MCP Reference Time

Grade history

14 scans on record between 2026-06-20 and 2026-07-04. The grade has not changed across them.

History as recorded by this registry's own scans. The cause is an attribution from the inputs the registry records — the scanner engine identity and the declared tool surface — not proof of what changed on the server. Generated 2026-08-02.

How to read this grade

• What was scanned: mcp-server-time, as distributed.
• When: 2026-07-04 08:18:12.
• By what: mcpaudit 2.4.0, applied to the published danger rubric (weights, bands, and the critical cap are all public).
• What the grade means: this registry's opinion, computed by the disclosed automated methodology against the artifact version above, on the scan date above. It measures conformance to the rubric at scan time.
• What it does not claim: it is not a statement that the product is malicious, insecure in your deployment, or unfit for use, and it is not an endorsement or certification.
• Disagree? Grades are re-checkable against the same package version, and corrections are welcome: open a dispute — see the dispute & correction policy.

Spec-shift exposure

BREAKS against MCP 2026-07-28-rc · confidence high · ruled 2026-07-18

What to change

• D1 [trivial] Pass stateless=True to server.run() at src/mcp_server_time/server.py:220. The server is genuinely stateless already - both tools are pure functions of their arguments plus the host clock, and the only closure state is the local timezone string resolved once at startup - so the argument records a property the code already has.

This is a point-in-time ruling against a release candidate, not the published specification, and it is independent of the danger grade above. Neither figure constrains the other.

Provenance & dispute

• Listing basis: operator-listed from a public catalog. This entry was not submitted by its vendor.
• Scan target: the published pypi artifact mcp-server-time, installed and scanned locally using sandbox image mcp-trust-scan:corpus-2026-07-03. The public record stores the sandbox image, but not the network mode, so this page does not claim network isolation for that run.
• Credentials: none declared, none used.
• Dispute: vendor or maintainer of this server? Dispute this grade — first response within 14 days.

Findings

Score breakdown