Turva.dev MCP server

• Registry namedev.turva/turva-mcpverified in the MCP registry

The registry name sits under turva.dev. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

• Stateanswerschecked 2026-10-20
• Tools5
• Server calls itselfturva-mcp
• Server version1.6.19
• Protocol version2025-06-18

On 2026-10-20 the server answered initialize and tools/list without a sign-in. First answer in 224 ms.

• Its tools do none of the product's use cases we checked: check what AI assistants can read on a website; find where published product information disagrees; confirm Shopify prices and availability match across shopping interfaces.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

• INITE MCP score71 of 100answers 100 · does the job 0 · definitions 100 · context 100
• What an agent can do with it0 of 3 use cases
• Answered100% of days7 of 7 daily checks
• Median first answer238 ms
• Space in an agent's context≈ 1,003 tokensthe definitions of all its tools (5), which an agent carries on every turn
• Tool definitionsA · 100 of 100
• Typed results5 of 5 toolsdeclared outputSchema: results come typed, read once

• Every tool passes all six checks.

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (30%), doing the product's job (25%), definitions (20%), context (10%) and use (15%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

• get_services

  Returns turva.dev's service catalog: the Shopify agent storefront check, agent-readiness audit, advisory, implementation, agent operations, and MCP server design, plus the engagement model and pricing (fixed list prices for the Shopify…

• get_agent_readiness

  Returns turva.dev's own agent-readiness score from an independent public scanner (isitagentready.com), including category sub-scores, with the measurement date and a link to the scanner's start page, where a new check can be run (the link…

• get_security_evidence

  Returns the latest public web-security scan results for turva.dev's own domain (Hardenize, Internet.nl site and mail), each with its scan date. Use this when a user asks about turva.dev's own security posture or wants evidence beyond…

• get_principles

  Returns turva.dev's engagement principles: async-only, least access, the result shows up in scanner numbers, and open and verifiable. Use this when a user asks how turva.dev works with clients or what rules an engagement follows. For what…

• get_contact

  Returns who runs turva.dev and the official ways to reach it: the operator and business details, the email address, the Signal link, the LinkedIn profile, the correspondence languages, the first-reply time and the access an audit needs…