Sighttrue

Last 30 days

Uptime

100%

Response time

255 ms typical, 255 ms slowest 5%

Last check

2 h ago

Next check

in 4 h

How to call it

Add it to any MCP client that supports remote servers.

{
  "mcpServers": {
    "sighttrue": {
      "type": "http",
      "url": "https://sighttrue.com/api/mcp"
    }
  }
}

31 tools

• check_before_install

  Call this before adding a dependency. Returns only the facts a reviewer would be annoyed to discover afterwards: whether the publisher has withdrawn the package, whether it runs scripts on the installing machine, whether its repository is archived, how many advisories are on reco

• check_package

  Read the current standing of one open-source package: downloads with the window they cover, OpenSSF scorecard, advisory count, licence, whether the repository is archived, and when it was last pushed to.

• check_stack

  Read a whole dependency list at once and report what is archived, what carries advisories, what has a source-available licence, and what has not been pushed to in a year. Use when reviewing a package.json, requirements.txt, Cargo.toml, composer.json or Gemfile.

• search_repositories

  Find watched repositories whose name contains a string, with their current readings. Use it to discover what is covered before calling the other tools.

• compare_repositories

  Hold two watched repositories against each other across downloads, OpenSSF scorecard, advisories, forks, stars and findings on record. Compares only; it does not pick a winner.

• find_model

  Find language models by price and context window, from a catalogue read daily across sixty providers. Use this before choosing a model: prices move without announcement and training data is out of date on the day it ships.

• check_eol

  Check whether a runtime, database or framework release is still receiving security fixes, and what to move to. Covers about two dozen products read daily from endoflife.date.

• check_provider

  Recorded incidents for a hosting or API provider over a window, kept after the provider’s own status page dropped them.

• list_readings

  List every reading this server can return, what each one measures, and which require a key. Call this first if unsure which tool answers a question.

• who_can_publish

  How many accounts hold publish rights on a package, as the registry lists them. Answers who can put code on your machine, which is a different question from who writes it. Requires a key; see https://sighttrue.com/pricing.

• package_weight_history

  How the published artefact size has moved over time. Returns the readings taken, not a verdict. Requires a key; see https://sighttrue.com/pricing.

• withdrawn_but_installed

  Packages whose own publisher has withdrawn them and which are still being installed heavily, with the download figure and the publisher’s notice. Requires a key; see https://sighttrue.com/pricing.

• typosquat_check

  Whether a name is one edit away from a more widely installed package. States that both names exist; which one was meant is the caller’s call. Requires a key; see https://sighttrue.com/pricing.

• funding_gap

  Packages that ask for funding, beside how heavily they are installed and how many people write them. Requires a key; see https://sighttrue.com/pricing.

• time_to_fix

  Days between an advisory being published and a release appearing that postdates it, per package and as a distribution. Requires a key; see https://sighttrue.com/pricing.

• advisory_severity

  Advisories broken down by severity rather than counted, with identifiers and dates. Requires a key; see https://sighttrue.com/pricing.

• runtime_deadlines

  Support end dates for the runtimes a dependency set requires, including any already past. Requires a key; see https://sighttrue.com/pricing.

• base_image_check

  For a container base image: its size, when it was last rebuilt, and whether the OS underneath it is still supported. Requires a key; see https://sighttrue.com/pricing.

• registry_health

  Recorded outages of the package registries themselves, kept after their status pages drop them. Requires a key; see https://sighttrue.com/pricing.

• provider_incidents

  A provider’s recorded incidents, grouped by the component that failed, over the whole archive rather than the window its status page shows. Requires a key; see https://sighttrue.com/pricing.

• provider_transparency

  How long a provider takes to acknowledge an incident: the interval between an incident starting and its first public update. Requires a key; see https://sighttrue.com/pricing.

• provider_terms_changed

  When a provider last changed its terms or pricing page, from a stored fingerprint of the page. Requires a key; see https://sighttrue.com/pricing.

• model_price_history

  Every recorded price for a model, with the date each was read. Requires a key; see https://sighttrue.com/pricing.

• model_withdrawn

  Models that were in the catalogue and no longer are, with the date last seen. Requires a key; see https://sighttrue.com/pricing.

• help_availability

  For a technology tag: questions asked against questions answered, over time. Requires a key; see https://sighttrue.com/pricing.

• audit_manifest

  Read a whole manifest and return every reading on record for it, ordered by how much a reviewer would want to know. One call instead of one per dependency. Requires a key; see https://sighttrue.com/pricing.

• diff_since

  What changed for a set of packages since a given date, read from the daily archive. Requires a key; see https://sighttrue.com/pricing.

• watch_add

  Add a package to the caller’s own private watchlist, so later readings are about their stack rather than the public one. The list is private to the key that created it. Requires a key; see https://sighttrue.com/pricing.

• watch_changes

  Everything that has changed across the caller’s private watchlist since a given date: withdrawals, licence changes, advisories, archived repositories and runtimes going out of support. Requires a key; see https://sighttrue.com/pricing.

• explain_finding

  Given a finding id, return what was measured, when, by whom, and the address it can be checked at. For an agent quoting a figure into a review. Requires a key; see https://sighttrue.com/pricing.

• domain_risk

  Whether the domains a package points at — homepage, funding, documentation — still resolve to a registered owner. Requires a key; see https://sighttrue.com/pricing.

Security scan

• No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks