Magery Forge is a security-audit engine for people who ship code fast and don't have a security team. It checks your website and turns raw scanner output into plain-English risks with concrete fixes — then delivers a weekly report to your inbox. Built for VibeCoders, indie hackers, and solo founders: you add a domain, Forge checks it, and you learn what's wrong in language you actually understand. No "Missing Strict-Transport-Security header" — instead, "Your site allows unencrypted connections; here's how to fix it." This MCP server exposes the same engine to your AI agent. Your agent in Cursor, Copilot, Claude, or OpenClaw can trigger scans and read reports without opening the UI — one engine, two ways in. What Forge checks: • Passive checks (run instantly): DNS, SSL/TLS, HTTP headers, SEO, AEO, Open Graph / social markup. • Active checks (unlock after domain verification): crawling, forms/CSRF, secret-leak scanning, outdated components. Every finding ships as a plain-English risk plus a concrete mitigation step — never just a red flag. Checks are non-destructive: Forge scans, it doesn't attack. How it works: 1. Add a domain and verify ownership (email or TXT). 2. Run passive checks instantly. 3. Unlock active checks by verifying the domain. 4. Read human-readable risks with fixes, or let your agent do it over MCP. 5. Get a weekly automatic report by email. Why it's cost-efficient: Forge runs on a purpose-built harness that optimizes token spend and needs no heavy dedicated server, so it stays far cheaper than asking a general-purpose agent to audit a site from scratch. Use cases: • Pre-release security check • Weekly automated security monitoring • Agent-driven security scanning (MCP) • Clearing a shipped product of common vulnerabilities before users hit them Endpoint: https://forge.magery.ai/mcp Free while in beta — Pro plan launches later. Feedback from fast-shipping builders is welcome.

MCP readiness

B · 86/100

Readiness is how fully this listing follows its protocol and how it behaved in our probes over 30 days. It is shown for reference and does not move it in search. Search order and leaderboards use the separate quality grade (here B, 83.3/100), which weighs availability, conformance, p95 speed and descriptor. How the two differ

Valid MCP handshake	10/10	initialize and tools/list both answered.
Live MCP endpoint	25/25	Endpoint answers the MCP initialize handshake (872 ms).
Protocol revision	8/10	Speaks MCP 2025-11-25, 1 revision(s) behind 2026-07-28.
Signed descriptor	n/a	No MCP standard defines a signed server descriptor.
Uptime (30 days)	15/15	22/22 probes succeeded over 30 days (100%).
Tool declaration	10/10	Lists 6 tool(s) with descriptions.
Verified identity	5/10	Publisher declared (repository, package or homepage); claim this listing to verify domain control.
Freshness + modern flags	4/5	seen in a source within 7 days.
Auth declaration	0/5	How to authenticate is not stated.

Applicable criteria total 90 points, scaled to 100.

Responsiveness: Responsive (872 ms; bands ≤2.5 s, ≤5 s, ≤8 s, slower; penalty only).

Measured 2026-11-11.

Nine criteria, the same as the A2A readiness score, read from our daily MCP probe (initialize + tools/list) and 30-day probe history. No MCP standard defines a signed server descriptor, so that criterion is n/a and the other 90 points are scaled to 100. Grades: A>=90, B>=75, C>=60, D>=40, F<40. Display only: search order uses the quality grade.

Compared with peers

Against 53,039 reachable MCP servers in our daily snapshot (2026-11-12 06:46 UTC). Display only; it does not change search order.

Readiness: Higher than 80% of peers; This listing 86 · peer median 81
Latency: Faster than 15% of peers; This listing 736 ms · peer median 326 ms

Where it loses the most points, and how to win them back

Verified identity −5 — Claim the listing and prove control of its domain.
Now: Publisher declared (repository, package or homepage); claim this listing to verify domain control.
Auth declaration −5 — State how to authenticate (an auth scheme, or that none is needed).
Now: How to authenticate is not stated.
Protocol revision −2 — Support the current protocol revision.
Now: Speaks MCP 2025-11-25, 1 revision(s) behind 2026-07-28.

How many agent tools actually work · All statistics

Listed in

Directories this entry was found in.

agenstry since 2026-10-22 ↗

How to connect

MCP endpoint (streamable-http)

https://forge.magery.ai/mcp

JSON-RPC initialize probe

curl -X POST https://forge.magery.ai/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'

Homepage

https://forge.magery.ai

Listed at (agenstry)

https://agenstry.com/mcp/mageryai/forge