sidelineiq-mcp-servers (kpjmd/sidelineiq-mcp-servers) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 78 tools. No publisher has claimed this listing.

C
Emerging
74/100

sidelineiq-mcp-servers

MCP (Model Context Protocol) servers for the SidelineIQ — an autonomous AI sports injury intelligence platform

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

kpjmd

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 1 credential: MCP_AUTH_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes78 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

farcaster_publish_cast

Publish a single cast to Farcaster via Neynar API. Use for Breaking injury posts and short Tracking updates under 320 characters.

farcaster_publish_thread

Publish a multi-cast thread to Farcaster. Use for Deep Dive injury content requiring more than 320 characters. Automatically chains casts as replies.

farcaster_get_cast

Retrieve a previously published cast by hash to verify publication status or retrieve content for editing.

farcaster_get_profile_stats

Read the SidelineIQ Farcaster account's own follower and following counts via Neynar /user/bulk, for the FID in SIDELINEIQ_FARCASTER_FID. Used by the daily baseline metrics snapshot. Fails with an error rather than returning 0 when the counts cannot be read.

farcaster_get_notifications

Fetch recent Farcaster notifications (mentions and replies) for the SidelineIQ account. Filters to mention and reply types only — ignores likes and recasts. Use nextCursor from the response as the cursor on the next call.

farcaster_delete_cast

Delete a published cast by hash. Use when MD review flags a post for removal after publication.

twitter_publish_tweet

Publish a single tweet to X/Twitter. Use for Breaking and Tracking injury posts. Premium account supports up to 25,000 characters per post.

twitter_publish_thread

Publish a multi-tweet thread to X/Twitter. Use for Deep Dive and Conflict Flag content. Premium account supports up to 25,000 characters per post. Automatically chains as replies. Maximum 10 tweets per thread.

twitter_get_tweet

Retrieve a published tweet by ID to verify publication status.

twitter_get_profile_stats

Read the authenticated SidelineIQ X account's own follower, following and post counts (GET /2/users/me). Used by the daily baseline metrics snapshot. Fails with an error rather than returning 0 when the counts cannot be read.

twitter_get_mentions

Fetch recent mentions of the SidelineIQ Twitter account. Returns tweets that mention the account since the given since_id cursor. Use newestId from the response as since_id on the next call to avoid reprocessing.

twitter_delete_tweet

Delete a published tweet by ID. Use when MD review flags a post for removal after publication.

web_create_injury_post

Create a new injury post in the SidelineIQ database for display on the web frontend. Stores full clinical content, platform publish status, and metadata. Auto-generates a URL slug.

web_update_injury_post

Update an existing injury post. Used for Tracking updates as the injury story develops and return-to-play estimates are revised.

web_delete_injury_post

Hard delete an injury post from the SidelineIQ database. NOT the MD reject path — use web_reject_injury_post, which keeps the row so the review queue remembers the decision. This is for genuine deletions only. Protected against accidentally deleting posts with TRACKING children — pass force:true to

web_reject_injury_post

Reject a post awaiting MD review: sets status REJECTED, keeps the row, and closes its md_reviews entry. Replaces web_delete_injury_post on the reject path — the row is what lets the agent remember the decision and stop re-filing the same review item every poll cycle. Void the post's thread BEFORE ca

web_supersede_injury_post

Retire pending review items that a later post has already published for, so the MD cannot approve a duplicate. Only rows currently in PENDING_REVIEW are touched; anything else is returned in `skipped`. The caller decides equivalence — this tool takes explicit ids.

web_get_post

Retrieve an existing injury post by ID.

web_get_post_by_slug

Retrieve an injury post by its URL slug. Used by the frontend for slug-based routing.

web_get_post_by_social_id

Look up an OTM injury post by its Twitter ID or Farcaster hash — use this to retrieve the original post content when responding to mentions.

web_flag_for_md_review

Flag an injury post for MD review. By default sets post status to PENDING_REVIEW (correct for new agent-generated content that hasn't published yet). Pass preserve_status=true for retrospective flags on already-PUBLISHED posts (legacy fact sweep, post-hoc audits) so the live post isn't pulled out of

web_list_posts

List injury posts with filtering. Used by the agent to check for duplicate coverage before publishing.

web_list_md_reviews

List MD review records for the admin dashboard, joined with injury post details. Optionally filter by review status.

web_update_md_review

Approve or reject an MD review. If approved, also sets the linked injury post status to PUBLISHED. Sets reviewed_at timestamp.

web_purge_all_posts

Purge ALL injury posts and their cascaded md_reviews from the database. One-time pre-launch operation. Requires confirm:true. Returns row counts before and after.

web_get_social_state

Read a value from the social monitor state table. Used to retrieve pagination cursors (twitter_mentions_since_id, farcaster_notifications_cursor) between polling cycles.

web_set_social_state

Upsert a value in the social monitor state table. Used to persist pagination cursors between polling cycles.

web_record_metric_snapshot

Record one baseline metric reading (follower count, monthly uniques) for a UTC day. Upserts on (metric, day): the latest reading of a day wins. Call ONLY with a value actually read — a failed read must record nothing, never 0.

web_list_metric_snapshots

List baseline metric readings, ordered by metric then day. A day with no row means no reading was taken or the read failed — never zero.

web_increment_cta_click

Count one click on an AequOs link from a post page. Aggregate only — stores the day, post slug and which link, nothing about the visitor. Counts only when the slug belongs to a PUBLISHED post; returns counted=false otherwise.

web_list_cta_clicks

List daily AequOs link click counts from post pages, with totals by link and by post.

web_check_mention_processed

Check whether a social mention has already been processed. Returns processed:true if a matching row exists in processed_mentions.

web_insert_processed_mention

Log a processed mention to the processed_mentions table. Call this after every mention regardless of action taken (REPLIED, IGNORED, QUEUED_CORRECTION). Silently ignores duplicates.

web_insert_pending_correction

Queue a user-submitted correction for admin review. Called when a mention is classified as CORRECTION with confidence > 0.8. Corrections do NOT auto-update posts.

web_list_pending_corrections

List pending corrections submitted by users. Used by the admin dashboard to review and approve/dismiss factual corrections to OTM posts.

web_approve_injury_post

One-click approve a PENDING_REVIEW injury post. Flips status to PUBLISHED and marks the linked md_reviews row as APPROVED. Returns the full post row for downstream social publishing (Farcaster, Twitter). No reviewer notes required — for richer reviews with notes, use web_update_md_review.

web_upsert_team

Upsert a team row from ESPN's teams endpoint. Conflict resolution: (sport, espn_team_id) when the ESPN id is present, else (sport, name) case- and whitespace-insensitively among rows that have no ESPN id. Used by the roster-sync cycle that runs every 6h to keep teams current with trades and rebrands

web_upsert_player

Upsert a player row from ESPN's roster endpoints (or the athlete-tier override list). Conflict resolution: (sport, espn_athlete_id) when ESPN id present, else (sport, normalized_name). The server canonicalizes full_name into normalized_name (lowercase, no diacritics, Jr/Sr stripped) to make later re

web_set_player_prominence

Override the prominence_tier for a specific player. Used by the athlete-tier override import and any future manual prominence adjustments. prominence_source signals where the value came from for auditability ('override' for the JSON file, 'manual' for dashboard edits).

web_resolve_player

Resolve an athlete name to a canonical player record (with current team). Pass espn_athlete_id when the source carries one — it is tried first and returns confidence='exact', which is the only way to separate two athletes who share a name. Returns confidence='normalized' on a unique name match, 'amb

web_list_teams

List team rows, optionally filtered by sport and by coverage state. coverage='in' (default) returns clubs inside our editorial coverage, 'out' returns clubs that still exist upstream but have left it (e.g. relegated), 'all' returns both. Used by roster-sync drift detection and the seasonal coverage-

web_list_players

List player rows with their ESPN athlete ids and contract salary, optionally filtered by sport, team, and the coverage state of their current team. Unlike web_resolve_player this does not hide players on out-of-coverage clubs — it is the inspection surface for roster repair, not a publish-path looku

web_set_team_coverage

Mark a team as inside or outside our editorial coverage. Out-of-coverage clubs keep their row and their player links — the club still exists (e.g. relegated to a league we do not poll) — but its players stop resolving via web_resolve_player. Reversible: in_coverage=true restores it, and a club reapp

web_apply_correction

Apply a fact correction to a published injury post. Field must be one of: team, injury_type, injury_severity, team_timeline_weeks. Appends a visible 'Updated on <date>: <note>' line to clinical_summary and bumps correction_count — never a silent overwrite. Caller should follow up with web_append_inj

web_get_entity_for_post

Look up the injury entity associated with a post — either as the canonical_post_id or via an injury_updates link. Used by the entity backfill script to walk parent_post_id chains and reuse existing entities.

web_get_entity

Resolve an injury entity by id (player_id, body_part, laterality, injury_type, status, canonical_post_id, return date). Lets the Injury Desk walk a desk post's entity_id → canonical_post_id → web_get_post for fact-validation context.

web_get_published_desk_post_for_entity

Look up the most recent PUBLISHED desk post for an injury entity, or null if the entity has none. Used to detect whether new injury_updates activity on an entity should surface as a Return Watch candidate (append to the existing post) instead of a new-post candidate.

web_list_injury_updates

List an injury entity's timeline updates newest-first (update_kind, severity_at_time, team_timeline_weeks, otm_min_weeks, source_url, description). Backs the Injury Desk entity-timeline panel. An empty array is a valid result, not an error.

web_find_matching_entity

Find an active injury entity matching player + body part + laterality + injury type within a recency window. Returns the most recent matching entity (with last update's severity + team_timeline_weeks for delta-decision purposes) or matched=false if nothing matches.

web_create_injury_entity

Create a new injury entity. Called once per real-world injury — subsequent updates use web_append_injury_update. canonical_post_id should point to the originating BREAKING/DEEP_DIVE post when one exists.

web_append_injury_update

Append an update to an injury entity's timeline. post_id is nullable (repeat source reports about the same injury append updates without producing a new post). Bumps the entity's last_updated_at so future recency-window matches stay current.

web_thread_update_dates

Persist resolved injury/surgery dates and provenance onto an injury thread (the injury_entities row). Called by the pre-OTM date-resolution loop, the post-publish projection patch, and MD manual date entry. Every field is optional and COALESCE'd against the current value — omit a field to leave it u

web_thread_append_timeline

Append a trajectory data-point to a thread before the post is drafted: the reported team timeline, OTM min weeks, severity, and source. Thin wrapper over injury_updates (reported_timeline_weeks maps to team_timeline_weeks); post_id is attached later by entity bookkeeping. Use update_kind INITIAL for

web_thread_close

Close an injury thread when the athlete returns (RESOLVED) or retires (RETIRED), or retract one that should never have existed (VOID). RESOLVED/RETIRED record actual_return_date and compute accuracy_record against the stored otm_projection. VOID does neither — it means the thread describes an injury

web_thread_correct_laterality

Correct the stored laterality (side) on an injury thread. Use when a thread was opened with the wrong side and the posts have already been corrected — the entity's laterality feeds every follow-up's thread context and is half the (player_id, body_part, laterality) dedup key, so leaving it wrong keep

web_thread_get

Return one injury thread in a single round-trip for the MD detail view: the entity row (resolved dates, OTM projection, accuracy record) plus its full injury_updates trajectory newest-first.

web_list_threads

List injury threads for the MD dashboard, joined with athlete name / sport / team. Filter by status (ACTIVE/RESOLVED/RETIRED/VOID) and/or needs_date_review to drive the active, date-review, and accuracy views. Ordered by last_updated_at, newest first, with id as the tiebreak. Paged: follow next_offs

web_audit_append

Append an immutable audit entry. Used at every pipeline stage (ingest, validate, draft, attest, publish, correct, retract). before/after payloads are hashed server-side using canonical-JSON SHA-256.

web_list_audit_entries

List audit entries for one entity in reverse-chronological order. Use to reconstruct the history of a post, desk piece, or entity for review/defensibility.

web_propose_candidate

Propose (or refresh) an Injury Desk promotion candidate for an injury entity. Upserts the single open PROPOSED candidate per entity — re-proposing updates the score/reasons in place rather than creating a duplicate. Does NOT publish anything; it queues the entity for MD triage. promotion_score is 0-

web_list_candidates

List Injury Desk promotion candidates, joined to athlete/entity/post display fields, ordered by promotion_score. Filter by status (PROPOSED for the open queue). Use to render the Candidates tab in /admin.

web_decide_candidate

Record an MD decision on a promotion candidate: ACCEPTED (park for Injury Desk authoring) or DISMISSED (close). Only PROPOSED candidates can be decided. Audited. decided_by should be the MD user id.

web_get_user

Look up a verified user (identity + role) by id. The Tier 2 publish gate uses this to re-derive role from the database rather than trusting a caller-supplied role. Returns null if not found.

web_get_user_by_email

Look up a verified user by email (case-insensitive). Used by the NextAuth adapter to resolve the signing-in identity and its role. Returns null if not found.

web_upsert_user

Provision or update a verified user identity (role md|editor). Idempotent on email. Audited. Administrative provisioning only — the magic-link flow does not mint users.

web_create_verification_token

Persist an Auth.js magic-link verification token (issued at link-request time). identifier is the recipient email; expires is an ISO 8601 timestamp.

web_use_verification_token

Atomically consume a magic-link verification token at click time (single-use, delete-on-read). Returns the token row if valid, or null if already used / never existed.

desk_create_draft

Create a DRAFT Injury Desk (Tier 2) post from an ACCEPTED promotion candidate. Writes the v1 version row and moves the candidate to PROMOTED. Does NOT publish — a desk post must be attested by an MD and pass the server-enforced publish gate first.

desk_update_draft

Save edits to a DRAFT or READY desk post. Writes a new version row on every save. Editing a READY (attested) post reverts it to DRAFT — the prior attestation is now stale and must be redone before publishing.

desk_lint

Lint a desk post for Tier 2 framing violations and kpjmd contract compliance. Returns {warnings, blockers}; non-empty blockers will block desk_publish.

desk_attest

Record a physician attestation on a desk post. The MD role is re-derived server-side from reviewer_user_id (a UUID = session.user.id) — a caller-supplied role is ignored. All three confirmations must be true. Snapshots the current body's content_hash and moves the post to READY.

desk_publish

Run the server-enforced publish gate on a READY desk post. Publishes only if ALL hold: the DB-derived role of reviewer_user_id is 'md', the latest attestation's content_hash equals the post's current body hash (catches post-attestation edits), and the linter returns zero blockers. A blocked publish

desk_retract

Retract a PUBLISHED desk post (status → RETRACTED). MD-only — role is re-derived from reviewer_user_id. Refreshes draft_json so _sideline.status becomes RETRACTED; the frontend serves that snapshot as {slug}.retracted.json, which the kpjmd builder renders as a tombstone page at the same URL.

desk_confirm_kpjmd_live

Verify a PUBLISHED desk post is actually live on kpjmd.com and record the confirmation. Fetches https://kpjmd.com/injury-desk/{slug}/ and requires BOTH a 200 and an x-sideline-content-hash meta tag matching the post's current content_hash (so a stale page from an earlier build cannot pass). Only on

desk_append_update

Append a dated 'Return Watch' follow-up to an already-PUBLISHED Injury Desk post (e.g. a return-to-play milestone). MD-only — role re-derived from author_id. Refreshes the post's draft_json (kpjmd handoff snapshot) to include the new update. If candidate_id is supplied, that RETURN_WATCH_UPDATE cand

desk_list_updates

List a desk post's Return Watch updates newest-first (headline, markdown_body, occurred_at, author_id). Backs the timeline rendered in the /desk editor and the updates[] array of the kpjmd handoff. Empty array is a valid result.

desk_list

List Injury Desk posts (optionally filtered by status), newest-updated first, joined to athlete/injury display fields.

desk_get

Fetch one desk post by id plus its attestations (newest first) for the Injury Desk editor view.

// known CVEs in dependencies1 critical1 medium2 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3.2.4GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

medium@anthropic-ai/sdk@0.80.0GHSA-p7fg-763f-g4gf

Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool

low@anthropic-ai/sdk@0.80.0GHSA-5474-4w2j-mq4c

Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories

lowvitest@3.2.4GHSA-82fw-gwwq-j7x9

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretMCP_AUTH_SECRET
configPORT_FARCASTERFarcaster server port (default: 3101)
configPORT_TWITTERTwitter server port (default: 3102)
configPORT_WEBWeb server port (default: 3103)
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployDATABASE_URL
// quality suggestions

Tool inputs are validated

75/78 tool handlers declare input schemas (96%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Production dependencies are patched

1 medium severity in production deps

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/kpjmd/sidelineiq-mcp-servers)](https://m8ven.ai/mcp/kpjmd/sidelineiq-mcp-servers)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: 199de09bca8cc67e0a644ea1faf556bcb4fdd8cd
code hash: 1ca70fc59c9d524cbfe9493486e16594d7e3e558070417ea8a6caff2e728f0b1
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client