Universal Tool Calling Protocol (UTCP) for TypeScriptBLOCK
Official typescript implementation of UTCP. UTCP is an open standard that lets AI agents call any API directly, without extra middleware.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/universal-tool-calling-protocol) [](https://www.npmjs.com/package/@utcp/sdk) [](https://github.com/universal-tool-calling-protocol/typescript-utcp/blob/main/LICENSE) [](https://cdtm.com/)
The Universal Tool Calling Protocol (UTCP) is a secure and scalable standard for defining and interacting with tools across a wide variety of communication protocols. This repository contains the official TypeScript implementation, structured as a monorepo with a lean core and pluggable communication protocols.
UTCP offers a unified framework for integrating disparate tools and services, making them accessible through a consistent and well-defined interface. This TypeScript SDK provides a comprehensive toolkit for developers to leverage the full power of the UTCP standard in their applications.
Key Features
- Automatic Plugin Registration: The official plugins are automatically discovered and registered when you import the core client—no manual setup required. For other plugins, you will need to register them manually.
- Scalability: Designed to handle a large number of tools and providers without compromising performance.
- Extensibility: A pluggable architecture allows developers to easily add new communication protocols, tool storage mechanisms, and search strategies without modifying the core library.
- Interoperability: With a growing ecosystem of protocol plugins—including HTTP, MCP, Text, File, and CLI—UTCP can integrate with almost any existing service or infrastructure.
- Code Execution Mode: Execute TypeScript code with hierarchical ac
fe34c6b32776OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add text --env UTCP_TEST_FAKE_SECRET=${UTCP_TEST_FAKE_SECRET} -- npx -y @utcp/[email protected]{
"mcpServers": {
"text": {
"command": "npx",
"args": [
"-y",
"@utcp/[email protected]"
],
"env": {
"UTCP_TEST_FAKE_SECRET": "${UTCP_TEST_FAKE_SECRET}"
}
}
}
}Exposed tools (16)
13 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
add | write | Adds two numbers |
add_numbers_cli | write | Adds two numbers via CLI. |
cli_tool | read | CLI test tool |
echo | read | |
echo_cli | read | Echoes a message via CLI. |
get_user | read | Gets a user by ID. |
greet | read | Greets a person |
http_tool | read | HTTP test tool |
ping | read | A tool |
read_env | read | Reads a specific environment variable. |
sse_tool | read | An SSE test tool |
stream_tool | read | A streaming test tool |
t | read | |
test.tool | read | A test tool. |
test_tool | read | A simple test tool |
write_file_cli | write | Writes content to a file in the CWD. |
Trust audit
BLOCKgrade F · trust 60/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (4 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
data = yaml.load(content);
responseData = yaml.load(response.data);
return yaml.load(response.data);
data = yaml.load(content);
import { Serializer } from "../../interfaces/serializer";import { Serializer } from '../../interfaces/serializer';import { Serializer } from '../../interfaces/serializer';import { Serializer } from '../../interfaces/serializer';import { ToolPostProcessor } from '../../interfaces/tool_post_processor';describe('HttpCommunicationProtocol redirect exfiltration', () => {{ url: 'http://169.254.169.254/latest/meta-data/', method: 'GET' },res.writeHead(302, { Location: 'http://169.254.169.254/latest/meta-data/' });res.writeHead(302, { Location: 'http://169.254.169.254/latest/meta-data/' });token_url: 'http://169.254.169.254/oauth/token',
makeMaliciousSpec('http://169.254.169.254/token'),'http://127.0.0.1:3000'
manualWith("http://127.0.0.1:9200/secret"),manualWith("http://127.0.0.2:9200/secret"),"http://127.0.0.1:8765/manual",
manualWith("http://127.0.0.1:9200/secret"),@types/js-yaml, bun-types, nock, tsup, zod
@utcp/sdk, bun-types, typescript, @types/bun
dotenv, zod, bun-types, typescript
@utcp/sdk, bun-types, typescript, @types/bun
dotenv, zod, bun-types, typescript
Gates applied: no_behavioural_pass.
fe34c6b32776full audit observations/trust-audit/mcp-server/universal-tool-calling-protocol__typescript-utcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | fe34c6b32776 | BLOCK | F | 60 | first audit |
Questions
What is the @utcp/sdk MCP server?
Official typescript implementation of UTCP. UTCP is an open standard that lets AI agents call any API directly, without extra middleware.
What tools does @utcp/sdk expose?
16 in total: 13 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @utcp/sdk safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (60/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does @utcp/sdk need?
It reads UTCP_TEST_FAKE_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @utcp/sdk run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @utcp/text at 1.1.0.
How current is this page?
The grade is for one exact copy of the source (fe34c6b32776), read on 2026-10-12. The repository is watched and re-audited when it changes.