Level 1 measurement

What a server did at startup before any tool was used, and where its own README is silent about it. No tool is called, so nothing here tests whether a tool does what it says. Not calibration-backed. Not a ranking.

@kolbo/mcp 1.128.0 — Level 1 measurement

Measured 2026-11-02. Asked for @kolbo/mcp@1.128.0. Instrument fingerprint ca9170dfaeae.

Published on npm as @kolbo/mcp. Its own manifest points at https://github.com/Zoharvan12/kolbo-mcp, which is what the package says about itself and is not checked here.

This is not a ranking of the most-used servers. This package was measured because it appeared in a candidate list built from registry searches, and the order of those searches is not a measure of use.

Level 1, and not calibration-backed. No tool was called, so this report makes no claim about any tool doing what it says. The calibration that backs the ten curated measurements proves the instrument catches planted claims about what a tool did; Level 1 runs no such checks, and reads the package's own documentation by a stated rule rather than by a person, so nothing in that calibration speaks to this page.

Not named in the README does not mean hidden. A server's tool list can depend on its settings, and READMEs often describe the default setup. This run gave every server the same fake credentials and no settings of its own, so what it shows is that one configuration, not necessarily the one you would run.

In plain words

We installed @kolbo/mcp 1.128.0 from the npm registry, started it in a room with no route to the internet, where every website name answers to this machine and every credential is fake, and asked it to list its tools without calling any of them. Before any tool was used it offered 278 tools, looked up 0 websites, started 2 programs and wrote 0 files; of those, 66 tools and 0 websites are not named in its own README. From starting to answering with that list took about 2.1 s, measured once and while being watched, which makes it slower than it would be otherwise. We called no tool and read the contents of no encrypted connection, so this page says nothing about whether any of its tools does what it says.

The standard this report uses

A website counts as declared only if the README names it.

A sentence about connecting somewhere, without the address, names no website. A tool counts as documented only if its name appears in the README as a whole word. Each question is asked once per thing observed, so what the README documents is never worked out from what the program offered — which is the only way "offered but not documented" can be found at all.

The host rule is loose in one direction, and it is better to say so: it reads any dotted name whose last part is two or more letters, so a filename written in prose can read as a website. That can only make the declared list longer and leave something out of the findings below. It cannot put something in.

What it did at startup, before any tool was used

It started and identified itself as kolbo 1.0.0.

Websites it looked upnone
Encrypted connections it openednone
Other addresses it triednone
Programs it startedkolbo-mcp, node, setpriv
Files it wrotenone
Package-manager commands it rannone
Tools it offered278
Time to answer (approximate)2.1 s

Time to answer is approximate. It is 2.1 s measured once, from the moment this harness handed the process to an unprivileged user to the timestamp on its reply listing its tools; 2.0 s of that was reaching the end of the opening handshake, and listing the tools took the remaining 157 ms. The process ran under a kernel tracer that stops it at every file it opens, so this is slower than the same start untraced, by an amount not measured and not estimated here. It includes whatever runtime the package brings with it. One run, one version, one machine: there is no second run, so there is no spread to quote and the figure carries no error bar.

setpriv in that list is the harness's own launcher, not the package's doing.

Tools it offers, against its own README

It offered 278 tools. 212 of them are named in README.md.

66 tools it offered are not:

Websites it reached for, against its own README

It reached for no website at startup.

The README uses the word "analytics" — README.md line 331; it reads | 'get_project_page_insights' | Visitor analytics for a published project page: visitors, active time, scroll depth, story reach, clicks, copies, sources, countries, most-opened media |. Stated here because it is in the document. This report does not decide whether it accounts for the websites above.

Names in the README that it did not offer

43 names written in backticks in the README look like a tool name and were not among the tools it offered. A README mentions plenty of things that are not tools, so this is a weaker signal than the two above and is listed rather than counted as a finding:

What this report does not say

Evidence: README.md (384 lines, sha256 e02354593456), package integrity sha512-DXMVIWcQEouQQ1Fc1….

The badge for this measurement

<img class="badge" src="/b/kolbo--mcp.svg" alt="BRYDGE level 1, measured 2026-11-02" width="251" height="20">

It states that a measurement happened and when — not a verdict, not a score, and no colour that means anything. It links to this page, where the limits are. Anyone may use it; nobody needs permission, and nobody can buy a different one.

<div class="snippet">![BRYDGE level 1, measured 2026-11-02](https://mcp.brydge-ai.com/s/kolbo--mcp.html)</div>

The badge is regenerated when the package is measured again, so an old badge in a README cannot show a date that has moved on.

All measurementsHow we measurePaste your configRequest a measurementGet an alertPricingHarness and raw evidenceBRYDGE’s calibrated measurements

Something on this page wrong? Email contact@brydge-ai.com, or open an issue. Corrections are free, and the correction is recorded.