C

npm:@yawlabs/caddy-mcp

https://www.npmjs.com/package/@yawlabs/caddy-mcp
75/100 · MCP Trust Grade · checked 2h ago · MCP 1.2.9

What it offers — 18 tools · Maps & Geo

caddy_status

Check Caddy connectivity and get a config summary: servers, routes, listen addresses, and TLS status.

caddy_list_servers

List all configured HTTP servers with their names, listen addresses, route counts, and TLS status. Use this to discover server names before calling ro

caddy_upstreams

Get the current health status of all reverse proxy upstreams. Shows address, active requests, and failure counts.

caddy_pki

Get PKI certificate authority info or the CA certificate chain.

caddy_metrics

Get Prometheus metrics from Caddy. Shows request counts, durations, TLS handshake stats, active connections, and more. Output can be megabytes on busy

caddy_stop

Gracefully shut down the Caddy server. Requires confirm=true to prevent accidental shutdown.

caddy_adapt

Convert a config in any registered adapter format to Caddy JSON without loading it. Useful for previewing what a Caddyfile produces, or for porting fr

caddy_config_get

Read Caddy config at any JSON path. Returns the full config when path is empty, or a subtree at a specific path (e.g.,

caddy_config_set

Write config at a JSON path. Mode

caddy_config_delete

Delete config at a JSON path. Removes the config node at the specified path.

caddy_load

Replace the entire Caddy configuration atomically. Accepts a JSON config object, or a Caddyfile string with format=

caddy_revert

Manage config snapshots for rollback. Snapshots are auto-captured before caddy_load and kept in-memory (last 10). Actions:

caddy_config_by_id

Access config by @id tag. Any config object with an

caddy_reverse_proxy

Add a reverse proxy route. The most common operation \u2014 just specify where traffic comes from and where it goes. Example: from=

caddy_add_route

Add a route with full control over match conditions and handlers. Supports any Caddy handler (reverse_proxy, file_server, static_response, redirect, e

caddy_list_routes

List all routes on a Caddy HTTP server with a human-readable summary of matchers and handlers.

caddy_remove_route

Remove a route. Target by @id (preferred \u2014 stable across reorderings) or by array index on a specific server. Index-based removal is a two-step r

caddy_tls

Get or configure TLS/HTTPS settings. Actions:

Spec / packaging20%100
Security (OWASP MCP)30%25
Maintenance / popularity20%100
Tool hygiene15%95
Transparency / provenance15%90

Findings

WARNMCP08 References sensitive file paths / environment secrets.
INFO Static analysis of npm package @yawlabs/caddy-mcp@1.2.9 (stdio server — no remote endpoint). Reliability/behavioral signals require running it; not measured.
Grade another server

We re-grade npm:@yawlabs/caddy-mcp on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.

Share this report card

A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.

MCP Trust report card — npm:@yawlabs/caddy-mcp grade C
Share on X Open card image

Embed this grade

A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.

MCP Trust Grade C · wmcp.sh
[![MCP Trust Grade C](https://wmcp.sh/mcp/grade/npm%3A%40yawlabs%2Fcaddy-mcp/badge.svg)](https://wmcp.sh/mcp/grade/npm%3A%40yawlabs%2Fcaddy-mcp)
<a href="https://wmcp.sh/mcp/grade/npm%3A%40yawlabs%2Fcaddy-mcp"><img src="https://wmcp.sh/mcp/grade/npm%3A%40yawlabs%2Fcaddy-mcp/badge.svg" alt="MCP Trust Grade C · wmcp.sh"></a>

Agents: check this before connecting

Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:

https://wmcp.sh/mcp/trust
How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.