B

api.supero.dev

https://api.supero.dev/mcp/v1/messages
86/100 · MCP Trust Grade · checked 3d ago · MCP 2025-03-26

Is the api.supero.dev MCP server safe to use?

Independent trust grade B (86/100). No blocking issues found in the static + spec checks. wmcp.sh continuously watches api.supero.dev for tool drift and rug-pulls. The grade is free and identical whether or not the operator pays.

⚠ Rug-pull watch: this server's tool surface has changed 1× since baseline — last 3d ago. Continuously watched by wmcp.sh for drift & rug-pulls.

What it offers — 65 tools · Developer Tools

build_get_skills

Fetch a Supero build reference. doc='skills' (default, the spec you MUST follow) | 'components' (the real pre-built SDK component/global catalog — rea

build_get_examples

Fetch a COMPLETE, production-quality reference app (schemas.py + config.py + setup.py + ui/app.js) to copy patterns from — the single biggest lever fo

build_plan

PLAN FIRST — turn a one-line app idea into an explicit BUILD CHECKLIST before you author anything, so a thin prompt doesn't silently skip what expert

build_get_service_contract

Fetch the AUTHORITATIVE contract for a transactional/stateful platform service (cart, order, payment, booking, appointment, membership, approval, docu

build_whoami

Resolve your API key's scope: role (domain_admin/project_admin), domain, whether you can create projects, and your plan. Call this to decide the flow.

build_list_projects

List projects you can build into (uuid, name, schema_namespace, live_url).

build_get_project

Get one project's details: schema_namespace (use this EXACT value as the `namespace` literal on every schema dict), last published version, AND the ca

build_create_project

Create a NEW project (domain-admin keys only; plan-gated). Mints the project's schema_namespace + an API key (returned ONCE). Use for a fresh app.

build_update_project

Update a project's metadata (display_name, description, show_public, live_url).

build_set_project_mode

Set a project's build mode. 'dev' (default) allows COMPLETE REPLACE (wipe data, keep credentials); 'live' protects it. Switch to dev before replacing,

build_replace_project

DESTRUCTIVE (DOMAIN-admin keys only): completely replace a DEV-mode project's app — wipes its data (retains credentials, API keys, namespace, tenant).

build_validate

Validate a locally-authored bundle against the live platform BEFORE publishing. AST-only (your code is never executed). Checks manifest, syntax, impor

build_publish

Package + upload your authored bundle and record a version under the project. Returns version_uuid + file_id + download_url. Runs build_validate first

build_stage_bundle

PUB-1a: get the out-of-band UPLOAD endpoint for a LARGE app bundle that won't fit inline (the model's max OUTPUT tokens cap `files`/`files_b64gz`, so

build_get_bundle

Fetch the CURRENT (or a given) PUBLISHED bundle: the file list + a signed download_url, or ONE file's content inline via file=. For ANY change request

build_deploy

Deploy a published version. target='cloud_ephemeral' (managed Cloud Run, ~30m throwaway preview; requires platform enablement; the default when cloud

build_deploy_status

Poll a cloud deploy started by build_deploy or build_go_live. Pass the poll_url it returned. Reports elapsed_s since launch. 'launching' for 5-6.5 min

build_logs

Fetch recent Cloud Run logs for a project's deployed app — THE tool for diagnosing a failed/stalled cloud deploy or a crashing app (startup-probe time

+47 more tools

Spec conformance20%80
Security (OWASP MCP)30%100
Reliability / performance20%92
Tool hygiene15%73
Transparency / provenance15%70

Observed behavior

No proxied traffic observed for this host yet. Connect it at /connect and its grade gains a measured Reliability score + per-tool behavioral evidence — the half a static scan can't produce.

Findings

No blocking issues found in the static + spec checks.
Grade another server

We re-grade api.supero.dev on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.

Run api.supero.dev? Claim it (free) to get drift alerts and show an independently-verified trust badge. The grade stays free — claiming just ties it to you.

Share this report card

A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.

MCP Trust report card — api.supero.dev grade B
Share on X Open card image

Embed this grade

A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.

MCP Trust Grade B · wmcp.sh
[![MCP Trust Grade B](https://wmcp.sh/mcp/grade/api.supero.dev/badge.svg)](https://wmcp.sh/mcp/grade/api.supero.dev)
<a href="https://wmcp.sh/mcp/grade/api.supero.dev"><img src="https://wmcp.sh/mcp/grade/api.supero.dev/badge.svg" alt="MCP Trust Grade B · wmcp.sh"></a>

Agents: check this before connecting

Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:

https://wmcp.sh/mcp/trust
How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.