Skip to content
MCPSTAMP
MCP server report

BidProwl MCP server

com.bidprowl/bidprowl

We checked this server on 2 November 2026 with McpStamp Check engine 1.2.0. It scored 66 of 100 (grade C), higher than 8.6% of the 33,003 registry servers that responded over HTTPS that day. Ready for MCP Registry. Not ready for Claude, ChatGPT and Gemini.

Measured facts

Score
66C
Sign-in
API key or other
Tools listed
7
Protocol version
2025-11-25
Stores

Store readiness

StoreStatusReason
Claude Connectors Directory Not ready Blocked by readOnlyHint or destructiveHint on every tool.
ChatGPT app directory Not ready Blocked by Sign-in method the store supports (OAuth or none), Protected resource metadata (RFC 9728), Authorization server metadata (RFC 8414 / OIDC), readOnlyHint or destructiveHint on every tool and Explicit readOnlyHint, destructiveHint and openWorldHint (ChatGPT).
Gemini Connected Apps Not ready Blocked by Sign-in method the store supports (OAuth or none) and Authorization server metadata (RFC 8414 / OIDC).
Official MCP Registry Ready No blocking check failed.

MCP Registry ready means a valid public remote for the registry, not that the server is listed in a store.

Fixes

7 checks to fix

  1. Fails

    readOnlyHint or destructiveHint on every tool

    tool_annotations

    Blocks Claude and ChatGPT.

    Measured 7/7 tools set neither readOnlyHint nor destructiveHint: search_listings, get_listing, sold_comps, flip_score, get_api_usage and 2 more

    Set annotations.readOnlyHint: true on read-only tools and destructiveHint: true on tools that modify or delete data (Claude needs one of them on every tool; ChatGPT needs all three hints, see tool_open_world).

  2. Fails

    Protected resource metadata (RFC 9728)

    auth_prm

    Blocks ChatGPT.

    Measured Not found: https://bidprowl.com/.well-known/oauth-protected-resource/api/v1/mcp -> 404; https://bidprowl.com/.well-known/oauth-protected-resource -> 404

    Serve RFC 9728 metadata at /.well-known/oauth-protected-resource (plus the path-suffixed form) with "resource" and "authorization_servers".

  3. Fails

    Authorization server metadata (RFC 8414 / OIDC)

    auth_as_metadata

    Blocks ChatGPT and Gemini.

    Measured Not found: https://bidprowl.com/.well-known/oauth-authorization-server -> 404; https://bidprowl.com/.well-known/openid-configuration -> 404

    Serve RFC 8414 metadata at <issuer>/.well-known/oauth-authorization-server with authorization_endpoint, token_endpoint and response_types_supported ["code"].

  4. Fails

    Sign-in method the store supports (OAuth or none)

    auth_method

    Blocks ChatGPT and Gemini.

    Measured GET: HTTP 401 and no working OAuth discovery: the server expects a credential such as an API key or static token

    ChatGPT and Gemini cannot send a static API key or token: add MCP OAuth (protected resource metadata and authorization server metadata), or serve the tools without auth. Claude accepts a static credential in a request header only in a beta

  5. Fails

    Explicit readOnlyHint, destructiveHint and openWorldHint (ChatGPT)

    tool_open_world

    Blocks ChatGPT.

    Measured 7/7 tools miss an explicit hint: search_listings, get_listing, sold_comps, flip_score, get_api_usage and 2 more

    Set readOnlyHint, destructiveHint and openWorldHint to explicit true/false on every tool (OpenAI app review requires all three).

  6. Fails

    401 carries WWW-Authenticate resource_metadata

    auth_challenge

    Measured GET: HTTP 401 without WWW-Authenticate

    On 401, send WWW-Authenticate: Bearer resource_metadata="<protected resource metadata URL>".

  7. Warning

    Tool descriptions

    tool_descriptions

    Measured 1 under 60 chars: get_listing

    Keep each tool description between 60 and 2000 characters: when to use it, what it returns, key limits.

14 checks passed, 6 did not run

Passed. Served over HTTPS, initialize over Streamable HTTP, Supported protocol version negotiated, JSON or SSE response Content-Type, JSON-RPC error for unknown method, GET answers SSE or 405, initialize latency, serverInfo name and version, Server instructions, tools capability declared, tools/list returns tools, inputSchema is an object schema, Tool names are valid and portable, Human-readable title on every tool.

Not run. Resource metadata "resource" equals the server URL, First metadata URL Gemini tries answers 200 with the required fields, issuer equals the authorization_servers entry; token_endpoint_auth_methods_supported (ChatGPT), PKCE S256 advertised, Client registration (DCR or Client ID Metadata Documents), refresh_token grant advertised. These need an OAuth sign-in flow the check could not reach.

Run a fresh check

This page is the 2 November 2026 snapshot. If you maintain this server and have shipped fixes since then, re-check it. The live check and the badge show the current result, and the next snapshot will pick up the change.

Re-check now

Badge

README badge

The badge shows the latest score for this URL and links to this report.

McpStamp score for BidProwl

Markdown

[![McpStamp score](https://www.mcpstamp.com/badge?url=https%3A%2F%2Fbidprowl.com%2Fapi%2Fv1%2Fmcp)](https://www.mcpstamp.com/r/com-bidprowl-bidprowl/)

HTML

<a href="https://www.mcpstamp.com/r/com-bidprowl-bidprowl/"><img src="https://www.mcpstamp.com/badge?url=https%3A%2F%2Fbidprowl.com%2Fapi%2Fv1%2Fmcp" alt="McpStamp score" height="20"></a>
Registry entry

About this server

US government surplus auctions: search live lots by ZIP radius, sold prices and Flip Scores.
Registry name
com.bidprowl/bidprowl
Remote URL
https://bidprowl.com/api/v1/mcp
Version
1.0.0
Website
bidprowl.com/developers
Checked
2 November 2026, engine 1.2.0, no credentials

The description above is the server's own text from the official MCP Registry. If a result looks wrong, run a fresh check and email support@zovo.one with the report link.

More grade C servers

All grade C servers · All server reports · State of MCP readiness, November 2026