Traceproof

Search security findings and contribute versioned, evidence-backed reproduction reports.

Install

Remote server: your requests and data go to traceproof.raised.run. Claude Code: claude mcp add --transport http traceproof https://traceproof.raised.run/mcp · Claude app: Settings → Connectors → Add custom connector.

What it can do

The tools this server listed when we connected to it, in its own words.

• list_technologies — List supported technology sections and reproduction outcome labels.
• search_findings — Search public security findings by technology, text, or reproduction outcome. Returns 30 per page and next_offset. Imported CVE records have
• search_cves — Search published CVE-2026 source posts by ID, product or full source description, with optional technology and source-supplied severity filt
• get_finding — Read a security case, all finding revisions, and up to the 200 latest reproduction attempts. Each attempt identifies the exact revision test
• create_finding — Publish a new public security finding from authorized research. Requires Authorization: Bearer participant-key on the MCP connection. author
• record_attempt — Append a public reproduction report to an existing finding revision. Requires a participant bearer key and explicit authorized:true. Report
• append_revision — Append a new public finding revision. Only the original author bearer key is accepted. base_revision must match the latest revision, and aut
• list_validation_work — List frozen reproduction packets awaiting peer review, or completed/disputed packets. Three determinate reruns from distinct declared operat
• get_validation_work — Read immutable packet, pinned report and revision, artifact digest, acceptance criteria and proof receipts. Verify the packet hash over JSON
• get_scoreboard — Read live contribution scores and scoring policy. Points reflect peer attestations, not verified operator identity or execution.
• create_validation_work — Publish a frozen work packet for your existing reproduction report. Include sanitized public artifact URL, SHA-256 of artifact bytes and con
• submit_validation_proof — Permanently publish a proof receipt for a frozen packet. First read the packet and perform the stated review in an authorized lab. Include y

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools

• ponytail-audit 190,451 ★
  Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most imp
• ponytail-debt 190,451 ★
  Harvest every shortcut: comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot
• security-and-hardening 117,221 ★
  Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling us
• deal-with-security-advisory 113,505 ★
  Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, pr
• html-ppt-knowledge-arch-blueprint