Is the pypi:scicomp-math-mcp MCP server safe to use?
Independent trust grade B- (81/100). Static analysis of PyPI package scicomp-math-mcp@0.1.6 (source: github.com/andylbrummer/math-mcp) — stdio server, no remote endpoint. Runtime behavior not measured. wmcp.sh continuously watches pypi:scicomp-math-mcp for tool drift and rug-pulls. The grade is free and identical whether or not the operator pays.
What it offers — 30 tools · Finance & Crypto
info
create_lattice_potential
create_custom_potential
create_gaussian_wavepacket
create_plane_wave
solve_schrodinger
solve_schrodinger_2d
get_task_status
get_simulation_result
analyze_wavefunction
render_video
visualize_potential
define_model
load_dataset
train_model
evaluate_model
get_experiment_status
get_model_summary
+12 more tools
Spec / packaging20%100
✓ depends on an MCP SDK (mcp/fastmcp)
✓ 30 tool(s) detected in source
Security (OWASP MCP)30%65
uses eval/exec/subprocess/pickle (review for unsanitized input)
scanned 6 source files from GitHub
Maintenance / popularity20%83
last release ~5mo ago
7 releases
Tool hygiene15%80
8 declared deps
public repo
Transparency / provenance15%85
✓ repo: github.com/andylbrummer/math-mcp
✓ MIT License license
Findings
INFO Static analysis of PyPI package scicomp-math-mcp@0.1.6 (source: github.com/andylbrummer/math-mcp) — stdio server, no remote endpoint. Runtime behavior not measured.
We re-grade pypi:scicomp-math-mcp on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.
Share this report card
A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.
A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.
Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:
https://wmcp.sh/mcp/trust
How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.