Oathe Mcp
About
MCP server for https://oathe.ai security audits. Runtime behavioral analysis and security scanner for AI systems. Check trust scores before installing MCP servers, plugins, or AI agent skills.
Details
- Author
- oathe-ai
- Downloads
- 297
- Categories
- Other, Security, AI, Developer Tools, Infrastructure
Jump to
- No API key or configuration needed
- Submit GitHub or ClawHub URLs for audits
- Poll audit status every 5 seconds
- Retrieve full trust reports with findings
- Search completed audits by verdict or score
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Oathe McpCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Oathe Mcp runs with a single command: npx oathe-mcp. No API key or configuration is required. It can be added to Claude Desktop via its configuration file or to Claude Code with claude mcp add. The server exposes five tools: submit_audit, check_audit_status, get_audit_report, get_skill_summary, and search_audits.
submit_audit
Submit a third-party skill for a behavioral security audit before installing it. Accepts any GitHub or ClawHub URL. Returns an audit_id to track progress. Rate limited: one submission per 60 seconds per IP. Returns existing audit_id if URL was already scanned (deduplicated: true). Use check_audit_status to poll for results.
check_audit_status
Check the status of an Oathe security audit submitted via submit_audit. Poll every 5 seconds until status is "complete" or "failed". Statuses: queued, scanning, analyzing, summarizing, finalizing, complete, failed. Terminal statuses: complete, failed. When complete, the response includes the full audit report with trust score, verdict, and findings.
get_audit_report
Get the full behavioral security audit report for a GitHub repository. Use this to review all findings before installing a third-party MCP server, plugin, or tool. Returns the latest completed audit with trust score, verdict, findings, category scores, and recommendation. Use get_skill_summary for a quick safety check instead.
get_skill_summary
Check if a GitHub repository is safe to install as an MCP server or AI agent skill. Returns trust score, verdict, and recommendation from Oathe's behavioral security audit. Use this BEFORE installing any third-party tool — it's the quickest safety check. For the full report with all findings, use get_audit_report instead.
search_audits
Search all completed Oathe behavioral security audits. Find which skills have been audited, filter by verdict or minimum trust score. Returns up to 100 completed audits. Use this to check if a skill has already been audited before submitting a new audit.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"oathe mcp": {
"oathe": {
"command": "npx",
"args": [
"-y",
"oathe-mcp"
]
}
}
}
}McpServers
{
"oathe": {
"command": "npx",
"args": [
"-y",
"oathe-mcp"
]
}
}oathe-mcp
MCP server for Oathe AI security audits. Check trust scores before installing MCP servers, plugins, or AI agent skills.
Quick Start
npx oathe-mcp
No API key required. No configuration needed.
MCP Client Configuration
Claude Desktop
Add to your claude_desktop_config.json:
{
"mcpServers": {
"oathe": {
"command": "npx",
"args": ["-y", "oathe-mcp"]
}
}
}
Claude Code
claude mcp add oathe -- npx -y oathe-mcp
Tools
submit_audit
Submit a GitHub or ClawHub URL for a security audit.
{ "skill_url": "https://github.com/owner/repo" }
Returns audit_id to track progress. Rate limited: one submission per 60 seconds per IP.
check_audit_status
Check the status of a submitted audit.
{ "audit_id": "uuid-from-submit" }
Poll every 5 seconds. Terminal statuses: complete, failed.
get_audit_report
Get the full security audit report for a repository.
{ "owner": "anthropics", "repo": "claude-code" }
Returns trust score, verdict, findings, category scores, and recommendation.
get_skill_summary
Get a lightweight summary (score + verdict) without full findings.
{ "owner": "anthropics", "repo": "claude-code" }
Returns score, verdict, recommendation, and finding counts.
search_audits
Search completed audits by verdict or minimum trust score.
{ "verdict": "SAFE", "min_score": 80, "sort": "trust_score", "order": "DESC" }
Returns up to 100 results.
Configuration
| Environment Variable | Default | Description |
|---------------------|---------|-------------|
| OATHE_API_BASE | https://audit-engine.oathe.ai | Override the API base URL |
Setting an invalid OATHE_API_BASE will produce a clear error at startup.
License
MIT
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
