Porch

Q: Is Porch MCP server safe?

QAmcp's test on 25 Oct 2026: No hidden instructions were found in its tool descriptions. Its error messages showed no secrets or internal details. 4 of its 10 tools are labeled read-only; the others may change or send things. Overall it scored 100/100 on 25 Oct 2026. A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.

by porch.okibi.ai · https://porch.okibi.ai/mcp

Public URLs for AI agents to catch webhooks, OAuth redirects, job callbacks and approval clicks.

10 tools✓ no account neededPricing: not listed

Visit website

100 /100

PASS

11 of 11 checks · 25 Oct 2026

Is Porch MCP server safe?

No hidden instructions were found in its tool descriptions.
Its error messages showed no secrets or internal details.
4 of its 10 tools are labeled read-only; the others may change or send things.
Overall it scored 100/100 on 25 Oct 2026.

A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.

What it can do

10 tools, in the server's own words.

create_inbox

Get a public URL that records every HTTP request sent to it, plus the inbox_key that all other tools need.

get_inboxread-only

Show an inbox: its URL, expiry, request count, latest request id, configured responses and approval links.

list_requestsread-only

List captured requests as summaries, oldest first.

get_requestread-only

Full details of one captured request: method, path, parsed query, headers, body (UTF-8 text or base64), plus "json" or "form" when the body parses.

wait_for_request

Block until a request arrives, then return it in full (same shape as get_request).

set_response

Choose what Porch sends back to callers, for the whole inbox or a sub-path: status, headers and body.

create_approval_link

Make a link to send a person when you need their decision ("Deploy to production?").

wait_for_approvalread-only

Block until the person answers an approval link, then return their choice.

clear_requests

Delete all captured requests from the inbox.

delete_inbox

Delete the inbox and everything it captured.

Test results

Safe mode: only tools labeled read-only were run. How the test works

✓
ConnectsConnected in 168 ms
pass
✓
Ready for the newest MCP versionUses the latest MCP version (2026-07-28)
pass
✓
Lists its toolsFound 10 tools
pass
✓
Every tool is describedAll 10 tools and their inputs are described
pass
✓
Tools are labeled safe or dangerousEvery tool has a safety label
pass
✓
No hidden instructionsNo hidden instructions found in tool descriptions
pass
✓
Tools work with good inputs
All good
- ✓get_inbox: Answered with an error, probably because of our sample input: That inbox_key is not valid, or its inbox has expired. Call create_inbox to get a new inbox and key.
- ✓list_requests: Answered with an error, probably because of our sample input: That inbox_key is not valid, or its inbox has expired. Call create_inbox to get a new inbox and key.
- ✓get_request: Answered with an error, probably because of our sample input: That inbox_key is not valid, or its inbox has expired. Call create_inbox to get a new inbox and key.
- ✓wait_for_approval: Answered with an error, probably because of our sample input: That inbox_key is not valid, or its inbox has expired. Call create_inbox to get a new inbox and key.
- –create_inbox: Not run: labeled as changing data
- –wait_for_request: Not run: labeled as changing data
- –set_response: Not run: labeled as changing data
- –create_approval_link: Not run: labeled as changing data
- and 2 more
pass
✓
Bad inputs give a clean error
All good
- ✓get_inbox: Refused missing required input "inbox_key" with a clear error
- ✓get_inbox: Refused wrong type for "inbox_key" with a clear error
- ✓list_requests: Refused missing required input "inbox_key" with a clear error
- ✓list_requests: Refused wrong type for "inbox_key" with a clear error
- ✓get_request: Refused missing required input "inbox_key" with a clear error
- ✓get_request: Refused wrong type for "inbox_key" with a clear error
- ✓wait_for_approval: Refused missing required input "inbox_key" with a clear error
- ✓wait_for_approval: Refused wrong type for "inbox_key" with a clear error
pass
✓
Fast enough
All good
- ✓Connecting took 168 ms
- ✓Listing tools took 78 ms
- ✓Average tool answer: 44 ms
- ✓get_inbox: Slowest tool: get_inbox (57 ms)
pass
✓
No secrets leakedChecked 12 error messages: no secrets or internal details
pass
✓
Resources and prompts work
All good (1 resource)
- ✓Opened 1 of 1 resources
- ✓An address that does not exist gets a clean "not found" error
pass
–
Tools work togetherNo safe tool returned data to start a chain from, so chains were not tested (not counted either way)
not tested

Test it yourself

Free and open source. Same checks, same score.

npx qamcp-cli https://porch.okibi.ai/mcp

Score over time

18 Oct 2026100
25 Oct 2026100

Reviews

Coming soon: reviews from people who use Porch, signed in with GitHub, one per person. Reviews never change the score.

Is this your server?

Soon you can claim this page: re-test it from here, reply to results, and show a "Tested by QAmcp" badge.

Have a concern, or want it removed? Ask us and we'll take it off the list. How the directory works