
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
overwing-mcp
Advanced tools
Overwing MCP server: guardrails for LLM output. Score any text for safety, quality and compliance and get pass / fail / review verdicts with calibrated confidence, from any MCP-capable agent. Plus Overwing Atlas: identify any User-Agent string against a r
Guardrails for LLM output, as MCP tools.
Score any text for safety, quality and compliance. Get pass / fail / review verdicts with calibrated confidence in under 500 ms.
Overwing is an API that checks what your model said before it ships. This package exposes it to any MCP-capable agent: Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, OpenAI's Agents SDK, and anything else that speaks the Model Context Protocol.
fail means a rule matched; review means it was unsure; pass means neither.content-safety rule set: toxicity, personal data, self-harm, sexual content, severity. Or write your own rules in plain language.Try it without installing anything: paste text into the console at overwing.ai.
You need an API key. Get one at overwing.ai/login, or let your agent sign itself up:
curl -X POST https://overwing.ai/api/v1/signup \
-H "Content-Type: application/json" \
-d '{"email":"you@example.com","password":"at-least-12-chars"}'
Claude Code
claude mcp add overwing -e OVERWING_API_KEY=ow_live_... -- npx -y overwing-mcp
Claude Desktop, Cursor, Windsurf, VS Code (any JSON-configured client)
{
"mcpServers": {
"overwing": {
"command": "npx",
"args": ["-y", "overwing-mcp"],
"env": { "OVERWING_API_KEY": "ow_live_..." }
}
}
}
Set OVERWING_BASE_URL to point at a self-hosted deployment. Requires Node 20+.
| Tool | What it does |
|---|---|
evaluate | Score one text against a rule set. Returns the verdict, a recommended_action (block, redact, review, or allow), aggregate score, confidence, latency, and per-rule results with each rule's action. Takes an optional context object (recipient, channel, ownership) that context-aware rule sets such as outbound-message read. |
evaluate_batch | Score up to 50 texts in one call, with a summary and per-item verdicts and recommended actions. |
list_rule_sets · get_rule_set · create_rule_set | Browse the prebuilt set or define your own rules: yes/no questions, classifications, or scored scales. |
get_evaluation · list_evaluations | Read stored results, filter by verdict or rule set, page with a cursor. |
atlas_lookup | Overwing Atlas: say what a User-Agent string claims to be and whether the claim can be trusted (Web Bot Auth, spoofable string, or unattributable). 100 free a day. |
atlas_agents · atlas_summary | Search the registry of 241 AI crawlers, fetchers and browser agents; get traffic shares, sector field-scan headlines, and the agent-spending summary. |
get_usage · whoami · list_plans | Today's quota, the org behind the key, and the public plan catalog. |
The overwing://guide resource returns the full plain-text API guide.
Ask your agent:
Check this reply before I send it: "Reach me at dana@example.com or 555-0142 to sort out the refund."
It calls evaluate and gets back:
Verdict: FAIL score=0.82 confidence=0.97 251ms
toxicity: pass (answer="safe", confidence=1)
pii_detected: fail (answer=true, confidence=0.98)
self_harm: pass (answer=false, confidence=1)
sexual_content: pass (answer="none", confidence=1)
severity: pass (answer=0.03, confidence=0.97)
Each rule has a fail condition, an optional review threshold, and a weight.
Every rule also carries an action (block, redact, or review), and the response rolls them up into one recommended_action: block beats redact beats review beats allow. Branch on that field. Pass a context object (recipient, channel, owns_contact_info) with the outbound-message rule set and its rules read it, so a customer's own phone number in a reply to that customer is not flagged.
aggregate_score is 0 to 1 (pass = 1, review = 0.5, fail = 0 per rule, weighted). confidence is the minimum across rules.
Free: 250 evaluations a day. Paid plans from $29/month. Every plan includes every endpoint, custom rule sets, webhooks, and the dashboard. Full details at overwing.ai/#pricing or GET https://overwing.ai/api/v1/plans.
npm install
npm run build
OVERWING_API_KEY=ow_live_... node dist/index.js
MIT © Overwing. Verdicts are produced by TypeSafe's Jev System One model; Overwing is not affiliated with TypeSafe.
FAQs
Overwing MCP server: guardrails for LLM output. Score any text for safety, quality and compliance and get pass / fail / review verdicts with calibrated confidence, from any MCP-capable agent. Plus Overwing Atlas: identify any User-Agent string against a r
We found that overwing-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.