BorealHost MCP Server
https://borealhost.ai/mcp
Remote
v1.27.0
Published by borealhost.ai — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
Agent-native web hosting — deploy sites, manage DNS, register domains, scale infrastructure
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 6 = 94. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 13
high Sensitive-source and external-sink co-existMTC-FLOW-004
Tools that read sensitive data ([list_files, read_file, execute_query, get_logs]) and tools that can send data out ([upload_file, add_cron, create_alert_rule, set_site_nginx_snippet, create_webhook, delete_webhook, test_webhook]) are exposed together. An agent can move private data to the sink.
Evidence: sources [list_files, read_file, execute_query, get_logs] → sinks [upload_file, add_cron, create_alert_rule, set_site_nginx_snippet, create_webhook, delete_webho
Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.
Location: flow list_files → upload_file
high Tool "add_cron" exposes command/code executionMTC-CAP-001
Tool "add_cron" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool add_cron
medium Unconstrained URL/host parameter "url" on "create_webhook"MTC-CAP-007
Tool "create_webhook" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).
Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.
Location: tool create_webhook · inputSchema.properties.url
medium Tool "write_file" can modify the filesystemMTC-CAP-002
Tool "write_file" can write, overwrite or delete files (keyword "write_file" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool write_file
medium Tool "delete_file" can modify the filesystemMTC-CAP-002
Tool "delete_file" can write, overwrite or delete files (keyword "delete_file" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool delete_file
medium Unconstrained command parameter "command" on "add_cron"MTC-CAP-006
Tool "add_cron" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool add_cron · inputSchema.properties.command
low Mutating tool "write_file" declares no destructiveHintMTC-CAP-005
Tool "write_file" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool write_file
low Mutating tool "delete_file" declares no destructiveHintMTC-CAP-005
Tool "delete_file" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool delete_file
low Mutating tool "add_cron" declares no destructiveHintMTC-CAP-005
Tool "add_cron" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool add_cron
low Unconstrained path parameter "path" on "list_files"MTC-CAP-008
Tool "list_files" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool list_files · inputSchema.properties.path
low Unconstrained path parameter "path" on "read_file"MTC-CAP-008
Tool "read_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool read_file · inputSchema.properties.path
low Unconstrained path parameter "path" on "write_file"MTC-CAP-008
Tool "write_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool write_file · inputSchema.properties.path
low Unconstrained path parameter "path" on "delete_file"MTC-CAP-008
Tool "delete_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool delete_file · inputSchema.properties.path
Tools 152
Each tool and what it can reach — enumerated from the running server.
add_cronruns code / shellcreate_alert_rulenetwork egresscreate_webhooknetwork egressdelete_filewrites filesdelete_webhooknetwork egressexecute_queryreads sensitive dataget_logsreads sensitive datalist_filesreads sensitive dataread_filereads sensitive dataset_site_nginx_snippetnetwork egress
Show 142 more tools ↓
test_webhooknetwork egressupload_filenetwork egresswrite_filewrites filesadd_domain_dnsno sensitive capabilityadd_firewall_ruleno sensitive capabilityadd_redirectno sensitive capabilityadd_siteno sensitive capabilityadd_ssh_keyno sensitive capabilityadd_subdomainno sensitive capabilityadopt_compute_instanceno sensitive capabilityattach_compute_volumeno sensitive capabilitycache_flushno sensitive capabilitycache_statusno sensitive capabilitycache_toggleno sensitive capabilitycancel_checkoutno sensitive capabilitycancel_scheduled_snapshotno sensitive capabilityclaim_api_keyno sensitive capabilitycloudflare_proxy_statusno sensitive capabilitycloudflare_purge_cacheno sensitive capabilitycloudflare_set_proxyno sensitive capabilitycomplete_checkoutno sensitive capabilitycontainer_actionno sensitive capabilitycreate_api_keyno sensitive capabilitycreate_b2_snapshotno sensitive capabilitycreate_backupno sensitive capabilitycreate_checkoutno sensitive capabilitycreate_compute_volumeno sensitive capabilitycreate_directoryno sensitive capabilitycreate_ftp_accountno sensitive capabilitycreate_mailboxno sensitive capabilitycreate_snapshotno sensitive capabilitycreate_support_ticketno sensitive capabilitydatabase_search_replaceno sensitive capabilitydecommissionno sensitive capabilitydelete_accountno sensitive capabilitydelete_alert_ruleno sensitive capabilitydelete_backupno sensitive capabilitydelete_compute_volumeno sensitive capabilitydelete_cronno sensitive capabilitydelete_domain_dnsno sensitive capabilitydelete_mailboxno sensitive capabilitydelete_redirectno sensitive capabilitydelete_snapshotno sensitive capabilitydelete_subdomainno sensitive capabilitydetach_compute_volumeno sensitive capabilitydomain_detailno sensitive capabilitydomain_settingsno sensitive capabilityenable_smtp_relayno sensitive capabilityenable_wildcardno sensitive capabilityget_app_statusno sensitive capabilityget_backup_retentionno sensitive capabilityget_billing_portalno sensitive capabilityget_checkout_statusno sensitive capabilityget_compute_instanceno sensitive capabilityget_compute_volumeno sensitive capabilityget_database_infono sensitive capabilityget_email_statusno sensitive capabilityget_metricsno sensitive capabilityget_resource_snapshotno sensitive capabilityget_site_nginx_snippetno sensitive capabilityget_site_statusno sensitive capabilityget_smtp_relayno sensitive capabilityget_snapshot_usageno sensitive capabilityget_ssh_infono sensitive capabilityget_stack_infono sensitive capabilityget_support_ticketno sensitive capabilityget_walletno sensitive capabilityget_webmail_urlno sensitive capabilityinstall_appno sensitive capabilitylaunch_compute_instanceno sensitive capabilitylink_domainno sensitive capabilitylist_alert_rulesno sensitive capabilitylist_api_keysno sensitive capabilitylist_appsno sensitive capabilitylist_backupsno sensitive capabilitylist_checkoutsno sensitive capabilitylist_compute_imagesno sensitive capabilitylist_compute_instancesno sensitive capabilitylist_compute_typesno sensitive capabilitylist_compute_volumesno sensitive capabilitylist_cronno sensitive capabilitylist_databasesno sensitive capabilitylist_db_usersno sensitive capabilitylist_domain_dnsno sensitive capabilitylist_domainsno sensitive capabilitylist_firewall_rulesno sensitive capabilitylist_ftp_accountsno sensitive capabilitylist_modulesno sensitive capabilitylist_php_versionsno sensitive capabilitylist_plansno sensitive capabilitylist_pluginsno sensitive capabilitylist_redirectsno sensitive capabilitylist_snapshotsno sensitive capabilitylist_subdomainsno sensitive capabilitylist_subscriptionsno sensitive capabilitylist_support_ticketsno sensitive capabilitylist_tablesno sensitive capabilitylist_themesno sensitive capabilitylist_webhooksno sensitive capabilitymanage_db_userno sensitive capabilitymanage_dnsno sensitive capabilitymanage_pluginno sensitive capabilitymanage_themeno sensitive capabilityoptimize_databaseno sensitive capabilityreboot_compute_instanceno sensitive capabilityregisterno sensitive capabilityregister_domainno sensitive capabilityremove_firewall_ruleno sensitive capabilityremove_ftp_accountno sensitive capabilityreply_support_ticketno sensitive capabilityrequest_api_keyno sensitive capabilityreset_mailbox_passwordno sensitive capabilityrestore_backupno sensitive capabilityrevoke_api_keyno sensitive capabilityrevoke_smtp_relayno sensitive capabilityrollback_snapshotno sensitive capabilityrotate_keyno sensitive capabilityrun_malware_scanno sensitive capabilityscaleno sensitive capabilityschedule_snapshotno sensitive capabilitysearch_domainno sensitive capabilityset_api_keyno sensitive capabilityset_backup_retentionno sensitive capabilityset_domain_usageno sensitive capabilityset_force_httpsno sensitive capabilityset_site_typeno sensitive capabilitysetup_emailno sensitive capabilitysnapshot_compute_volumeno sensitive capabilityssl_infono sensitive capabilityssl_renewno sensitive capabilitystart_compute_instanceno sensitive capabilitystop_compute_instanceno sensitive capabilityswitch_phpno sensitive capabilityterminate_compute_instanceno sensitive capabilitytoggle_moduleno sensitive capabilitytransfer_out_domainno sensitive capabilityupdate_accountno sensitive capabilityupdate_checkoutno sensitive capabilityupload_ssl_certno sensitive capabilitywhoamino sensitive capabilitywp_check_updatesno sensitive capabilitywp_update_allno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.27.0 latest |
A 94/100 | 13 | 1.13.0 | 2026-09-06 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan https://borealhost.ai/mcp --onlineMore in Cloud & DevOps
Operator control CLI for AdGuard Home with an MCP adapter
interacting with Aliyun (Alibaba Cloud) services through This MCP server provides tools.
MCP server for the Aspro.Cloud REST API
MCP server for Atlassian Confluence and Jira Cloud APIs
AuroraCloud-first MCP server that exposes AuroraDocs workspace data to Claude Desktop and other AI agents
The official AWS Knowledge Base retrieval server using Bedrock Agent Runtime.