"}, "age": {"type": "number"}}
}
}
}'
# => {"valid":true,"errors":[],"latency_ms":1}2. Python (requests)
im
4b8f93c2b5e1OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add validate --env SANDBOX_API_KEY=${SANDBOX_API_KEY} -- npx -y @machinegrade/[email protected]Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
machinegrade-validate | read | Validate AI-generated artifacts against a contract: JSON Schema conformance, OpenAPI response conformance, or SQL syntax. |
validate | read | Validate an artifact against a contract (json_schema | openapi_response | sql) via the machinegrade validate API. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
@cfworker/json-schema, @hono/node-server, @modelcontextprotocol/sdk, hono, node-sql-parser, @cloudflare/workers-types, @types/node, tsx
1. `POST /keys` with `{"email": "[email protected]"}` to get an API key.Gates applied: no_behavioural_pass.
4b8f93c2b5e1full audit observations/trust-audit/mcp-server/machinegrade__validate.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 4b8f93c2b5e1 | SAFE | B | 89 | first audit |
Questions
What is the machinegrade-validate MCP server?
Deterministic validation for AI-generated artifacts: JSON Schema, OpenAPI response, SQL. Typed verdicts with fix hints. Metered API + MCP.
What tools does machinegrade-validate expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is machinegrade-validate safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does machinegrade-validate need?
It reads ADMIN_TOKEN and SANDBOX_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does machinegrade-validate run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @machinegrade/validate at 0.1.2.
How current is this page?
The grade is for one exact copy of the source (4b8f93c2b5e1), read on 2026-10-10. The repository is watched and re-audited when it changes.