turva-mcp

Public, read-only Model Context Protocol (MCP) server for turva.dev, an agent-readiness audit and advisory service. It lets AI agents query turva.dev's service catalog, its own agent-readiness scores, the public web-security scan results for its domain, and its engagement principles, as structured JSON instead of scraped HTML.

The server is public on purpose: anyone can read exactly what it exposes before deciding anything.

MCP endpoint

https://mcp.turva.dev/mcp

Listed in the official MCP registry as dev.turva/turva-mcp, and in the Glama MCP directory (domain verified at /.well-known/glama.json).

Implements MCP protocol revision 2025-11-25 and negotiates down to the older revisions the SDK supports. Transport is Streamable HTTP. The MCP endpoint is POST /mcp. The deprecated standalone SSE transport is not served. The Streamable HTTP GET stream uses SSE framing, which is a different thing. A server card is published at GET / and GET /.well-known/mcp. CORS is open (Access-Control-Allow-Origin: *).

No authentication and no API key are required. All exposed data is public and read-only. Requests are rate limited to 100 per 60 seconds per client IP at the edge, answered with 429 and a Retry-After header past that, and the limiter fails open if it errors.

Related MCP server: fedramp-docs-mcp

Tools

Four read-only tools. There are no write tools and no transaction tools. Each returns JSON as text content.

• get_services: the service catalog (audit, advisory, implementation, agent operations, MCP server design), the engagement model, and pricing (fixed list prices for audit, advisory and implementation, others on request).

• get_agent_readiness: turva.dev's own agent-readiness score from an independent scanner, with category sub-scores, the measurement date, and verification links.

• get_security_evidence: public web-security scan results for turva.dev's own domain (Hardenize, Internet.nl), with the scan date.

• get_principles: the engagement principles, namely async-only, least access, results measured in scanner numbers, open and verifiable.

Data is served from static TypeScript objects bundled with the Worker, so every response is deterministic and depends on no external state. Scores carry a measured_at date and verification links, so any reader can compare a stored snapshot against a fresh scan.

Evidence

The scores these tools return are turva.dev's own, measured by independent public scanners on 2026-07-28: 100/100 and Level 5 (Agent-Native) on isitagentready.com, Hardenize passing all 13 categories, and 98/100 on Internet.nl. Every response carries a measured_at date and a verification link, so a stored snapshot can be compared against a fresh scan. Re-run any scan yourself from the links in Verify below.

Endpoints

All methods on /mcp are handled by the Streamable HTTP transport (GET opens the SSE stream, DELETE ends a session). The card paths respond to any method.

Connect

Point any MCP client that supports Streamable HTTP at the endpoint. Example client config:

{
  "mcpServers": {
    "turva": {
      "url": "https://mcp.turva.dev/mcp"
    }
  }
}

Quick reachability check (returns the server card):

curl https://mcp.turva.dev/

On Windows PowerShell use curl.exe, since curl is an alias for Invoke-WebRequest.

Verify

Everything the tools return is publicly auditable. Re-run the scans and open the records yourself:

• isitagentready scanner: https://isitagentready.com/

• Hardenize report: https://www.hardenize.com/report/turva.dev

• Internet.nl report: https://internet.nl/site/turva.dev/

• Company (Finnish Business Information System): https://tietopalvelu.ytj.fi/yritys/3600281-7

How it works

A single Cloudflare Worker built on the Cloudflare Agents SDK serves the MCP endpoint, backed by a Durable Object. Tool data lives in static TypeScript objects in the bundle. The server does no logging. Errors are returned as MCP protocol error responses rather than written anywhere. Cloudflare Workers observability is switched off in wrangler.jsonc, so the platform does not collect invocation logs either.

The Worker is independent from the main turva.dev site, so an MCP change cannot affect the website.

Deploy

Requires a Cloudflare account and the wrangler CLI.

cd turva-mcp
npm install
npx wrangler deploy

Route the Worker to mcp.turva.dev under Workers & Pages, your-worker, Settings, Domains & Routes.

Use it for your own site

MIT licensed. Fork it, replace the static data objects with your own, then deploy.

If you want an agent-readiness audit of your own domain, see turva.dev or Erik Rekola on LinkedIn.

Security

Responsible disclosure: see SECURITY.md. Contact: info@turva.dev

License

MIT