# Check MCP

Remote Check MCP lives at https://www.hirebestie.com/api/check/mcp. Thirteen tools; custody first; no second SDK.

Canonical MCP resource identifier: [https://www.hirebestie.com/api/check/mcp](https://www.hirebestie.com/api/check/mcp). Use that URL in clients. Do not use unverified hostnames.

## Transport today

Authorization-server and protected-resource metadata are public. Credential creation, DCR, authorization, redemption, and token issuance stay off unless `CHECK_DISTRIBUTION_MODE` is `internal` (Bestie tenant allowlist) or `public`. Production defaults to `disabled`. Stdio MCP (via the CLI) does not use HTTP OAuth — it reads the process environment or a local credential store.

## Tools

The adapter exposes thirteen tools. Inline deliverable content is off by default; prefer `artifactRef`.

- `inspect_packs` — list admitted packs available to the caller.
- `verify_deliverable` — start a billable run. Requires a budget ceiling and explicit credit approval.
- `get_check` — status and scorecard for a `checkId`.
- `get_tasks` — execution progress.
- `get_findings` — locators and disposition summaries, not document excerpts.
- `get_artifacts` — committed backing artifacts for the run.
- `get_receipt` — execution receipt for a terminal run.
- `create_ruling` — record a disposition; never re-interprets the finding.
- `create_repair` — start a repair run against a parent check.
- `get_diff` — compare a repair or rerun to its parent.
- `get_lineage` — rerun and repair tree.
- `export_check` — export a terminal run (json, sarif, or pdf summary).
- `delete_check` — irreversible deletion of the run and its custody artifacts.

## Authorization

MCP credentials authenticate MCP. They are tenant-bound. Do not treat an MCP token as a general website session, and do not paste it into plugin JSON. REST and Office audiences are separate product work; do not assume one secret opens every surface.

> OpenAPI for the HTTP Check API is advertised at [/api/check/openapi.json](/api/check/openapi.json). Machine clients should prefer that file over scraping HTML.