Server: https://contractors.agentlookups.ai/mcp
Scanned: 2026-10-22 · Tools advertised: 1 · Injection verdict: clear · Directory: ready for the Claude Connector Directory
Free contractor-license checks from official state records; a no-match never proves unlicensed.
Before an agent — or a user — connects it, every tool definition it advertises is read by the model, so a poisoned description or a hidden instruction can steer the agent before any tool runs. This scorecard is an independent, static read of that advertised metadata, run against the Plumbline - Contractor License Checks server on the date above.
The scan is static analysis of the advertised tools/list metadata only — it never invokes a
tool and never sends data anywhere. It is a point-in-time read: an MCP server’s tool definitions can
change at any time (that is the “drift” risk this scorecard exists to make visible), so a clean result
today is not a guarantee for tomorrow.
No account, no key:
curl "https://x402-data-api.sigrunner.workers.dev/scan/mcp/preview?url=https://contractors.agentlookups.ai/mcp&directory=true"
That free response gives you the verdict and the directory blocker count. For the itemized findings — which tools, which OWASP LLM01/LLM08 pattern, and for the directory check which criteria fail and how to fix each — the zero-egress paid report is one call:
curl -s -X POST https://x402-data-api.sigrunner.workers.dev/scan/mcp -H 'content-type: application/json' \
-d '{"directory":true,"url":"https://contractors.agentlookups.ai/mcp"}'
$0.05 USDC via x402 on Base, no account. To keep a server honest as it changes,
continuous drift monitoring with alerts is $9.99/mo — see pricing.
Independent scan by Grey Ridge Signals. Measured on 2026-10-22; re-run the command above for a current result. Questions: contact@greyridgesignals.ai