Atlas / MCP servers / nulljosh / sidewise

sidewiseCAUTION

mcp/nulljosh/sidewise

Reads 16 feeds across the political spectrum and flags stories only one side is covering.

Verdict
CAUTION
Grade
B
Trust score
89 /100
Exposed tools
4 4r · 0w · 0d
Transport
streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/nulljosh/sidewise)

What is the other side reading?

Sidewise pulls 16 feeds from 14 newsrooms across the spectrum, tags each left, center or right, and flags the blindspots: stories only one side is covering. Free. No account, no key, no limit.

Two feeds from one newsroom count as one voice. A publisher can't run an opinion section next to its main feed and call that two sources.

Five ways in: a web reader, native iPhone, iPad and Mac apps, a JSON API, an MCP server, and a terminal client (swift build && ./.build/debug/sidewise-tui 5 — see tui/).

Screenshots

Apps

SwiftUI, one codebase for iOS and macOS, in ios/. It reads the same public API. No account, no tracking. Saved stories, follows, reading history and the feed cache stay on the device.

What the iPhone and iPad app does beyond a list of stories:

  • Compare. Open a story and each outlet's headline sits side by side, left to right, with

its rating and a link out. The Compare tab lists only stories two or more outlets cover. A one-outlet story says so instead of faking a comparison. The feed's clusters sometimes pull in an unrelated item, so a headline stays in a comparison only if it shares at least two meaningful words with the story's title.

  • Outlets and Following. Every outlet with its rating and recent headlines. Follow or mute

any of them; muted outlets disappear, followed ones get their own tab.

  • My Diet. This week's left, center and right mix of what you actually opened, your

average

Read from source at commit c112c1029812OBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add sidewise -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "sidewise": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (4)

4 read · 0 write · 0 destructive.

ToolRiskDescription
compare_coveragereadSide-by-side wording of one story as left, center and right outlets headline it, plus the words each side uses that the others do not.
get_blindspotsreadStories covered by only one side of the political spectrum — reported by left-leaning outlets but not right-leaning, or vice versa.
get_feed_healthreadWhich of the underlying news feeds answered on the last pull, and whether the data currently being served is complete or a stale fallback.
get_newsreadCurrent headlines from newsline\
04

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (5 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (4)

MEDIUMInventory / provenance · inv.binary · CWE-1104
kmp/gradle/wrapper/gradle-wrapper.jar
gradle-wrapper.jar
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWInventory / provenance · inv.symlink · CWE-1104
AGENTS.md
AGENTS.md
Why it matters. link not followed
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
test/webmcp.test.mjs:32
const fn = new Function(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha c112c1029812full audit observations/trust-audit/mcp-server/nulljosh__sidewise.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11c112c1029812CAUTIONB89first audit
06

Questions

What is the sidewise MCP server?

Reads 16 feeds across the political spectrum and flags stories only one side is covering.

What tools does sidewise expose?

4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is sidewise safe to connect to an agent?

With care. The audit graded it B (89/100) and found 4 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does sidewise need?

No credential environment variables were found in its source, so it appears to need none.

How does sidewise run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as sidewise at 0.4.0.

How current is this page?

The grade is for one exact copy of the source (c112c1029812), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement