SERVICE / DETAILother

MCP Server Risk Analyzer

POST hermesplant.com/api/agent-services/mcp-risk/score

OPEN SERVICE ↗
SONAR SCORE0.000
LIVE PRICE0.050000
BAZAAR LIVE—
CDP INDEXEDno
DECISION EVIDENCE

Why an agent can trust this route.

No recent observations
HANDSHAKE SUCCESS0.0%402 challenge reachable
PAID DELIVERY0.0%settlement observed
P90 LATENCY—recent response window
PRICE DRIFT—advertised vs observed

Sonar evidence is advisory. Paid delivery is shown as verified only when paid probes are available; otherwise route estimates use the unpaid handshake as a clearly labeled proxy.

SONAR PROBE HISTORY / 30D

Observed outcomes

JSON ↗
No probe history yet.
LIVE ENDPOINT METADATA

Analyze an MCP server manifest for security risk before install — destructive actions, over-broad scopes, sensitive-data egress, weak auth, prompt-injection surface, and permission diff. Returns per-tool, per-factor findings with severity, why, and a concrete fix (not just a score).

Resource: hermesplant.com/api/agent-services/mcp-risk/score

Network: eip155:8453 · Asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 · Pay to: 0x5171C72a59b994a80097b6ab52D4A4FcB8BF4c1B

Payment methods: — · Last validation: —

{
  "input": {
    "body": {
      "tools": [
        {
          "name": "delete_path",
          "scopes": [
            "fs:*"
          ],
          "description": "Recursively delete any path on the filesystem",
          "inputSchema": {
            "properties": {
              "path": {
                "type": "string"
              }
            }
          }
        },
        {
          "name": "read_env_and_post",
          "network": true,
          "description": "Read environment secrets and upload to a webhook URL"
        }
      ],
      "server": "github.com/acme/mcp-filesystem",
      "authModel": "none"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "risk": "critical",
      "status": "scored",
      "service": "mcp-risk-score",
      "byFactor": {
        "weak-auth": 1,
        "over-broad-scope": 1,
        "sensitive-egress": 1,
        "destructive-action": 1
      },
      "requestId": "mcp_<uuid>",
      "findingsCount": 5,
      "requiresApproval": true,
      "recommendedAction": "block_install_until_scoped_and_approved"
    }
  },
  "paymentRequirements": [
    {
      "raw": {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x5171C72a59b994a80097b6ab52D4A4FcB8BF4c1B",
        "amount": "50000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      },
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "payTo": "0x5171C72a59b994a80097b6ab52D4A4FcB8BF4c1B",
      "scheme": "exact",
      "network": "eip155:8453",
      "amountAtomic": "50000"
    }
  ]
}
METADATA PROVENANCE

Source catalog records are retained separately from live endpoint observations. Sonar score, uptime, and latency are advisory metrics. CDP indexing is not inferred from validation.