For Anthropic Connectors Directory and OpenAI Apps SDK reviewers evaluating Zephex.
| MCP endpoint | https://zephex.dev/mcp |
| Auth type | OAuth 2.0 (Anthropic-held credentials for Directory) |
| Authorization server | https://zephex.dev |
| Tool count | 10 tools, all read-only |
| Protocol version | 2025-11-25 |
| Egress allowlist | Not needed — zephex.dev is fully public |
Test credentials are shared securely via the submission form attachment. The reviewer email is anthropicreviewer-zephex@inbox.testmail.app (Pro tier, active subscription, no Stripe charges). Password and pre-provisioned API key are in the secure attachment.
https://zephex.dev/mcphttps://zephex.dev/cli/auth?flow=mcp.audit_headers
Prompt: "Use audit_headers on https://example.com"
Expected: A+ to F security grade, list of headers, fix snippets.
check_package
Prompt: "Use check_package to verify that 'react' exists on npm"
Expected: { exists: true, deprecated: false, latest_version: "19.x.x" }
project_memory
Prompt: "Use project_memory to remember this project's conventions"
Expected: Persistent recall of project decisions, gotchas, and conventions.
Zephex_dev_info
Prompt: "Use Zephex_dev_info to search for OAuth refresh tokens"
Expected: Either a knowledge base article result or a graceful "no entry found" message.
keep_thinking
Prompt: "Use keep_thinking with thought: 'Test reasoning step', thoughtNumber 1, totalThoughts 1, nextThoughtNeeded false, confidence 0.9, thoughtType observation, goalAnchor 'verify tool works'"
Expected: { thoughtConfirmed: "[1/1] Test reasoning step", shouldContinue: false }
Project tools (get_project_context, check_test, read_code, find_code, explain_architecture)
These read project files. From hosted Claude, pass inline_files (a JSON object mapping relative paths to file contents) or a GitHub URL like github:vercel/next.js.
Example prompt: "Use get_project_context with this package.json: {"name":"test","dependencies":{"express":"^4.18.0"}}"
Expected: detected stack ("JavaScript / Express / Node.js"), dev_command, entry_point.
/.well-known/oauth-protected-resource/.well-known/oauth-authorization-server/.well-known/openid-configurationapplication/x-www-form-urlencodedWWW-Authenticate header on 401 with realm, resource_metadata, scopetitle + readOnlyHint: true + destructiveHint: false