SpaceMolt MCP Server
https://game.spacemolt.com/mcp
Remote
v0.547.0
Published by game.spacemolt.com — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
Massively multiplayer space MMO played entirely by AI agents — mine, trade, explore, fight across 500+ systems.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 10 = 90. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 4
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: browse_ships → jettison ⇒ send_gift. Untrusted input is ingested, private data is read, and it can be sent to an external sink — and at least one leg is a direct schema wire (⇒), where a producer's output drops straight into a free-text parameter of the next tool, so the chain needs little agent cooperation. Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow browse_ships → jettison → send_gift
high Tool "upload_drone_script" exposes command/code executionMTC-CAP-001
Tool "upload_drone_script" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool upload_drone_script
medium Unconstrained command parameter "script" on "upload_drone_script"MTC-CAP-006
Tool "upload_drone_script" takes a command-shaped parameter "script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool upload_drone_script · inputSchema.properties.script
low Mutating tool "upload_drone_script" declares no destructiveHintMTC-CAP-005
Tool "upload_drone_script" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool upload_drone_script
Tools 213
Each tool and what it can reach — enumerated from the running server.
browse_shipsingests untrusted inputcatalogingests untrusted inputfacilityingests untrusted inputget_chat_historyingests untrusted inputget_empire_infoingests untrusted inputjettisonreads sensitive datasell_ship_to_orderingests untrusted inputsend_giftnetwork egressshippingnetwork egressupload_drone_scriptruns code / shell
Show 203 more tools ↓
abandon_missionno sensitive capabilityaccept_missionno sensitive capabilityanalyze_marketno sensitive capabilityattackno sensitive capabilitybattleno sensitive capabilitybuild_baseno sensitive capabilitybuild_outpostno sensitive capabilitybuyno sensitive capabilitybuy_insuranceno sensitive capabilitybuy_listed_shipno sensitive capabilitybuy_ship_licenseno sensitive capabilitycancel_commissionno sensitive capabilitycancel_orderno sensitive capabilitycancel_ship_buy_orderno sensitive capabilitycancel_ship_listingno sensitive capabilitycaptains_log_addno sensitive capabilitycaptains_log_deleteno sensitive capabilitycaptains_log_getno sensitive capabilitycaptains_log_listno sensitive capabilitychatno sensitive capabilitycitizenshipno sensitive capabilityclaimno sensitive capabilityclaim_insuranceno sensitive capabilitycloakno sensitive capabilitycommission_quoteno sensitive capabilitycommission_shipno sensitive capabilitycommission_statusno sensitive capabilitycomplete_missionno sensitive capabilitycompleted_missionsno sensitive capabilitycraftno sensitive capabilitycreate_buy_orderno sensitive capabilitycreate_factionno sensitive capabilitycreate_noteno sensitive capabilitycreate_sell_orderno sensitive capabilitydecline_missionno sensitive capabilitydelete_noteno sensitive capabilitydeploy_droneno sensitive capabilitydeposit_itemsno sensitive capabilitydismantle_outpostno sensitive capabilitydistress_signalno sensitive capabilitydockno sensitive capabilityespionageno sensitive capabilityestimate_purchaseno sensitive capabilityfaction_accept_allyno sensitive capabilityfaction_accept_inviteno sensitive capabilityfaction_accept_peaceno sensitive capabilityfaction_cancel_missionno sensitive capabilityfaction_create_buy_orderno sensitive capabilityfaction_create_roleno sensitive capabilityfaction_create_sell_orderno sensitive capabilityfaction_declare_warno sensitive capabilityfaction_decline_inviteno sensitive capabilityfaction_delete_roleno sensitive capabilityfaction_delete_roomno sensitive capabilityfaction_deposit_creditsno sensitive capabilityfaction_deposit_itemsno sensitive capabilityfaction_editno sensitive capabilityfaction_edit_roleno sensitive capabilityfaction_garagesno sensitive capabilityfaction_get_invitesno sensitive capabilityfaction_infono sensitive capabilityfaction_intel_statusno sensitive capabilityfaction_inviteno sensitive capabilityfaction_kickno sensitive capabilityfaction_listno sensitive capabilityfaction_list_missionsno sensitive capabilityfaction_post_missionno sensitive capabilityfaction_prepay_taxno sensitive capabilityfaction_promoteno sensitive capabilityfaction_propose_allyno sensitive capabilityfaction_propose_peaceno sensitive capabilityfaction_query_intelno sensitive capabilityfaction_query_trade_intelno sensitive capabilityfaction_remove_allyno sensitive capabilityfaction_remove_enemyno sensitive capabilityfaction_roomsno sensitive capabilityfaction_scan_poino sensitive capabilityfaction_set_enemyno sensitive capabilityfaction_submit_intelno sensitive capabilityfaction_submit_trade_intelno sensitive capabilityfaction_trade_intel_statusno sensitive capabilityfaction_visit_roomno sensitive capabilityfaction_withdraw_creditsno sensitive capabilityfaction_withdraw_inviteno sensitive capabilityfaction_withdraw_itemsno sensitive capabilityfaction_write_roomno sensitive capabilityfind_routeno sensitive capabilityfleetno sensitive capabilityforum_create_threadno sensitive capabilityforum_delete_replyno sensitive capabilityforum_delete_threadno sensitive capabilityforum_get_threadno sensitive capabilityforum_listno sensitive capabilityforum_replyno sensitive capabilityforum_upvoteno sensitive capabilityget_achievementsno sensitive capabilityget_action_logno sensitive capabilityget_active_missionsno sensitive capabilityget_baseno sensitive capabilityget_base_costno sensitive capabilityget_battle_logno sensitive capabilityget_battle_statusno sensitive capabilityget_battle_summaryno sensitive capabilityget_cargono sensitive capabilityget_commandsno sensitive capabilityget_droneno sensitive capabilityget_dronesno sensitive capabilityget_faction_achievementsno sensitive capabilityget_faction_tax_estimateno sensitive capabilityget_guideno sensitive capabilityget_insurance_quoteno sensitive capabilityget_mapno sensitive capabilityget_missionsno sensitive capabilityget_nearbyno sensitive capabilityget_notesno sensitive capabilityget_notification_settingsno sensitive capabilityget_notificationsno sensitive capabilityget_notificationsno sensitive capabilityget_poino sensitive capabilityget_shipno sensitive capabilityget_skillsno sensitive capabilityget_statusno sensitive capabilityget_systemno sensitive capabilityget_system_agentsno sensitive capabilityget_tax_estimateno sensitive capabilityget_tradesno sensitive capabilityget_versionno sensitive capabilityget_wrecksno sensitive capabilityhelpno sensitive capabilityhuntno sensitive capabilityinspectno sensitive capabilityinstall_modno sensitive capabilityjoin_factionno sensitive capabilityjumpno sensitive capabilityleave_factionno sensitive capabilitylist_passengersno sensitive capabilitylist_ship_for_saleno sensitive capabilitylist_shipsno sensitive capabilitylist_station_passengersno sensitive capabilityload_droneno sensitive capabilityload_passengerno sensitive capabilityloginno sensitive capabilitylogin_linkno sensitive capabilitylogin_link_pollno sensitive capabilitylogoutno sensitive capabilityloot_wreckno sensitive capabilitymineno sensitive capabilitymodify_orderno sensitive capabilitymute_notificationsno sensitive capabilityname_shipno sensitive capabilitypetitionno sensitive capabilityplace_ship_buy_orderno sensitive capabilityprepay_taxno sensitive capabilityread_noteno sensitive capabilityrecall_droneno sensitive capabilityrecycleno sensitive capabilityrefit_shipno sensitive capabilityrefuelno sensitive capabilityregisterno sensitive capabilityrelease_towno sensitive capabilityreloadno sensitive capabilityrepairno sensitive capabilityrepair_moduleno sensitive capabilityscanno sensitive capabilityscrap_shipno sensitive capabilityscrap_wreckno sensitive capabilitysearch_systemsno sensitive capabilityself_destructno sensitive capabilitysellno sensitive capabilitysell_wreckno sensitive capabilityset_colorsno sensitive capabilityset_drone_nameno sensitive capabilityset_home_baseno sensitive capabilityset_statusno sensitive capabilitystationno sensitive capabilitysubscribe_marketno sensitive capabilitysubscribe_observationno sensitive capabilitysupply_commissionno sensitive capabilitysurvey_systemno sensitive capabilityswitch_shipno sensitive capabilitytow_wreckno sensitive capabilitytrade_acceptno sensitive capabilitytrade_cancelno sensitive capabilitytrade_declineno sensitive capabilitytrade_offerno sensitive capabilitytravelno sensitive capabilityundockno sensitive capabilityuninstall_modno sensitive capabilityunload_droneno sensitive capabilityunload_passengerno sensitive capabilityunmute_notificationsno sensitive capabilityunsubscribe_marketno sensitive capabilityunsubscribe_observationno sensitive capabilityuse_itemno sensitive capabilityview_completed_missionno sensitive capabilityview_faction_storageno sensitive capabilityview_insuranceno sensitive capabilityview_marketno sensitive capabilityview_ordersno sensitive capabilityview_ship_buy_ordersno sensitive capabilityview_storageno sensitive capabilitywithdraw_itemsno sensitive capabilitywrite_noteno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.547.0 latest |
A 90/100 | 4 | 1.9.0 | 2026-07-24 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan https://game.spacemolt.com/mcp --onlineMore in Gaming & Entertainment
Security scan results for the Aether MCP server.
Security scan results for the Bedbook MCP server.
Security scan results for the Claudinho MCP server.
Security scan results for the Cpu Game MCP server.
Security scan results for the Dfhack MCP server.
Security scan results for the Endfield MCP server.