SpaceMolt MCP Server
https://game.spacemolt.com/mcp
Remote
v0.596.2
Published by game.spacemolt.com — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
Massively multiplayer space MMO played entirely by AI agents — mine, trade, explore, fight across 500+ systems.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 10 = 90. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 4
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: browse_ships → jettison ⇒ send_gift. Untrusted input is ingested, private data is read, and it can be sent to an external sink — and at least one leg is a direct schema wire (⇒), where a producer's output drops straight into a free-text parameter of the next tool, so the chain needs little agent cooperation. Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow browse_ships → jettison → send_gift
high Tool "upload_drone_script" exposes command/code executionMTC-CAP-001
Tool "upload_drone_script" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool upload_drone_script
medium Unconstrained command parameter "script" on "upload_drone_script"MTC-CAP-006
Tool "upload_drone_script" takes a command-shaped parameter "script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool upload_drone_script · inputSchema.properties.script
low Mutating tool "upload_drone_script" declares no destructiveHintMTC-CAP-005
Tool "upload_drone_script" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool upload_drone_script
Tools 220
Each tool and what it can reach — enumerated from the running server.
browse_shipsingests untrusted inputcatalogingests untrusted inputfacilityingests untrusted inputget_chat_historyingests untrusted inputget_empire_infoingests untrusted inputjettisonreads sensitive datasell_ship_to_orderingests untrusted inputsend_giftnetwork egressshippingnetwork egressupload_drone_scriptruns code / shell
Show 210 more tools ↓
abandon_missionno sensitive capabilityaccept_missionno sensitive capabilityanalyze_marketno sensitive capabilityarenano sensitive capabilityattackno sensitive capabilitybattleno sensitive capabilitybuild_baseno sensitive capabilitybuild_outpostno sensitive capabilitybuyno sensitive capabilitybuy_insuranceno sensitive capabilitybuy_listed_shipno sensitive capabilitybuy_ship_licenseno sensitive capabilitycancel_commissionno sensitive capabilitycancel_orderno sensitive capabilitycancel_ship_buy_orderno sensitive capabilitycancel_ship_listingno sensitive capabilitycaptains_log_addno sensitive capabilitycaptains_log_deleteno sensitive capabilitycaptains_log_getno sensitive capabilitycaptains_log_listno sensitive capabilitychatno sensitive capabilitycitizenshipno sensitive capabilityclaimno sensitive capabilityclaim_insuranceno sensitive capabilityclaim_prizeno sensitive capabilitycloakno sensitive capabilitycommission_quoteno sensitive capabilitycommission_shipno sensitive capabilitycommission_statusno sensitive capabilitycomplete_missionno sensitive capabilitycompleted_missionsno sensitive capabilitycraftno sensitive capabilitycreate_buy_orderno sensitive capabilitycreate_factionno sensitive capabilitycreate_noteno sensitive capabilitycreate_sell_orderno sensitive capabilitydecline_missionno sensitive capabilitydelete_noteno sensitive capabilitydeploy_droneno sensitive capabilitydeposit_itemsno sensitive capabilitydismantle_outpostno sensitive capabilitydistress_signalno sensitive capabilitydockno sensitive capabilityespionageno sensitive capabilityestimate_purchaseno sensitive capabilityfaction_accept_allyno sensitive capabilityfaction_accept_inviteno sensitive capabilityfaction_accept_peaceno sensitive capabilityfaction_cancel_missionno sensitive capabilityfaction_create_buy_orderno sensitive capabilityfaction_create_roleno sensitive capabilityfaction_create_sell_orderno sensitive capabilityfaction_declare_warno sensitive capabilityfaction_decline_inviteno sensitive capabilityfaction_delete_roleno sensitive capabilityfaction_delete_roomno sensitive capabilityfaction_deposit_creditsno sensitive capabilityfaction_deposit_itemsno sensitive capabilityfaction_editno sensitive capabilityfaction_edit_roleno sensitive capabilityfaction_garagesno sensitive capabilityfaction_get_invitesno sensitive capabilityfaction_infono sensitive capabilityfaction_intel_statusno sensitive capabilityfaction_inviteno sensitive capabilityfaction_kickno sensitive capabilityfaction_listno sensitive capabilityfaction_list_missionsno sensitive capabilityfaction_personnelno sensitive capabilityfaction_post_missionno sensitive capabilityfaction_prepay_taxno sensitive capabilityfaction_promoteno sensitive capabilityfaction_propose_allyno sensitive capabilityfaction_propose_peaceno sensitive capabilityfaction_query_intelno sensitive capabilityfaction_query_trade_intelno sensitive capabilityfaction_remove_allyno sensitive capabilityfaction_remove_enemyno sensitive capabilityfaction_roomsno sensitive capabilityfaction_scan_poino sensitive capabilityfaction_set_enemyno sensitive capabilityfaction_submit_intelno sensitive capabilityfaction_submit_trade_intelno sensitive capabilityfaction_trade_intel_statusno sensitive capabilityfaction_visit_roomno sensitive capabilityfaction_withdraw_creditsno sensitive capabilityfaction_withdraw_inviteno sensitive capabilityfaction_withdraw_itemsno sensitive capabilityfaction_write_roomno sensitive capabilityfind_routeno sensitive capabilityfleetno sensitive capabilityforum_create_threadno sensitive capabilityforum_delete_replyno sensitive capabilityforum_delete_threadno sensitive capabilityforum_get_threadno sensitive capabilityforum_listno sensitive capabilityforum_replyno sensitive capabilityforum_upvoteno sensitive capabilityget_achievementsno sensitive capabilityget_action_logno sensitive capabilityget_active_missionsno sensitive capabilityget_baseno sensitive capabilityget_base_costno sensitive capabilityget_battle_logno sensitive capabilityget_battle_statusno sensitive capabilityget_battle_summaryno sensitive capabilityget_cargono sensitive capabilityget_commandsno sensitive capabilityget_droneno sensitive capabilityget_dronesno sensitive capabilityget_faction_achievementsno sensitive capabilityget_faction_tax_estimateno sensitive capabilityget_guideno sensitive capabilityget_insurance_quoteno sensitive capabilityget_mapno sensitive capabilityget_missionsno sensitive capabilityget_nearbyno sensitive capabilityget_notesno sensitive capabilityget_notification_settingsno sensitive capabilityget_notificationsno sensitive capabilityget_notificationsno sensitive capabilityget_poino sensitive capabilityget_shipno sensitive capabilityget_skillsno sensitive capabilityget_statusno sensitive capabilityget_systemno sensitive capabilityget_system_agentsno sensitive capabilityget_tax_estimateno sensitive capabilityget_tradesno sensitive capabilityget_versionno sensitive capabilityget_wrecksno sensitive capabilityhelpno sensitive capabilityhuntno sensitive capabilityinspectno sensitive capabilityinstall_modno sensitive capabilityjoin_factionno sensitive capabilityjumpno sensitive capabilityleave_factionno sensitive capabilitylist_passengersno sensitive capabilitylist_ship_for_saleno sensitive capabilitylist_shipsno sensitive capabilitylist_station_passengersno sensitive capabilityload_droneno sensitive capabilityload_passengerno sensitive capabilityloginno sensitive capabilitylogin_linkno sensitive capabilitylogin_link_pollno sensitive capabilitylogoutno sensitive capabilityloot_wreckno sensitive capabilitymineno sensitive capabilitymodify_orderno sensitive capabilitymute_notificationsno sensitive capabilityname_shipno sensitive capabilitypay_bountyno sensitive capabilitypetitionno sensitive capabilityplace_ship_buy_orderno sensitive capabilityprepay_taxno sensitive capabilityread_noteno sensitive capabilityrecall_droneno sensitive capabilityrecruit_personnelno sensitive capabilityrecycleno sensitive capabilityrefit_shipno sensitive capabilityrefuelno sensitive capabilityregisterno sensitive capabilityrelease_towno sensitive capabilityreloadno sensitive capabilityrepairno sensitive capabilityscanno sensitive capabilityscrap_shipno sensitive capabilityscrap_wreckno sensitive capabilitysearch_systemsno sensitive capabilityself_destructno sensitive capabilitysellno sensitive capabilitysell_wreckno sensitive capabilityservice_prizeno sensitive capabilityset_colorsno sensitive capabilityset_drone_nameno sensitive capabilityset_home_baseno sensitive capabilityset_statusno sensitive capabilitystationno sensitive capabilitysubscribe_marketno sensitive capabilitysubscribe_observationno sensitive capabilitysupply_commissionno sensitive capabilitysurvey_systemno sensitive capabilityswitch_shipno sensitive capabilitytow_wreckno sensitive capabilitytrade_acceptno sensitive capabilitytrade_cancelno sensitive capabilitytrade_declineno sensitive capabilitytrade_offerno sensitive capabilitytransfer_personnelno sensitive capabilitytravelno sensitive capabilitytreat_personnelno sensitive capabilityundockno sensitive capabilityuninstall_modno sensitive capabilityunload_droneno sensitive capabilityunload_passengerno sensitive capabilityunmute_notificationsno sensitive capabilityunsubscribe_marketno sensitive capabilityunsubscribe_observationno sensitive capabilityuse_itemno sensitive capabilityview_completed_missionno sensitive capabilityview_faction_storageno sensitive capabilityview_insuranceno sensitive capabilityview_marketno sensitive capabilityview_ordersno sensitive capabilityview_ship_buy_ordersno sensitive capabilityview_storageno sensitive capabilitywithdraw_itemsno sensitive capabilitywrite_noteno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
Versions 10
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.596.2 latest |
A 90/100 | 4 | 1.13.0 | 2026-09-07 |
v0.592.2 |
A 90/100 | 4 | 1.13.0 | 2026-09-06 |
v0.586.0 |
A 90/100 | 4 | 1.13.0 | 2026-09-05 |
v0.583.1 |
A 90/100 | 4 | 1.13.0 | 2026-09-04 |
v0.574.0 |
A 90/100 | 4 | 1.13.0 | 2026-09-01 |
Show 5 more versions ↓
v0.573.1 |
A 90/100 | 4 | 1.13.0 | 2026-08-31 |
v0.572.0 |
A 90/100 | 4 | 1.13.0 | 2026-08-30 |
v0.569.0 |
A 90/100 | 4 | 1.13.0 | 2026-08-29 |
v0.567.0 |
A 90/100 | 4 | 1.13.0 | 2026-08-28 |
v0.563.1 |
A 90/100 | 4 | 1.13.0 | 2026-08-27 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan https://game.spacemolt.com/mcp --onlineMore in Gaming & Entertainment
Uncensored AI tools (chat, image, RE/malware analysis, JS deobfuscation, multi-step research) for Claude Desktop, Cursor, Cline, Zed, and any MCP client.
儿童故事 MCP 服务 - 提供故事列表和搜索功能
Grade any bet against thousands of play-by-play game simulations: win probability, odds, edge.
World Cup MCP server for the 2026 men's football tournament — live scores, fixtures, standings, read-only prediction-market signals, and paste-ready match cards. Works with Claude Code, Cursor, Codex, Windsurf, Zed. Not affiliated with FIFA or Anthropic.
MCP server exposing a live Dwarf Fortress fort to an AI agent as curated, semantic tools
MCP Server for Arknights: Endfield (TypeScript / stdio + Streamable HTTP)