C-

npm:@collapseindex/ci1t-mcp

https://www.npmjs.com/package/@collapseindex/ci1t-mcp
70/100 · MCP Trust Grade · checked 1mo ago · MCP 1.7.1

Is the npm:@collapseindex/ci1t-mcp MCP server safe to use?

Independent trust grade C- (70/100). References sensitive file paths / environment secrets. wmcp.sh continuously watches npm:@collapseindex/ci1t-mcp for tool drift and rug-pulls. The grade is free and identical whether or not the operator pays.

What it offers — 20 tools · Developer Tools

onboarding

Welcome guide for new users. Returns setup instructions, available tools, pricing, and links. No auth required. Call this when someone is new to CI-1T

evaluate

Evaluate prediction stability. Sends scores to the CI-1T engine and returns per-episode stability metrics. Accepts floats (0.0–1.0) or Q0.16 integers

fleet_evaluate

Evaluate a fleet of model nodes for prediction stability. Each node provides a score stream. Returns per-node episodes and aggregate fleet stats. Acce

probe

Probe an LLM for prediction instability. Sends the same prompt 3 times and compares responses using the specified similarity method. Two modes: (1) De

health

Check CI-1T engine health. Response: { status, version, latency_ms }. Call before evaluate/fleet operations to verify the engine is reachable.

fleet_session_create

Create a new persistent fleet monitoring session. Returns a session ID for subsequent rounds. Max 16 nodes. Response: { session_id, node_count, node_n

fleet_session_round

Submit a scoring round to an existing fleet session. Each node

fleet_session_state

Get the current state of a fleet session without submitting new scores. Response: { session_id, round_count, nodes: [{ node_id, node_name, episodes: [

fleet_session_list

List all active fleet sessions. Response: { sessions: [{ session_id, node_count, round_count, created_at }] }.

fleet_session_delete

Delete a fleet session by ID. Response: { deleted: true, session_id }. Call when monitoring is complete to free server resources.

list_api_keys

List all API keys for the authenticated user. Response: { keys: [{ id, name, masked_key, scope, enabled, created }] }. Use the record id with delete_a

create_api_key

Create a new CI-1T API key. Response: { api_key, masked_key, scope, record }. IMPORTANT: Save the returned api_key — it cannot be retrieved again afte

delete_api_key

Delete an API key by its PocketBase record ID (from list_api_keys). Response: { deleted: true }.

get_invoices

Get billing history (Stripe invoices). Response: { invoices: [{ amount, credits, date, status }], has_more, cursor }. Pass cursor to paginate.

interpret_scores

Analyze raw prediction scores with statistical breakdown — no API call, no auth, no credits. Response: { count, mean, std, min, max, breakdown: [{ ind

convert_scores

Convert between probability floats (0.0–1.0) and Q0.16 fixed-point integers (0–65535) — no API call, no auth, no credits. Response: { direction, count

generate_config

Generate CI-1T integration boilerplate for a specific framework or language — no API call, no auth, no credits. Response: { framework, use_case, api_b

compare_windows

Compare two windows of episodes to detect drift or degradation — no API call, no auth, no credits. Takes baseline and recent episode arrays from evalu

+2 more tools

Spec / packaging20%100
Security (OWASP MCP)30%25
Maintenance / popularity20%75
Tool hygiene15%95
Transparency / provenance15%90

Findings

WARNMCP08 References sensitive file paths / environment secrets.
INFO Static analysis of npm package @collapseindex/ci1t-mcp@1.7.1 (stdio server — no remote endpoint). Reliability/behavioral signals require running it; not measured.
Grade another server

We re-grade npm:@collapseindex/ci1t-mcp on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.

Share this report card

A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.

MCP Trust report card — npm:@collapseindex/ci1t-mcp grade C-
Share on X Open card image

Embed this grade

A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.

MCP Trust Grade C- · wmcp.sh
[![MCP Trust Grade C-](https://wmcp.sh/mcp/grade/npm%3A%40collapseindex%2Fci1t-mcp/badge.svg)](https://wmcp.sh/mcp/grade/npm%3A%40collapseindex%2Fci1t-mcp)
<a href="https://wmcp.sh/mcp/grade/npm%3A%40collapseindex%2Fci1t-mcp"><img src="https://wmcp.sh/mcp/grade/npm%3A%40collapseindex%2Fci1t-mcp/badge.svg" alt="MCP Trust Grade C- · wmcp.sh"></a>

Agents: check this before connecting

Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:

https://wmcp.sh/mcp/trust
How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.