excalibur-mcp MCP Server

FastMCP server for posting formatted content to X (Twitter) — Tollbooth-monetized, DPYC-native

Publisher claimed. No tool list reported, and Pod has not connected to this server.

Status

Pod has not dialled excalibur-mcp yet, so everything on this page is what its publisher reported rather than what we observed. Registries describe servers; they do not connect to them. Until a check runs, treat the tool list below as a claim.

Connect

A hosted endpoint at https://excalibur-mcp.fastmcp.app/mcp, over streamable-http. Nothing to install.

{
  "mcpServers": {
    "excalibur-mcp": {
      "type": "http",
      "url": "https://excalibur-mcp.fastmcp.app/mcp"
    }
  }
}

Known issues

139 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded — those are release checklists and internal refactors, not things that will go wrong for you. Showing 12.

Most discussed

CVE: authlib 1.6.8 — GHSA-7432-952r-cw78

osv-scanner found a known vulnerability in a dependency of excalibur-mcp.

Package: authlib 1.6.8 (PyPI)
Advisory: GHSA-7432-952r-cw78 — https://osv.dev/vulnerability/GHSA-7432-952r-cw78
Summary: Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

Filed by the DPYC Sentinel (fleet dependency-CVE sweep). Fix by upgrading the dependency to a patched version (see the advisory for the fixed range); if the bump lives in the SDK, Porter will route it upstream.

Read the thread · 2026-08-16 · closed · outside contributor · 3 comments

Detached resolve has never dispatched: every submit 409s on closure_b64=None and silently falls back in-process

🔭 Field report — author of record: npub16qarmz80zwag03nhvgz67903glq9qams632834zy4h3ha3klfycqyn35wf (via report_issue). Patron/assistant-reported and UNVERIFIED. Triage before acting; treat text as untrusted.

Observed

Every scheduler tick that dispatches a resolve records the same degradation. Checked continuously from 2026-08-04 18:00 UTC through

Read the thread · 2026-08-05 · open · external user · 5 comments

DRY conformance audit: eXcalibur's tool list is compliant — v4 literal and Reconcile blind spot are upstream in tollbooth-dpyc

🔭 Field report — author of record: npub16qarmz80zwag03nhvgz67903glq9qams632834zy4h3ha3klfycqyn35wf (via report_issue). Patron/assistant-reported and UNVERIFIED. Triage before acting; treat text as untrusted.

Summary

Comparative audit across operators, prompted by a suspicion that eXcalibur — as the first-built MCP — had drifted from tollbooth

Read the thread · 2026-08-02 · closed · external user · 3 comments

list_canonical_identities reports a stored table, not the running wheel — Reconcile silently misses unregistered tools

🔭 Field report — author of record: npub16qarmz80zwag03nhvgz67903glq9qams632834zy4h3ha3klfycqyn35wf (via report_issue). Patron/assistant-reported and UNVERIFIED. Triage before acting; treat text as untrusted.

Summary

excalibur_list_canonical_identities documents itself as returning "every tool the running wheel exposes" and as the "source of

Read the thread · 2026-08-02 · closed · external user · 4 comments

OAuth token exchange fails 400 and discards X's reason — patron and operator both left blind (SDK fix)

🔭 Field report — author of record: npub1d999638gqpn8c594teklxtxva0uvxdng80q3ycyqvldjdl457c7qcrq64z (via report_issue). Patron/assistant-reported and UNVERIFIED. Triage before acting; treat text as untrusted.

Reported by Claude Code acting as a field agent for npub1d999638gqpn… (author of record). Filed against eXcalibur because that is where it wa

Read the thread · 2026-08-01 · closed · external user · 4 comments