https://contabo.run.mcp.com.ai/mcp
Remote
v0.6.0
Published by contabo.run.mcp.com.ai — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
Contabo API (v1.0.0) as MCP tools for cloud provisioning, and management. Powered by HAPI MCP server
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 6 = 94. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
This server (without client built-ins) exposes a complete data-exfiltration chain: createCustomImage → retrieveSecretList → resendEmailVerification. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow createCustomImage → retrieveSecretList → resendEmailVerification
Each tool and what it can reach — enumerated from the running server.
createCustomImageingests untrusted inputresendEmailVerificationnetwork egressretrieveImageingests untrusted inputretrieveSecretListreads sensitive dataassignInstancePrivateNetworkno sensitive capabilityassignIpno sensitive capabilitybulkDeleteDnsZoneRecordsno sensitive capabilitycancelDomainno sensitive capabilitycancelInstanceno sensitive capabilityCancelObjectStorageno sensitive capabilityconfirmDomainTransferOutno sensitive capabilitycreateAssignmentno sensitive capabilitycreateDnsZoneno sensitive capabilitycreateDnsZoneRecordno sensitive capabilitycreateHandleno sensitive capabilitycreateInstanceno sensitive capabilitycreateObjectStorageno sensitive capabilitycreatePrivateNetworkno sensitive capabilitycreatePtrRecordno sensitive capabilitycreateRoleno sensitive capabilitycreateSecretno sensitive capabilitycreateSnapshotno sensitive capabilitycreateTagno sensitive capabilitycreateUserno sensitive capabilitydeleteAssignmentno sensitive capabilitydeleteDnsZoneno sensitive capabilitydeleteDnsZoneRecordno sensitive capabilitydeleteImageno sensitive capabilitydeletePrivateNetworkno sensitive capabilitydeletePtrRecordno sensitive capabilitydeleteRoleno sensitive capabilitydeleteSecretno sensitive capabilitydeleteSnapshotno sensitive capabilitydeleteTagno sensitive capabilitydeleteUserno sensitive capabilitygenerateClientSecretno sensitive capabilitygetAuthCodeno sensitive capabilitygetObjectStorageCredentialsno sensitive capabilitylistDomainsno sensitive capabilitylistHandlesno sensitive capabilitylistObjectStorageCredentialsno sensitive capabilityorderDomainno sensitive capabilitypatchInstanceno sensitive capabilitypatchPrivateNetworkno sensitive capabilityregenerateObjectStorageCredentialsno sensitive capabilityreinstallInstanceno sensitive capabilityremoveHandleno sensitive capabilityrescueno sensitive capabilityresetPasswordno sensitive capabilityresetPasswordActionno sensitive capabilityrestartno sensitive capabilityretrieveApiPermissionsListno sensitive capabilityretrieveAssignmentno sensitive capabilityretrieveAssignmentListno sensitive capabilityretrieveAssignmentsAuditsListno sensitive capabilityretrieveCustomImagesStatsno sensitive capabilityretrieveDataCenterListno sensitive capabilityretrieveDnsZoneno sensitive capabilityretrieveDnsZoneRecordsListno sensitive capabilityretrieveDnsZonesListno sensitive capabilityretrieveDomainno sensitive capabilityretrieveDomainsAuditsListno sensitive capabilityretrieveHandleno sensitive capabilityretrieveHandlesAuditsListno sensitive capabilityretrieveImageAuditsListno sensitive capabilityretrieveImageAuditsList1no sensitive capabilityretrieveImageListno sensitive capabilityretrieveInstanceno sensitive capabilityretrieveInstancesActionsAuditsListno sensitive capabilityretrieveInstancesAuditsListno sensitive capabilityretrieveInstancesListno sensitive capabilityretrieveObjectStorageno sensitive capabilityretrieveObjectStorageAuditsListno sensitive capabilityretrieveObjectStorageListno sensitive capabilityretrieveObjectStoragesStatsno sensitive capabilityretrievePrivateNetworkno sensitive capabilityretrievePrivateNetworkAuditsListno sensitive capabilityretrievePrivateNetworkListno sensitive capabilityretrievePtrRecordno sensitive capabilityretrievePtrRecordsListno sensitive capabilityretrieveRecordAuditsListno sensitive capabilityretrieveRoleno sensitive capabilityretrieveRoleAuditsListno sensitive capabilityretrieveRoleListno sensitive capabilityretrieveSecretno sensitive capabilityretrieveSecretAuditsListno sensitive capabilityretrieveSnapshotno sensitive capabilityretrieveSnapshotListno sensitive capabilityretrieveSnapshotsAuditsListno sensitive capabilityretrieveTagno sensitive capabilityretrieveTagAuditsListno sensitive capabilityretrieveTagListno sensitive capabilityretrieveUserno sensitive capabilityretrieveUserAuditsListno sensitive capabilityretrieveUserClientno sensitive capabilityretrieveUserIsPasswordSetno sensitive capabilityretrieveUserListno sensitive capabilityretrieveVipno sensitive capabilityretrieveVipAuditsListno sensitive capabilityretrieveVipListno sensitive capabilityrevokeCancelDomainno sensitive capabilityrevokeDomainTransferOutno sensitive capabilityrollbackSnapshotno sensitive capabilitysetDefaultHandleno sensitive capabilityshutdownno sensitive capabilitystartno sensitive capabilitystopno sensitive capabilitytool_searchno sensitive capabilityunassignInstancePrivateNetworkno sensitive capabilityunassignIpno sensitive capabilityupdateDnsZoneRecordno sensitive capabilityupdateDomainno sensitive capabilityupdateHandleno sensitive capabilityupdateImageno sensitive capabilityupdateObjectStorageno sensitive capabilityupdatePtrRecordno sensitive capabilityupdateRoleno sensitive capabilityupdateSecretno sensitive capabilityupdateSnapshotno sensitive capabilityupdateTagno sensitive capabilityupdateUserno sensitive capabilityupgradeInstanceno sensitive capabilityupgradeObjectStorageno sensitive capabilityvalidateDomainAvailabilityno sensitive capabilityCross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.6.0 latest |
A 94/100 | 1 | 1.13.0 | 2026-09-06 |
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan https://contabo.run.mcp.com.ai/mcp --online
A Model Context Protocol server implementation for AdGuard Home that enables AI agents to query and manage DNS records, filtering rules and more
Identity oracle and trust layer for autonomous AI agents. Bidirectional KYA and trust scoring.
MCP server with Airtable integration
A free one-minute reset for people, delivered by AI, with no account or personal data.
Access SEC filings efficiently, save time and tokens, and get cited answers.
A smart [MCP](https://modelcontextprotocol.io) server for [AniList](https://anilist.co) that gets your anime/manga taste - not just API calls.