# sh.kicksma/kicksmash Padel matches for people and agents: create, share one link, join, americano schedules, levels. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.1.0 - **Author:** sh.kicksma - **License:** Unknown - **Endpoints:** streamable-http https://kicksma.sh/mcp - **Source:** https://github.com/evhg/padel-matchup - **Endpoint health:** reachable (last checked 2026-10-17T05:00:04.575Z, 5 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 1 day ## Security scan **Assessment scope:** Hosted endpoint only: Forge can assess who publishes it and whether it answers, not the code behind it. No CVE, dependency or source analysis applies, so nothing here is a clean bill for that code. - **Status:** probed (endpoint answered; no code examined) - **Scanned:** 2026-10-17T05:00:04.575Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. ## Tools 15 declared. Observed from a live `tools/list` probe. - `about_kicksmash` — What Kicksmash is and how to use it: matches, levels, groups, boards, the API and what we ask of assistants. Read this once before acting. - `get_match` — A match or tournament by its 4-character code: players with levels, spots left, venue, time, level range, result. Public data only. - `find_matches` — Open, organizer-listed matches at a venue (its public board), with spots left and level ranges. Give the venue name; the slug is derived. - `get_group` — A crew that plays together: members' first names and count (their levels are for members only, so null here), weekly slot, whether it asks to join, upcoming mat - `generate_schedule` — Rounds of rotating-partner doubles for 4 to 64 players. Exact when the field is in fours (every pair partners once in players−1 rounds), fair sit-outs otherwise - `find_clubs` — Padel clubs: booking link and platform, courts, today's free courts (from the club's own calendar feed, or read from its booking platform's public page: freeCou - `find_series` — Tournament series: same weekday and time every week, fortnight or month, with the next edition to sign up for and the past podiums. Filter by city, or pass a sl - `find_coaches` — Padel coaches who listed their page: clubs, lesson length, languages, the rules students book under (cancellation cutoff, free late passes, notice). Filter by c - `coach_slots` — Free starts inside a coach's hours for the next days (default 14). Only accepted students can book them: request_coach first. - `request_coach` — Ask a coach to accept a person as their student, by first name or personal token. The coach answers with one tap. Keep the returned personalToken private to the - `book_lesson` — Book one lesson at a free start for an accepted student (their personal token). Draws from their open package when they have one. Confirm the time with the pers - `cancel_lesson` — Cancel a student's lesson under the coach's rules; the outcome says whether it was refunded, covered by a free pass, or counted. Say the rule to the person befo - `create_match` — Create a padel match (4 players) or an americano tournament for a person. A tournament may keep fixed pairs (fixedPairs: true): two partners play every round to - `join_match` — Put a person into a match by first name (or by their personal token from an earlier call). Handles waitlists and level ranges; when the level is outside the ran - `create_api_key` — Get a free key instantly for roomier limits and webhooks. Shown once. Not needed for reading or for a few writes a day. ## Install **Verdict: review** — Installable, but 3 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - Hosted endpoint only: Forge can assess who publishes it and whether it answers, not the code behind it. No CVE, dependency or source analysis applies, so nothing here is a clean bill for that code. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"kicksmash\": {\n \"type\": \"http\",\n \"url\": \"https://kicksma.sh/mcp\"\n }\n }\n}" ``` ## Blast radius Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on someone else's infrastructure; read-only tool surface. - Floor 9, ceiling 27 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/sh.kicksma%2Fkicksmash - Install plan: https://forgeregistry.com/api/v1/packages/sh.kicksma%2Fkicksmash/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/sh.kicksma%2Fkicksmash - HTML page: https://forgeregistry.com/registry/sh.kicksma%2Fkicksmash - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.