Turva Mcp

dev.turvaPublished by turva.devOfficial publisherv1.0.0Updated Oct 24, 2026

Read-only MCP server for turva.dev, an agent-readiness audit and advisory service.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Read-only MCP server exposing turva.dev's service catalog, agent-readiness scores, security scan results, principles and contact details.

What you can do
Retrieve the service catalog, engagement model and fixed list prices for the Shopify agent storefront check, audit, advisory and implementation offerings, plus agent operations and MCP server design services (get_services). Read turva.dev's own agent-readiness score from an independent public scanner, with category sub-scores and measurement date (get_agent_readiness). Read the latest public web-security scan results for turva.dev's domain from Hardenize and Internet.nl, each with scan dates (get_security_evidence). Read the engagement principles: async-only, least access, results visible in scanner numbers, open and verifiable (get_principles). Look up who runs turva.dev and the official, v
When to use it
Useful when a user asks what turva.dev sells and at what price, how its own agent-readiness and security posture score, what rules an engagement follows, or who is behind it and how to get in touch. It is a read-only information source about one provider, not a general audit tool.
Requirements
A remote streamable HTTP endpoint at mcp.turva.dev; no package, environment variables or headers are declared. Network access to the endpoint is needed.
Before you install
All tools are read-only lookups of turva.dev's own published information; nothing is written, sent or changed. The content is promotional material from the provider itself, including prices and self-reported scanner results, so treat it as vendor claims rather than independent assessment.

Installation

In SourceWeft

  1. Open Turva Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.turva%2Fturva-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "turva": {
      "type": "http",
      "url": "https://mcp.turva.dev/mcp"
    }
  }
}

Tools

5

get_services

Service catalog and pricing

Returns turva.dev's service catalog: the Shopify agent storefront check, agent-readiness audit, advisory, implementation, agent operations, and MCP server design, plus the engagement model and pricing (fixed list prices for the Shopify agent storefront check, audit, advisory and implementation; agent operations and MCP server design on request), and two implementation add-ons that carry a fixed price and are sold only with the diagnosis they follow, bought with it, with its report, or after the report and before implementation starts. Use this when a user asks what turva.dev offers, what it costs, or how an engagement works. For how to reach turva.dev use get_contact instead, and for the rules an engagement follows use get_principles. Read-only: returns static JSON that is compiled into the Worker, so it changes nothing and updates only on deploy.

Takes no parameters.

get_agent_readiness

Agent-readiness score

Returns turva.dev's own agent-readiness score from an independent public scanner (isitagentready.com), including category sub-scores, with the measurement date and a link to the scanner's start page, where a new check can be run (the link does not open the recorded reading). Use this when a user asks how turva.dev scores, whether its claims are verifiable, or what proof backs the audit service. For web-security scan results, which are a separate measurement, use get_security_evidence instead. Read-only: returns static JSON that is compiled into the Worker, so it changes nothing and updates only on deploy.

Takes no parameters.

get_security_evidence

Web-security scan evidence

Returns the latest public web-security scan results for turva.dev's own domain (Hardenize, Internet.nl site and mail), each with its scan date. Use this when a user asks about turva.dev's own security posture or wants evidence beyond agent-readiness scores. For the agent-readiness score itself, which is a separate measurement, use get_agent_readiness instead. Read-only: returns static JSON that is compiled into the Worker, so it changes nothing and updates only on deploy.

Takes no parameters.

get_principles

Engagement principles

Returns turva.dev's engagement principles: async-only, least access, the result shows up in scanner numbers, and open and verifiable. Use this when a user asks how turva.dev works with clients or what rules an engagement follows. For what is sold and what it costs use get_services instead, and for how to start use get_contact. Read-only: returns static JSON that is compiled into the Worker, so it changes nothing and updates only on deploy.

Takes no parameters.

get_contact

Contact and operator details

Returns who runs turva.dev and the official ways to reach it: the operator and business details, the email address, the Signal link, the LinkedIn profile, the correspondence languages, the first-reply time and the access an audit needs. Use this when a user asks who is behind turva.dev, how to contact it, how to start an audit or what access has to be granted. For what is sold and what it costs use get_services instead. Read-only: returns static JSON that is compiled into the Worker, so it changes nothing and updates only on deploy.

Takes no parameters.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.