Entropy0dev

io.github.entropy0devPublished by GitHub account entropy0devv0.1.3Updated Nov 10, 2026

Entropy0 MCP server — source trust and URL safety tools for AI agents

VerifiedSTDIODesktop onlyWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

Lets an assistant check a URL or domain for trust and threat signals and get a recommended action before navigating, fetching, or submitting credentials.

What you can do
Entropy0 provides source trust and URL safety checks for AI agents. The check_url tool evaluates a full URL for a given interaction such as navigate, and check_domain evaluates a bare domain name. Responses include trust, threat, and deviation scores with confidence, reason codes, an identity assessment, and a recommended action of proceed, proceed_with_caution, sandbox, or deny.
When to use it
Use it when an agent is about to open an unfamiliar link, fetch content from a site, or enter credentials somewhere, and you want a safety verdict first. It suits browsing and automation workflows where untrusted URLs are common.
Requirements
Runs as a local process via npx, so Node.js 18 or newer is needed. An Entropy0 API key is required, supplied through the ENTROPY0_API_KEY environment variable. Network access is needed to reach the Entropy0 service.
Before you install
The required ENTROPY0_API_KEY is a secret and should be kept out of shared configs and logs. Each check sends the URL or domain being evaluated to Entropy0, a third party, so sensitive or internal addresses may be disclosed. The verdict is advisory; a proceed result is not a guarantee of safety.

Installation

In SourceWeft

  1. Open Entropy0dev in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@entropy0/mcp

MCP server for Entropy0 — source trust and URL safety tools for AI agents.

Before your agent navigates a URL, fetches content, or submits credentials, Entropy0 tells it whether the domain is safe. Returns a recommended action (proceed, proceed_with_caution, sandbox, or deny) based on trust, threat, and structural anomaly signals.

Install

bash
npx -y @entropy0/mcp

Or add to your MCP client config:

json
{  "mcpServers": {    "entropy0": {      "command": "npx",      "args": ["-y", "@entropy0/mcp"],      "env": {        "ENTROPY0_API_KEY": "sk_ent0_your_key_here"      }    }  }}

Get an API key at entropy0.ai.

Tools

check_url

Evaluate whether a URL is safe to interact with.

check_url({ url: "https://example.com", interaction: "navigate" })

Returns trust score, threat score, recommended action, and reason codes.

check_domain

Evaluate a bare domain name.

check_domain({ domain: "example.com" })

Response

json
{  "recommended_action": "proceed",  "scores": {    "trust":     { "score": 88, "confidence": 0.91 },    "threat":    { "score": 4,  "confidence": 0.87 },    "deviation": { "score": 11, "confidence": 0.84 }  },  "decision": {    "reason_codes": ["STRONG_TRUST_HISTORY", "LOW_THREAT_SIGNALS"]  },  "identity_assessment": {    "claimed_entity": "stripe.com",    "posture": "strongly_supported_entity_domain",    "confidence": "high",    "analyst_note": "Multiple independent structural signals support a stripe.com relationship."  }}

Requirements

  • Node.js 18+
  • An Entropy0 API key (sk_ent0_...)

Links

Source: packages/mcp/README.md at commit 47669d3

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.3LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.