What are the risks of connecting to api.commodities.sh?

No blocking issues were found in the static + spec checks. Overall trust grade A- (92/100).

When was api.commodities.sh last audited?

Last checked 2026-10-26; wmcp.sh re-checks it on a schedule for tool drift and rug-pulls.

A-

api.commodities.sh

Item: api.commodities.sh
Rating: 92
Author: wmcp.sh

https://api.commodities.sh/api/mcp

92/100 · MCP Trust Grade · checked 3d ago · MCP 2024-11-05

Is the api.commodities.sh MCP server safe to use?

Independent trust grade A- (92/100). No blocking issues found in the static + spec checks. wmcp.sh continuously watches api.commodities.sh for tool drift and rug-pulls. The grade is free and identical whether or not the operator pays.

✓ Watched since 2026-09-17 — behavioral baseline locked, no drift for 39 days. We re-check this server's tool surface on a schedule; if it adds, removes, or silently rewrites a tool (rug-pull), we record it.

What it offers — 11 tools · Developer Tools

catalog.list

List every commodity instrument in the catalog with sector, unit, primary source, and freshness metadata. Call this first to discover valid codes befo

price.latest

Return the latest cash/fundies observation for one instrument code. Use catalog.list to discover codes such as CL, GC, or ZC. Response follows the sha

inventory.get

Fetch EIA weekly petroleum inventory levels. Omit series to list all latest inventory points, or pass a series key to get week-over-week change, vs-5y

positioning.get

Return the latest CFTC Commitments of Traders managed-money positioning for an instrument code. Includes long, short, net, and week-over-week net chan

spread.get

Compute a derived spread observation: 3-2-1 crack, soybean crush, WTI-Brent basis, or calendar (calendar requires licensed curve data and may return a

price.history

Return historical observations for an instrument code (up to 500 points). Use after price.latest when you need a short time series for the same code.

fx.latest

Return the latest FX rate observation for a pair or FRED FX series. Useful alongside commodity prices when converting cash values across currencies.

fundamentals.get

Fetch a fundamentals document: USDA WASDE, crop progress, export sales, or USGS mineral summaries. Choose kind based on the ags/metals question you ar

snapshot.get

Build a sector snapshot bundling prices, inventories, spreads, and related fundies for energy, metals, ags, or all sectors. Prefer this over calling m

calendar.get

List EIA, USDA, and CFTC release calendar entries with cadence, typical Eastern time, and next-hint notes. Free discovery tool — call before schedulin

decision.get

Build a deterministic decision pack for energy, metals, ags, or all sectors. Returns method, signals with direction/rationale, an embedded snapshot, a

Spec conformance20%100

✓ initialize → protocolVersion 2024-11-05
✓ initialize HTTP 200
✓ unknown method → -32601
✓ tools/list → 11 tools
✓ every tool has name + inputSchema

Security (OWASP MCP)30%100

11 tools scanned
no injection markup
no secret-path refs

Reliability / performance20%92

single-probe latency 184ms (PRELIMINARY — continuous uptime/p95 from proxy telemetry lands in v2)

Tool hygiene15%89

82% of tools have typed inputSchema
11/11 declare outputSchema
no unannotated destructive tools

Transparency / provenance15%70

HTTPS ✓
advertises protocol 2024-11-05

Observed behavior

No proxied traffic observed for this host yet. Connect it at /connect and its grade gains a measured Reliability score + per-tool behavioral evidence — the half a static scan can't produce.

Findings

No blocking issues found in the static + spec checks.

Grade another server

We re-grade api.commodities.sh on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.

Run api.commodities.sh? Claim it (free) to get drift alerts and show an independently-verified trust badge. The grade stays free — claiming just ties it to you.

Share this report card

A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.

MCP Trust report card — api.commodities.sh grade A-

Share on X Open card image

https://wmcp.sh/mcp/grade/api.commodities.sh

Embed this grade

A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.

Markdown (for your README)

[![MCP Trust Grade A-](https://wmcp.sh/mcp/grade/api.commodities.sh/badge.svg)](https://wmcp.sh/mcp/grade/api.commodities.sh)

HTML

<a href="https://wmcp.sh/mcp/grade/api.commodities.sh"><img src="https://wmcp.sh/mcp/grade/api.commodities.sh/badge.svg" alt="MCP Trust Grade A- · wmcp.sh"></a>

Agents: check this before connecting

Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:

https://wmcp.sh/mcp/trust

How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.