Home / MCP registry index / dev.upfork/upfork
UpFork
dev.upfork/upfork in the official MCP registry.
Endpoint https://upfork.dev/mcp.
The registry describes it as: Search, view and install React + Tailwind CSS components and landing pages from UpFork.
We read its 38 tools on 2026-10-28. Nothing in them matched our tool-poisoning rules. It also sets server instructions, text a client puts in front of the model on connect; those were read too.
A clean read means these rules found nothing, not that the server is harmless. A server can change its tools at any time, which is why the index reads it again every week.
Tools it advertises
answer_ticket withdraw_article update_profile my_profile dispute_lesson my_lesson_drafts install_product buy_link get_prompt article_guide make_resume draft_team_lesson get_guide delete_article search_lessons create_article get_my_article draft_lesson my_account confirm_lesson add_article_image team_lessons preflight my_tickets support_inbox reply_to_ticket view_product search_articles read_ticket read_article publish_article hide_article read_product_file search_products my_articles open_ticket update_article get_lesson
Run this server? Show the check in your README
The badge reflects the latest weekly read: 
[](https://lazaretto.dev/mcp-registry/dev-upfork-upfork)How this was checked
Lazaretto connects to the endpoint the way any MCP client does, asks the server to introduce itself and list its tools, and reads every name, description, parameter schema and server instruction for tool poisoning: hidden directive blocks, orders to read local secrets, parameters built to carry secrets or the conversation out, orders that redirect another server's tools, and invisible characters. It never calls a tool. What we found across the registry.
To run the same check every time Claude Code adds a server, install the free lazaretto-guard plugin. Browse every server in the index.