
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
askedthrice-mcp
Advanced tools
MCP server for askedthrice.com: measure whether AI assistants actually recommend a brand. stdio bridge to the hosted server, for clients that launch local commands.
MCP server for askedthrice.com. Ask your assistant whether a brand actually shows up when buyers ask AI for a recommendation, and get the measured answer: which buyer questions the brand won, which competitors were named instead, and which providers answered.
Free, no signup, no API key. One measurement per domain every 30 days.
Most clients accept the hosted endpoint directly. Use that when you can:
{"mcpServers":{"askedthrice":{"url":"https://mcp.askedthrice.com/mcp"}}}
Claude Code:
claude mcp add --transport http askedthrice https://mcp.askedthrice.com/mcp
For clients that only launch a local command (the Claude Desktop config file, for example), this package bridges stdio to the same server:
{"mcpServers":{"askedthrice":{"command":"npx","args":["-y","askedthrice-mcp"]}}}
Requires Node 18+. Nothing runs locally except the bridge: the measurement happens on the server, which holds the provider keys.
start_visibility_check: starts a measurement for a brand (name, website, category, optional competitors, location and language) and returns a runId. Takes about a minute, because the buyer questions are asked live to OpenAI, Anthropic and Gemini.get_visibility_check: collects the result with the runId. Returns running until the providers answer, then a verdict in three bands and the counts.askedthrice://methodology: how the measurement works.Try it: "Measure how Acme (acme.com), a project management tool, shows up in AI recommendations against Asana and Monday."
It returns the measured map: the buyer questions that were actually asked and who won each answer. It never returns a provider's self report (what a model believes about a brand), because in practice that number is the optimistic one and can be off by an order of magnitude. There is no 0 to 100 score either: a verdict in three bands and counts you can check.
There is no email field. The tool cannot send a result email to anyone.
ASKEDTHRICE_MCP_URL: override the endpoint (staging).Server code, tests and fixtures: github.com/nahuelsoria/llmaudit-mcp. Developer docs: askedthrice.com/developers.
FAQs
MCP server for askedthrice.com: measure whether AI assistants actually recommend a brand. stdio bridge to the hosted server, for clients that launch local commands.
The npm package askedthrice-mcp receives a total of 7 weekly downloads. As such, askedthrice-mcp popularity was classified as not popular.
We found that askedthrice-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.