kaval (usekaval/kaval-clients) is an MCP server listed on the M8ven Trust Index. It scores 62 out of 100, grade C. It declares 37 tools. No publisher has claimed this listing.
Freshness gate for AI agents: verify a belief is still true against the live world before you act.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
usekaval
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
checkVerify the facts an action depends on BEFORE acting on it. Describe the action you are about to take (and any context you are relying on), or pass the specific claims, and Kaval re-checks each fact against the sources it watches — returning decision ALLOW, REVIEW, or BLOCK with a signed receipt. ALL…
get_receiptFetch the full signed receipt for a check you already ran, by the `receipt.id` that check returned. `check` gives you only the id, the signature, and when it was signed; this returns the document that was actually signed — every fact with its state and the evidence basis under it (source locator, co…
prepare_contract_uploadCreate a private PDF upload target. Upload the exact bytes to upload_url before you call ingest_contract with the returned upload id.
ingest_contractQueue a contract for extraction. Use canonical text, an approved HTTPS content URL, or an upload id from prepare_contract_upload.
get_contractGet contract processing status, candidate counts, and extraction issue state. Poll until the contract is ready for review or has failed.
list_contract_claimsList extracted claim candidates with exact evidence spans. A reviewer must approve, correct, or reject each candidate before activation.
list_contract_extraction_issuesList deterministic contract extraction failures for customer review. Each issue identifies the rejected candidate and evidence-line range without exposing contract text.
review_contract_claimRecord an immutable human review. Use correct only with corrected_claim. The expected version prevents a stale review from overwriting newer work.
import_factsQueue 1 through 400 reviewed facts for warm checks. This tool does not create watched sources. Each item gets a terminal result.
get_fact_importGet one bulk import and every item result. Poll until the batch reaches a terminal state.
list_bulletinsList structured payer bulletins. Filter by payer, policy, code, publisher date, or review status. Dates are publisher-stated dates only. Prefer create_extraction_schema + create_extraction_run (or update_source's extraction_schema_id binding) for new integrations — this free-text pipeline still work…
get_bulletinGet one structured bulletin by source-version id. Each field includes its status and exact evidence when available. Prefer get_extraction_run for new integrations — this free-text pipeline still works but is not receiving new record types.
list_bulletin_extraction_attemptsList customer-readable bulletin extraction status. Filter by source or lifecycle state. This tool cannot requeue work. Prefer list_extraction_runs for new integrations — this free-text pipeline still works but is not receiving new record types.
get_bulletin_extraction_attemptGet one customer-readable bulletin extraction attempt by source-version id. This tool cannot requeue work. Prefer get_extraction_run for new integrations — this free-text pipeline still works but is not receiving new record types.
list_training_jobsList training and evaluation job status. This read-only tool does not start, approve, or promote a model.
get_training_jobGet one training job status. Production promotion remains an internal operation and is not available through MCP.
list_training_feedbackList reviewed feedback and its effective training-use state. This read requires training:manage and does not approve data for training.
record_training_feedback_consentRecord an explicit, auditable training-use decision for one reviewed feedback item. This mutation requires training:manage. Approval requires consent_to_training=true.
create_extraction_schemaRegister a JSON Schema Kaval extracts structured records against. Bind the returned schema's id to a source with update_source so every document that lands on it afterward is extracted automatically and delivered as an extraction.document webhook, or pass it directly to create_extraction_run for a o…
rename_extraction_schemaRename a schema without changing its definition or hash. Active watched sources can continue to use it.
delete_extraction_schemaDelete a schema from lists and selectors. Historical extraction records remain available. Returns a conflict if an active watched source uses it.
list_extraction_schemasList the extraction schemas registered in this workspace, newest first.
create_extraction_runRequest a one-off publisher + period extraction run. Pass source_id or extraction_schema_id, not both; omit both when exactly one schema is bound in the workspace. Requires policy-update:manage. Answers with the run in status 'processing' — poll get_extraction_run or wait for its extraction.document…
get_extraction_runGet one extraction run (an Update) by id — its status (processing | retry | succeeded | review_required | failed | out_of_scope), the schema it ran against, and its extracted result once it succeeds. Document PDF chrome (pdf_href, content_href, sections) is nested on extraction_run.document by defau…
list_extraction_runsList extraction runs (Updates). Filter by publisher_id (org publisher UUID), optional period_from and/or period_to (YYYY-MM), created_since/updated_since (ISO-8601), and page with limit + cursor. Document chrome is nested on each run.document by default; pass expand_document=false to omit. Returns {…
list_extraction_packagesList the monthly PDF + manifest rollups every publisher/period's extraction runs are packaged into, optionally filtered by publisher UUID and/or YYYY-MM period. Each row's pdf_href is GET /v1/extraction-packages/{id}/document — follow the 302 to a short-lived signed PDF (this tool does not download …
list_publishersList org-owned publishers for this workspace's billing account. publisher_id on sources and extraction runs is the UUID returned here; rename the display name without changing identity. Create with create_publisher.
create_publisherCreate an org-owned publisher (renameable display name; UUID is the identity). Pass the returned id as publisher_id to add_source. Duplicate names in the same org return 409.
get_publisherGet one org-owned publisher by UUID. Display name is renameable; identity is the UUID used as publisher_id on sources and extraction runs.
update_publisherRename an org-owned publisher. The UUID identity is unchanged — existing sources and runs keep grouping under it.
add_sourceTell Kaval what to watch, so later checks are answered from fresh state instead of live research. Requires publisher_id (org publisher UUID from list_publishers / create_publisher) so extractions group under that publisher. Registering the NAME of an authority is usually enough: {kind:'entity', name…
list_sourcesList what Kaval currently watches for this workspace — including sources it auto-registered after a check cited them. Each row shows the locator, what it was registered for, when it was last successfully fetched, and whether it is active. Use it to see whether the fact you care about is actually bac…
remove_sourceStop watching a source and forget it, by the `id` `add_source` or `list_sources` returned. Removal is the only thing that frees a slot. Capacity is two ceilings: up to 200 active registered/resolved sources per workspace (every URL a check cites auto-registers against that ceiling), and up to 200 ac…
update_sourceBind (or unbind) an extraction schema and/or set publisher_id on a watched source, by the `id` add_source or list_sources returned. Provide extraction_schema_id and/or publisher_id. Once a schema is bound, every document that lands on the source is extracted automatically and delivered as an extract…
get_source_version_contentFetch the captured content of one fetched version of a watched source, by the `source_version_id` an extraction.document webhook or an extraction run names. Defaults to the raw canonical text; pass format:'sections' to get it pre-split into the same sections the sectionizer feeds extraction runs.
report_outcomeReport what actually happened after a prior check, using the receipt id it returned, so Kaval can calibrate. Use `relied_and_correct` when you acted on an ALLOW and it held; `current_later_contradicted` when an ALLOW turned out to be wrong; `stale_caught_real` when a REVIEW/BLOCK caught a genuine ch…
verifyDEPRECATED — prefer the `check` tool. Verifies one load-bearing conclusion against evidence references you supply and returns a signed ProofPacket receipt (status valid | invalidated | could_not_verify, receipt.decision ALLOW | REVIEW | BLOCK). Kept only for existing pilot integrations that pass exp…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
Tool annotations
2/37 tools have annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
37/37 tools missing one or more hints — check (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_receipt (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); prepare_contract_upload (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +34 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.0 (high), @modelcontextprotocol/sdk@1.12.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
2 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/usekaval/kaval-clients)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check