webcite-mcp-serverSAFE
MCP server for fact-checking AI claims against authoritative sources. Works with any MCP-compatible agent — Claude, Cursor, Continue, Cody, Zed, Windsurf, OpenAI Agents, LangChain, and more.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Remote Streamable HTTP MCP: https://api.webcite.co/mcp. Start at https://webcite.co/connect. The remote server uses the public profile for all supported public API workflows. Check the published npm version before pinning it, because repository changes can precede publication.MCP (Model Context Protocol) server for WebCite — lets any AI agent verify factual claims against authoritative sources, bind quotes back to the passage they came from, and read the numbers out of documents deterministically.
Works with any MCP-compatible client including Claude Desktop, Claude Code, Cursor, Continue, Cody, Zed, Windsurf, OpenAI Agents SDK, LangChain, and more.
Verification and document acceptance
On servers implementing retained generation navigation, a folder generation can include one navigation-query provider stage within the existing five-credit generation operation. Its route is selected before calling the provider, and a refusal, invalid reply, failure or unknown outcome remains an error without provider switching, automatic retry or silent original-query fallback. Public memo model and token usage keep their existing meaning; separate query-provider measurements are internal. Internal staged continuation is identity-bound and requires complete accounting with no draft dispatch. It does not expose a new public preparation feature. Confirm the serving release before relying on this behavior.
On servers implementing isolated generation retrieval budgets, the default 16-anchor retrieval limit gives evidence-reference hints and mandatory core context up to 32,000 retained-text characters, plus up to 32,000 incremental ordinary-retrieval characters, bounded by 64,000 in total. Without evidence references, retained text remains bounded by 32,000 characters. Ordinary retrieval allows up to 16 anchors per retained navigation query, or 16 with no navigation queries, subject to the same text and physical-unit ceilings. The physical-u
de80f8337a07OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add webcite-mcp-server --env WEBCITE_API_KEY=${WEBCITE_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"webcite-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"WEBCITE_API_KEY": "${WEBCITE_API_KEY}"
}
}
}
}Exposed tools (37)
31 read · 6 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
accuracy_report | read | The numeric engine |
ask_document | read | Check numerical answers inside supplied document text. Returns a job ID; poll with get_ask_result. It does not search for external source URLs or identify the original publisher. Costs 5 credits. Unverified numbers remain null. |
certify_private_upload | write | I1: Certify private evidence upload configuration for cutover/eval. Missing EVIDENCE_STORAGE_ROOT or EVIDENCE_BUCKET_NAME returns ok:false with not_run — never a pass. Credits: 1. HTTP: GET /api/v2/context/private-upload/certify |
certify_retrieve_flag | read | C2: Report CONTEXT_GRAPH_RETRIEVE posture for cutover/eval. Default remains off; enabled:false is ok (default_off: true), not a misconfiguration. Credits: 1. HTTP: GET /api/v2/context/retrieve/flag |
document_gaps | read | The |
eval_catalog | read | List the authorized evaluation suite catalog. Private gold remains denied to non-evaluator callers (private_gold_denied: true). Credits: 1. HTTP: GET /api/v2/context/eval/catalog |
extract_figures | read | Extract recognized financial metrics from a document as tagged, source-grounded figures: the value normalized to its canonical unit, what it means (\ |
extract_pages | read | Extract citation-ready document chunks with page, sheet or section anchors. Returns extraction state and reason even when no chunks exist. Costs 1 credit. |
formal_revenue_bridge | read | Discharge a revenue-bridge obligation over exact consistent scopes (P4). Credits: 1. HTTP: POST /api/v2/context/formal/revenue-bridge |
format_certify | read | Certify planted spreadsheet/office/text/image/container/media inventory coverage (F1–F4). Fails closed. Media requires decode_finished. Credits: 1. HTTP: POST /api/v2/context/format/certify |
get_ask_result | read | Poll a document question job. Returns queued, running, done or failed status and the checked result when ready. Costs 0 credits. |
get_citation | read | Get the full details of a specific past verification by its ID. Credits: 1 |
get_consumer_usage | read | Customer-credit usage for everything one consumer consumed (I4). Blank/whitespace/surrounding-padded consumer_kind / consumer_id → incomplete_consumer_identity (never trim-launder into a certified usage hit). Credits: 1. HTTP: GET /api/v2/context/usage/consumer |
get_context_workflow | read | Read one immutable saved-context workflow revision. Blank/whitespace/surrounding-padded revision_id → incomplete_workflow_revision_identity (W3 #264/#279 pad honesty — never trim-launder into a certified workflow revision). Credits: 1. HTTP: GET /api/v2/context/workflows/:revisionId |
get_credit_balance | read | Read the authenticated account credit balance for an explicit balance question or an unresolved credit refusal. A routine document review does not require this call; use inline credit_usage from normal responses. Costs 0 credits. Returns remaining, used and total credits; no billing change is made. |
get_document_review | read | Read a saved document review by review_id without new analysis or credits. Page claims, uncovered passages, rejected candidates and explicit reviewer dispositions independently. The API key must own the review. |
get_evaluation | write | Describe an authorized evaluation run. Private gold stays denied. Blank/whitespace/surrounding-padded run_id → incomplete_evaluation_run_identity (W3 #264/#279 pad honesty — never trim-launder into a certified evaluation run). Credits: 1. HTTP: GET /api/v2/context/evaluations/:runId |
get_latest_representation | read | Locate the latest representation and source unit IDs of an owned retained source. Use these IDs to read evidence or verify a numeric claim. |
get_operation | read | Read one EvidenceOperation the caller owns (I4), including settlement fields. Blank/whitespace/surrounding-padded operation_id → incomplete_operation_identity (never trim-launder into a certified operation lookup). Credits: 1. HTTP: GET /api/v2/context/operations/:operationId |
get_operation_availability | read | Read root budget availability as the ledger sees it (I4). Clients must not re-derive this weakly. Blank/whitespace/surrounding-padded operation_id → incomplete_operation_identity (never trim-launder). Credits: 1. HTTP: GET /api/v2/context/operations/:operationId/availability |
get_workflow_run | write | Fetch an authorized workflow run artifact by run ID. Blank/whitespace/surrounding-padded run_id → incomplete_workflow_run_identity (W3 #264/#279 pad honesty — never trim-launder into a certified workflow run). Credits: 1. HTTP: GET /api/v2/context/runs/:runId |
learning_apply | write | Apply a learning proposal only when an explicit policy gate allows it (E2). Credits: 1. HTTP: POST /api/v2/context/learning/apply |
learning_judge | read | E2 judge control: hard failures reject; uncertain may request evidence once. Credits: 1. HTTP: POST /api/v2/context/learning/judge |
learning_placeholder | read | Return a non-authoritative placeholder calibration checkpoint (E2). Credits: 1. HTTP: GET /api/v2/context/learning/placeholder |
list_citations | read | List your past verification results. Useful for reviewing previous fact-checks or continuing a research session. Credits: 1 |
list_metric_definitions | read | List persisted metric definition revisions (C1c). Credits: 1. HTTP: GET /api/v2/context/metric-definitions |
prepare_ocr_rescue | read | Prepare judged OCR rescue for an owned OCR source representation before previewing unresolved citations. A new successful preparation costs 5 credits; retained replays are free. Requires the backend OCR feature; return unavailable states honestly. |
proofs_applies | read | Probe whether a proof receipt still binds under the current premise hash and approved toolchains (P3). Does not invent proved status. Credits: 1. HTTP: GET /api/v2/context/proofs/applies |
publish_text_representation | write | Publish a deterministic text or CSV representation of an owned retained source. Returns representation and source unit IDs for verify_numeric_claim. No model call. |
read_source_unit | read | Read one owned immutable source unit by the IDs returned from a source representation. Inspect its numeric content before choosing figure_index. |
register_source | read | Register original text or CSV bytes for an uploaded, owned asset. Returns a retained sourceVersionId for source representation and numeric verification. |
release_operation | read | Release an undispatched reservation and return credits to the account (I4). Dispatched operations cannot be released. Blank/whitespace/surrounding-padded operation_id → incomplete_operation_identity (never trim-launder). Credits: 1. HTTP: POST /api/v2/context/operations/:operationId/release |
reserve_research_budget | write | Reserve credits under a research run |
review_document | read | For |
verify_feedback | read | Record a human verdict on a verify_batch result. Pass the feedback_token from that result plus your verdict; the token carries the result summary, so token + verdict is enough. Feedback is stored, so corrections accumulate over time. Credits: 1 |
verify_numeric_claim | read | Assess arithmetic against one or two retained figures from owned source units. This is arithmetic scope, not full semantic verification. |
webcite_guide | read | Call this free guide first to choose a Webcite workflow. Use workflow=source_trace to identify the original source of a screenshot or slide; use workflow=document_review to check every claim in an uploaded file. Costs 0 credits. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (7)
# Health: curl http://127.0.0.1:8787/health
# MCP: POST http://127.0.0.1:8787/mcp with Authorization: Bearer <api_key>
url: `http://127.0.0.1:${server.address().port}`,const res = await fetch(`http://127.0.0.1:${port}/health`);const res = await fetch(`http://127.0.0.1:${port}/mcp`, {@modelcontextprotocol/sdk, undici, @types/node, typescript
Gates applied: no_behavioural_pass, no_license.
de80f8337a07full audit observations/trust-audit/mcp-server/strategyconnect__webcite-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | de80f8337a07 | SAFE | B | 89 | first audit |
Questions
What is the webcite-mcp-server MCP server?
MCP server for fact-checking AI claims against authoritative sources. Works with any MCP-compatible agent — Claude, Cursor, Continue, Cody, Zed, Windsurf, OpenAI Agents, LangChain, and more.
What tools does webcite-mcp-server expose?
37 in total: 31 read-only, 6 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is webcite-mcp-server safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does webcite-mcp-server need?
It reads WEBCITE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does webcite-mcp-server run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as webcite-mcp-server at 1.9.60.
How current is this page?
The grade is for one exact copy of the source (de80f8337a07), read on 2026-10-12. The repository is watched and re-audited when it changes.