Atlas / MCP servers / marino129 / creationloop

creationloopSAFE

mcp/marino129/creationloop-mcp

CreationLoop remote MCP. Public company and design-partner tools require no authentication; authenticated operators can also use the advisory-only GTM review tool.

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
—
Transport
streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

CreationLoop is your Marketing Agent.

Verified agent output. The recursive loop that gets better, and proves it.

This is the public listing for CreationLoop's remote MCP server. The server lets any MCP-capable agent read CreationLoop's canonical company information and submit a design-partner application on a user's behalf. It is a hosted, remote server: there is nothing to install and no key to configure. Point your client at the endpoint below and connect.

  • Endpoint: https://creationloop.ai/api/mcp
  • Transport: Streamable HTTP (stateless, JSON responses)
  • Authentication: none required
  • Method: POST only (JSON-RPC 2.0)

What the server is

CreationLoop is a Marketing Agent for early-stage founders and small brands. The MCP server exposes a small, deterministic surface: three read tools that return CreationLoop's canonical public copy verbatim, and one write tool that submits a design-partner application. No model sits in the response path of the read tools, so their output is fixed text, not generated on the fly.

The server is remote and hosted by CreationLoop. Your client connects over Streamable HTTP; there is no local process, no package to install, and no credential to supply.

Transport details

The server implements the MCP Streamable HTTP transport in stateless mode:

  • URL: https://creationloop.ai/api/mcp
  • Accepted method: POST with a JSON-RPC 2.0 body.
  • Response mode: plain JSON (application/json). The server runs with JSON

responses enabled and no SSE stream, so each request gets a single JSON reply.

  • Sessions: none. Every request builds a fresh server and transport pair, so

there is no session id to track and no session to resume or delete.

  • `GET` and `DELETE`: return HTTP 405 with a JSON-RPC error

(code -32000, message "Method not allowed. POST JSON-RPC to this endpoint."). Because the server is stateless there is no SSE stream to op

Read from source at commit c453e107ab69OBSERVED · 2026-10-14
02

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeNA
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (2)

MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table

Gates applied: no_behavioural_pass.

Audited 2026-10-14 · audit v0.4.1 · source sha c453e107ab69full audit observations/trust-audit/mcp-server/marino129__creationloop-mcp.json · Report an issue / request a re-scan
03

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-14c453e107ab69SAFEB89first audit
04

Questions

What is the creationloop MCP server?

CreationLoop remote MCP. Public company and design-partner tools require no authentication; authenticated operators can also use the advisory-only GTM review tool.

Is creationloop safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does creationloop need?

No credential environment variables were found in its source, so it appears to need none.

How does creationloop run?

It speaks streamable-http, so it runs as a service you connect to over the network.

How current is this page?

The grade is for one exact copy of the source (c453e107ab69), read on 2026-10-14. The repository is watched and re-audited when it changes.

Advertisement