com.allthepossiblesPublished by allthepossibles.comOfficial publisherv1.1.0Updated Oct 30, 2026
Scans an MCP server for security gaps before your agent connects. Free tier, no signup.
The publisher's own server: Design Check
Remote MCP server that lets an assistant pre-screen MCP servers, VS Code extensions, Claude Skills, documents and its own outputs for risk signals before…
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/com.allthepossibles%2Fpreflight/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"preflight": {
"type": "http",
"url": "https://preflight.allthepossibles.com/mcp"
}
}
}Scan MCP server
Check an MCP server for real risk signals before trusting it: unauthenticated transport, capability overreach (filesystem/shell/credential access with no scoping), and known-bad signatures. Pass a live server URL, or a manifest of tool definitions if the server isn't reachable over HTTP. Semantic prompt-injection detection runs too if a Pro API key is sent as an Authorization: Bearer header, see /docs.
urltoolsserverNameScan content
Check a document or web page for hidden instructions before an agent reads, summarizes, or acts on it: invisible Unicode, obfuscated payloads, and (on Pro) a semantic pass for prompt-injection phrasing aimed at the model instead of the human reader. Pass either a URL to fetch, or raw text you already have.
urlcontentScan extension
Check a VS Code extension or a Claude Skill before installing or trusting it. For a VS Code extension (which runs with full Node.js access and no permission model to scope): publisher domain-verification status weighed against install count, and known-bad-signature checks on its description. For a Claude Skill: hidden-instruction and obfuscated-payload detection on the SKILL.md body (the same engine scan_content uses), unscoped or credential-referencing tool grants in its allowed-tools/disallowed-tools frontmatter, inline shell execution baked into the file itself, and pattern matching on any bundled script files for credential-exfiltration signatures. Semantic prompt-injection detection on a skill's body runs too on Pro.
skillContentmarketplaceIdscriptContentsCheck output
Check a structured output you're about to return or act on for degenerate-answer patterns a schema check can't see: invalid JSON, a placeholder value ('TBD', 'N/A', 'unknown') where a real answer should be, an array of byte-identical items (a common symptom of a loop that never advanced), or an expected field that's missing or empty. Schema validity and answer quality are different guarantees, call this before trusting your own output, not just after validating it parses.
outputrequiredexpectedFields72% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Publish an icon in the registry entry.
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.
com.allthepossiblesOfficial publisher
Design Check's hosted MCP server, published by allthepossibles.com; no sign-in required; Streamable HTTP; 3 tools.
com.allthepossiblesOfficial publisher
Design-review MCP server that gives an assistant contrast, accessibility, typography and UX-copy checks plus critique methods for design work.
com.allthepossiblesOfficial publisher
Remote MCP server that gives an assistant six design-review tools: adversarial critique, state matrices, user journeys, UI copy audits, PRD assumptions and…
com.allthepossiblesOfficial publisher
Remote MCP server with small deterministic checks for agent builders: AI-writing tells, MCP tool-list token cost, CLAUDE.md lint, headers, sitemaps and more.
com.allthepossiblesOfficial publisher
Pulse checks a page's real Core Web Vitals (LCP, INP, CLS) from Chrome UX Report field data plus a live Lighthouse lab run.