MINIMALCULT

org.minimalcultPublished by minimalcult.orgOfficial publisherv1.0.0Updated Nov 5, 2026

Check MCP servers and packages against an independent, anchored record before you trust them.

VerifiedStreamable HTTPWeb executableCloud & InfrastructureDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Checks MCP servers, npm/PyPI packages and TON addresses against an independent, Bitcoin-anchored record of versions, hashes and tool descriptions.

What you can do
  • Check an MCP server, npm or PyPI package, endpoint URL or TON address against the anchored record and get a signed status with flags and facts
  • Search records of MCP servers and packages by name or keywords, and fetch a single record by rec_ id or source id
  • Read a record's recorded facts newest first, including versions, registry entries, package artifacts and tool descriptions, with proof and diff links
  • Subscribe a webhook to record changes such as new versions, changed tool descriptions or removal, with HMAC-signed notifications
When to use it
Use it before installing or calling an unfamiliar MCP server or package, to see how long it has been known, what changed recently and whether recorded hashes match. Also useful for watching a dependency for version or tool-description changes over time.
Requirements
A remote streamable HTTP endpoint; no package, account, API key or environment variable is declared. Webhook monitoring needs a reachable webhook URL.
Before you install
Results are signed facts, not a judgement of intent, so a clean status does not prove a server is safe. Creating a monitor returns a secret shown only once (used for the MINIMALCULT-Signature header) and must be stored safely; only three monitors per address are free. Check requests send the server, package or address you query to a third party.

Installation

In SourceWeft

  1. Open MINIMALCULT in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/org.minimalcult%2Fminimalcult/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "minimalcult": {
      "type": "http",
      "url": "https://ai.minimalcult.org/mcp"
    }
  }
}

Tools

5

check

Check before you trust

Check an MCP server, an npm or PyPI package (optionally with the hash you are about to install), an MCP endpoint URL or a TON address against the anchored record. Returns a signed check: status (witnessed, changed_recently, hash_mismatch, not_witnessed, sanctions_listed, not_listed), flags, facts, recent changes with diff links.

Parameterstyperequiredas_ofsha256targetrequiredversionintegrity

monitor_create

Watch a record

Subscribe a webhook to changes of a record (new version, tool description changed, removed). Returns the monitor id and a secret shown once (HMAC-SHA256 signatures, header MINIMALCULT-Signature). 3 monitors per address are free.

Parametersurlrequiredrecordrequired

record_get

Get a record

One record by rec_ id or source id (mcp:<registry name>, npm:<name>, pypi:<name>) with its latest recorded fact.

Parametersidrequired

record_versions

List recorded facts

The recorded facts (versions, registry entries, package artifacts, tool descriptions) of a record, newest first, with proof and diff links.

Parametersidrequiredlimit

Version history

1
  1. v1.0.0LatestNov 5, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.