# @munition/mcp

MCP server for Munition x402-paid agent services

- **Type:** MCP server
- **Trust:** 60/100 (B), scored on the package rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 0.0.16
- **Author:** io.github.benjammartin
- **License:** MIT
- **npm:** @munition/mcp
- **Endpoints:** streamable-http https://api.munition.io/mcp
- **Source:** https://github.com/benjammartin/munitionx402
- **Endpoint health:** reachable (last checked 2026-10-11T15:37:20.435Z, 1 sample) — uptime is not a security property and is not part of the trust score
- **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport)

## Trust

60/100 (B), scored on the package rubric
- Publisher verified: no
- Install scripts: nothing suspicious found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 1 day

## Security scan

- **Status:** clean
- **Scanned:** 2026-10-11T15:37:14.219Z
- **Version scanned:** 0.0.16
- **CVEs:** none found by OSV at scan time
**Findings**
- injection-shaped content (note) in the `connect_link` tool: Links to undeclared domain: api.munition.io

## Tools

12 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `flight_booking_links` — Generate KAYAK and Kiwi.com flight search links from airports and dates. Free and local: no account, wallet, API key, or network request is required. These link
- `flight_offer_details` — Fetch normalized Duffel details for a single flight offer id. Costs 0.01 USDC via x402 from the account wallet.
- `upload` — Upload a local file (≤ 10 MB) with optional stable tags. Returns a public URL retained for 7 days plus upload metadata including tags. Costs 0.005 USDC via x402
- `balance` — Returns the account's USDC wallet balance for x402 payments.
- `topup_link` — Returns an deposit URL for funding the account x402 wallet with USDC on Base.
- `connect_link` — Return a one-time link (valid 15 minutes) that lets the user use this same Munition account and balance in Claude.ai, ChatGPT or any app connected to the remote
- `setup_link` — Return a deposit link for the existing account, creating an anonymous account only if credentials are absent. Never resets existing credentials.
- `renew_upload` — Extend a file's retention by 7 more days. Costs 0.005 USDC via x402.
- `delete_upload` — Delete a previously-uploaded file. Free.
- `recent_uploads` — List the account's recent uploads (non-deleted), most recent first. Returns id, url, size, mime, hash, originalFilename, tags, uploadedAt, expiresAt, renewalCou
- `render_pdf` — Render self-contained HTML (inline CSS, data: images, no scripts or external resources, up to 1 MiB) into an A4 PDF (up to 20 pages / 10 MiB) and return its pub
- `search_flights` — Search live flight offers and return normalized itineraries. Costs 0.05 USDC via x402 from the account wallet.

## Install

**Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for.
**Cautions** (coverage gaps and advisories — never blocking)
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"mcp\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@munition/mcp\"\n      ]\n    }\n  }\n}"
```

## Blast radius

Extensive to critical — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs locally and hosted.
- Floor 42, ceiling 66 (tier: unknown)
- `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low.
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/%40munition%2Fmcp
- Install plan: https://forgeregistry.com/api/v1/packages/%40munition%2Fmcp/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/%40munition%2Fmcp
- HTML page: https://forgeregistry.com/registry/%40munition%2Fmcp
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.