dev.tuvio/tuvio
Tuvio
Is the Tuvio MCP server down? No. It is up and needs auth (HTTP 401), probed 2026-10-28.
Security scans for AI-built apps: leaked keys, open Supabase RLS, vulnerable packages, live sites.
needs auth probed 2026-11-14 · unchanged since 2026-10-28 · HTTP 401 · Bearer
Streamable HTTP error: Error POSTing to endpoint: {"error":"invalid_token","message":"Send your Tuvio MCP token as 'Authorization: Bearer msk_mcp_…'. Create one- Endpoint
- https://api.tuvio.dev/mcp (streamable-http)
- Host
- api.tuvio.dev
- Getting access
- A key or token from the publisher, sent in the Authorization header (Bearer). The server publishes no OAuth metadata. Store the key once: npx mcpcost auth https://api.tuvio.dev/mcp --header "Authorization: Bearer …".
Read from the server's public OAuth metadata, without a token. Method. - Website
- https://tuvio.dev
- Registry
- active, updated 2026-10-27 · registry entry
Compare this server with others.
More servers
Servers that mention vulnerable or packages.
- ai.smithery/Nekzus-npm-sentinel-mcp · needs auth
- Package Health Check app.openkrill/packages · alive
- A.U.G.U.R Synapse · Web & Research art.maddegen.agent/synapse-web · alive
- Tracking & Returns com.aftership.mcp/tracking-public · alive
- AgentAvow Trust com.agentavow/agentavow-trust · alive
- npm Release Tracker — new Node.js packages & JavaScript dependency updates (npmwatch) com.a2awire/data-npm-release-node-package-javascript-dependency · alive
- PyPI Release Tracker — new Python packages & dependency updates (pypiwatch) com.a2awire/data-pypi-release-package-release-python-dependency · alive
- Rust Crate Release Tracker — new cargo packages from crates.io (cratewatch) com.a2awire/data-rust-crate-release-cargo-package · alive
Badge for the README
The result of the latest probe, the tool count and the token cost. The feed has an entry for every probe that changed them.
A mail when this server changes
Stops answering, comes back, tool set or cost changes. One confirmation mail first, a stop link in every mail.
For the publisher
- The server answers HTTP 401 to an unauthenticated initialize, so the probe cannot list its tools. That is correct for a private server. Some public servers answer initialize and tools/list without credentials and ask for auth on tool calls only; those get a token count here.
Fixed something? Probe it now, with the same steps as the daily run. This page updates with the next daily run.