Mcp Server MCP Server
https://dchub.cloud/mcp
Remote
v2.12.7
Published by dchub.cloud — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
Data center intelligence: 20,000+ facilities, M&A deals, site scoring, and market analytics.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 6 = 94. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 2
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: export_dataset → list_saved_sites → set_market_alert. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow export_dataset → list_saved_sites → set_market_alert
medium Unconstrained URL/host parameter "webhook_url" on "standing_intent"MTC-CAP-007
Tool "standing_intent" takes a URL/host parameter "webhook_url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).
Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.
Location: tool standing_intent · inputSchema.properties.webhook_url
Tools 83
Each tool and what it can reach — enumerated from the running server.
export_datasetingests untrusted inputreads sensitive datalist_saved_sitesingests untrusted inputreads sensitive datasave_siteingests untrusted inputreads sensitive datafetchingests untrusted inputgenerate_site_analysisingests untrusted inputplan_queryingests untrusted inputresearch_taskingests untrusted inputset_market_alertnetwork egressset_shortlist_alertnetwork egressstanding_intentnetwork egress
Show 73 more tools ↓
ai_capacity_indexno sensitive capabilityanalyze_parcelno sensitive capabilityanalyze_siteno sensitive capabilitybind_emailno sensitive capabilityclaim_free_keyno sensitive capabilitycluster_sites_by_latencyno sensitive capabilitycompare_isosno sensitive capabilitycompare_sitesno sensitive capabilitydeal_autopsyno sensitive capabilitydiscover_toolsno sensitive capabilityexecute_planno sensitive capabilityfind_alternativesno sensitive capabilityget_agent_registryno sensitive capabilityget_backup_statusno sensitive capabilityget_changesno sensitive capabilityget_climate_intelno sensitive capabilityget_composite_site_scoreno sensitive capabilityget_dchub_recommendationno sensitive capabilityget_disaster_riskno sensitive capabilityget_energy_pricesno sensitive capabilityget_facilityno sensitive capabilityget_facility_risk_deltano sensitive capabilityget_fiber_intelno sensitive capabilityget_fiber_readinessno sensitive capabilityget_gas_economicsno sensitive capabilityget_gas_indexno sensitive capabilityget_gas_intelligenceno sensitive capabilityget_global_powerno sensitive capabilityget_grid_datano sensitive capabilityget_grid_intelligenceno sensitive capabilityget_grid_scoreboardno sensitive capabilityget_hosting_capacityno sensitive capabilityget_infrastructureno sensitive capabilityget_intelligence_indexno sensitive capabilityget_interconnection_queueno sensitive capabilityget_iso_contextno sensitive capabilityget_market_contextno sensitive capabilityget_market_dcpi_rankno sensitive capabilityget_market_intelno sensitive capabilityget_metro_fiberno sensitive capabilityget_newsno sensitive capabilityget_permitting_intelno sensitive capabilityget_pipelineno sensitive capabilityget_power_availability_timelineno sensitive capabilityget_power_pipelineno sensitive capabilityget_refined_queueno sensitive capabilityget_renewable_energyno sensitive capabilityget_retirement_headroomno sensitive capabilityget_shortlistno sensitive capabilityget_tax_incentivesno sensitive capabilityget_water_riskno sensitive capabilitygrid_transition_radarno sensitive capabilityhyperscaler_dealsno sensitive capabilitylist_transactionsno sensitive capabilityplan_fiber_leadinno sensitive capabilitypredict_market_trajectoryno sensitive capabilityrank_marketsno sensitive capabilityrank_sitesno sensitive capabilityrecover_my_keyno sensitive capabilitysave_to_shortlistno sensitive capabilityscore_facilityno sensitive capabilitysearchno sensitive capabilitysearch_facilitiesno sensitive capabilitysearch_intelligenceno sensitive capabilitysemantic_searchno sensitive capabilityset_site_alertno sensitive capabilitysimulate_scenariono sensitive capabilitysite_selection_canvasno sensitive capabilitysubscribe_digestno sensitive capabilitysuggest_reallocationno sensitive capabilitysummarize_for_citationno sensitive capabilityunlock_more_datano sensitive capabilitywhy_dchubno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
Versions 9
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v2.12.7 latest |
A 94/100 | 2 | 1.13.0 | 2026-09-06 |
v2.12.3 |
A 94/100 | 2 | 1.13.0 | 2026-09-01 |
v2.12.1 |
A 94/100 | 2 | 1.13.0 | 2026-08-31 |
v2.12.0 |
A 94/100 | 2 | 1.13.0 | 2026-08-30 |
v2.11.1 |
A 94/100 | 2 | 1.12.1 | 2026-08-12 |
Show 4 more versions ↓
v2.10.0 |
A 94/100 | 2 | 1.12.1 | 2026-08-01 |
v2.9.3 |
A 94/100 | 2 | 1.12.1 | 2026-07-31 |
v2.9.1 |
A 94/100 | 2 | 1.10.0 | 2026-07-27 |
v2.5.0 |
A 94/100 | 2 | 1.10.0 | 2026-07-25 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan https://dchub.cloud/mcp --onlineMore in Analytics & Monitoring
Public-safe MCP admin discovery contract descriptors and response builders.
Pokemon Champions battle advisor MCP server
Airflow MCP server — DAG list, runs, task instances, log tails, trigger and clear over the Airflow REST API
MCP analytics wrapper SDK that instruments MCP tool declarations with telemetry.
AI-ready GIS, geofencing, DataSynch, CRM, inventory, routing, APIs, telemetry and workflows.
AI-native social listening. Monitor buying signals and run GTM workflows via natural language.