SpaceMolt — the complete, unedited output of the deterministic mcptrustchecker engine v1.9.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.9.0",
"methodologyVersion": "mcptrustchecker-1.9"
},
"target": {
"id": "https://game.spacemolt.com/mcp",
"source": {
"kind": "http",
"origin": "https://game.spacemolt.com/mcp"
},
"server": {
"name": "spacemolt-gameserver",
"version": "0.547.0"
}
},
"grade": "A",
"score": {
"score": 90,
"threatScore": 100,
"grade": "A",
"band": "A",
"categorySubtotals": {
"injection": 0,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "client",
"term": "capability-exposure",
"level": "critical",
"label": "capability blast radius (critical) — client exposure if the model is manipulated",
"appliedPenalty": 10
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "live",
"label": "inspection depth (live) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.9"
},
"capability": {
"level": "critical",
"reasons": [
"ingests untrusted external content (a prompt-injection entry point)",
"can send data / act on an external service",
"reads sensitive or local data",
"has a read → egress path (a data-exfiltration surface)",
"can execute shell commands or code",
"untrusted-input, sensitive-source and egress co-exist across tools (toxic-flow surface)",
"untrusted input can reach code execution"
],
"tags": [
"untrusted-input",
"external-sink",
"sensitive-source",
"code-exec"
]
},
"coverage": {
"level": "live",
"inputs": {
"toolSurface": true,
"implementationSource": false,
"packageMetadata": false,
"liveTransport": true
},
"caveats": []
},
"findings": [
{
"ruleId": "MTC-FLOW-002",
"title": "Completed toxic-flow trifecta across tools",
"category": "exfiltration",
"severity": "critical",
"confidence": "strong",
"description": "This server (without client built-ins) exposes a complete data-exfiltration chain: browse_ships → jettison ⇒ send_gift. Untrusted input is ingested, private data is read, and it can be sent to an external sink — and at least one leg is a direct schema wire (⇒), where a producer's output drops straight into a free-text parameter of the next tool, so the chain needs little agent cooperation. Static analysis proves the primitive exists, not that a specific run will occur.",
"remediation": "Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.",
"location": {
"kind": "flow",
"name": "browse_ships → jettison → send_gift"
},
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"references": [],
"data": {
"untrusted": [
"get_empire_info",
"facility",
"browse_ships",
"catalog",
"sell_ship_to_order",
"get_chat_history"
],
"sources": [
"jettison"
],
"sinks": [
"shipping",
"upload_drone_script",
"send_gift"
],
"path": [
"browse_ships",
"jettison",
"send_gift"
],
"edges": [
{
"from": "browse_ships",
"to": "jettison",
"kind": "agent-mediated"
},
{
"from": "jettison",
"to": "send_gift",
"kind": "schema-wired"
}
],
"wired": true
}
},
{
"ruleId": "MTC-CAP-001",
"title": "Tool \"upload_drone_script\" exposes command/code execution",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "Tool \"upload_drone_script\" appears to run shell commands or evaluate code (parameter \"script\"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
"remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
"location": {
"kind": "tool",
"name": "upload_drone_script"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-006",
"title": "Unconstrained command parameter \"script\" on \"upload_drone_script\"",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"upload_drone_script\" takes a command-shaped parameter \"script\" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.",
"remediation": "Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.",
"location": {
"kind": "tool",
"name": "upload_drone_script",
"field": "inputSchema.properties.script"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"param": "script"
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"upload_drone_script\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"upload_drone_script\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "upload_drone_script"
},
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-NET-005",
"title": "Remote HTTP MCP endpoint",
"category": "network",
"severity": "info",
"confidence": "strong",
"description": "Remote endpoint game.spacemolt.com. MCP Trust Checker does not test server-side authentication/authorization; verify the endpoint requires auth.",
"location": {
"kind": "transport"
}
}
],
"toxicFlows": [
{
"id": "flow-1",
"severity": "critical",
"confidence": "strong",
"untrustedInput": [
"get_empire_info",
"facility",
"browse_ships",
"catalog",
"sell_ship_to_order",
"get_chat_history"
],
"sensitiveSource": [
"jettison"
],
"externalSink": [
"shipping",
"upload_drone_script",
"send_gift"
],
"selfContained": false,
"path": [
"browse_ships",
"jettison",
"send_gift"
],
"pathWired": true,
"description": "A cross-tool exfiltration chain exists: browse_ships → jettison ⇒ send_gift."
}
],
"capabilities": [
{
"tool": "logout",
"tags": [],
"reasons": {}
},
{
"tool": "get_battle_status",
"tags": [],
"reasons": {}
},
{
"tool": "uninstall_mod",
"tags": [],
"reasons": {}
},
{
"tool": "faction_declare_war",
"tags": [],
"reasons": {}
},
{
"tool": "load_drone",
"tags": [],
"reasons": {}
},
{
"tool": "forum_delete_reply",
"tags": [],
"reasons": {}
},
{
"tool": "faction_prepay_tax",
"tags": [],
"reasons": {}
},
{
"tool": "scrap_ship",
"tags": [],
"reasons": {}
},
{
"tool": "get_battle_log",
"tags": [],
"reasons": {}
},
{
"tool": "trade_decline",
"tags": [],
"reasons": {}
},
{
"tool": "set_colors",
"tags": [],
"reasons": {}
},
{
"tool": "faction_write_room",
"tags": [],
"reasons": {}
},
{
"tool": "captains_log_delete",
"tags": [],
"reasons": {}
},
{
"tool": "cancel_order",
"tags": [],
"reasons": {}
},
{
"tool": "name_ship",
"tags": [],
"reasons": {}
},
{
"tool": "refuel",
"tags": [],
"reasons": {}
},
{
"tool": "set_home_base",
"tags": [],
"reasons": {}
},
{
"tool": "get_guide",
"tags": [],
"reasons": {}
},
{
"tool": "captains_log_list",
"tags": [],
"reasons": {}
},
{
"tool": "commission_ship",
"tags": [],
"reasons": {}
},
{
"tool": "sell",
"tags": [],
"reasons": {}
},
{
"tool": "trade_offer",
"tags": [],
"reasons": {}
},
{
"tool": "switch_ship",
"tags": [],
"reasons": {}
},
{
"tool": "dismantle_outpost",
"tags": [],
"reasons": {}
},
{
"tool": "prepay_tax",
"tags": [],
"reasons": {}
},
{
"tool": "withdraw_items",
"tags": [],
"reasons": {}
},
{
"tool": "faction_deposit_credits",
"tags": [],
"reasons": {}
},
{
"tool": "commission_quote",
"tags": [],
"reasons": {}
},
{
"tool": "craft",
"tags": [],
"reasons": {}
},
{
"tool": "get_notes",
"tags": [],
"reasons": {}
},
{
"tool": "recall_drone",
"tags": [],
"reasons": {}
},
{
"tool": "tow_wreck",
"tags": [],
"reasons": {}
},
{
"tool": "completed_missions",
"tags": [],
"reasons": {}
},
{
"tool": "faction_submit_trade_intel",
"tags": [],
"reasons": {}
},
{
"tool": "analyze_market",
"tags": [],
"reasons": {}
},
{
"tool": "faction_set_enemy",
"tags": [],
"reasons": {}
},
{
"tool": "trade_cancel",
"tags": [],
"reasons": {}
},
{
"tool": "delete_note",
"tags": [],
"reasons": {}
},
{
"tool": "forum_delete_thread",
"tags": [],
"reasons": {}
},
{
"tool": "faction_list",
"tags": [],
"reasons": {}
},
{
"tool": "faction_withdraw_items",
"tags": [],
"reasons": {}
},
{
"tool": "set_status",
"tags": [],
"reasons": {}
},
{
"tool": "get_notifications",
"tags": [],
"reasons": {}
},
{
"tool": "cancel_commission",
"tags": [],
"reasons": {}
},
{
"tool": "get_battle_summary",
"tags": [],
"reasons": {}
},
{
"tool": "faction_edit",
"tags": [],
"reasons": {}
},
{
"tool": "get_notification_settings",
"tags": [],
"reasons": {}
},
{
"tool": "get_cargo",
"tags": [],
"reasons": {}
},
{
"tool": "faction_withdraw_credits",
"tags": [],
"reasons": {}
},
{
"tool": "faction_scan_poi",
"tags": [],
"reasons": {}
},
{
"tool": "petition",
"tags": [],
"reasons": {}
},
{
"tool": "faction_invite",
"tags": [],
"reasons": {}
},
{
"tool": "deploy_drone",
"tags": [],
"reasons": {}
},
{
"tool": "view_market",
"tags": [],
"reasons": {}
},
{
"tool": "list_ships",
"tags": [],
"reasons": {}
},
{
"tool": "captains_log_get",
"tags": [],
"reasons": {}
},
{
"tool": "faction_query_trade_intel",
"tags": [],
"reasons": {}
},
{
"tool": "mute_notifications",
"tags": [],
"reasons": {}
},
{
"tool": "unmute_notifications",
"tags": [],
"reasons": {}
},
{
"tool": "find_route",
"tags": [],
"reasons": {}
},
{
"tool": "forum_create_thread",
"tags": [],
"reasons": {}
},
{
"tool": "faction_deposit_items",
"tags": [],
"reasons": {}
},
{
"tool": "cancel_ship_buy_order",
"tags": [],
"reasons": {}
},
{
"tool": "reload",
"tags": [],
"reasons": {}
},
{
"tool": "get_empire_info",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"fetch\""
]
}
},
{
"tool": "get_faction_tax_estimate",
"tags": [],
"reasons": {}
},
{
"tool": "get_active_missions",
"tags": [],
"reasons": {}
},
{
"tool": "facility",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"browse\""
]
}
},
{
"tool": "register",
"tags": [],
"reasons": {}
},
{
"tool": "get_status",
"tags": [],
"reasons": {}
},
{
"tool": "get_missions",
"tags": [],
"reasons": {}
},
{
"tool": "decline_mission",
"tags": [],
"reasons": {}
},
{
"tool": "view_ship_buy_orders",
"tags": [],
"reasons": {}
},
{
"tool": "get_action_log",
"tags": [],
"reasons": {}
},
{
"tool": "faction_get_invites",
"tags": [],
"reasons": {}
},
{
"tool": "subscribe_market",
"tags": [],
"reasons": {}
},
{
"tool": "repair",
"tags": [],
"reasons": {}
},
{
"tool": "get_tax_estimate",
"tags": [],
"reasons": {}
},
{
"tool": "read_note",
"tags": [],
"reasons": {}
},
{
"tool": "list_ship_for_sale",
"tags": [],
"reasons": {}
},
{
"tool": "buy_listed_ship",
"tags": [],
"reasons": {}
},
{
"tool": "scrap_wreck",
"tags": [],
"reasons": {}
},
{
"tool": "join_faction",
"tags": [],
"reasons": {}
},
{
"tool": "faction_create_role",
"tags": [],
"reasons": {}
},
{
"tool": "release_tow",
"tags": [],
"reasons": {}
},
{
"tool": "chat",
"tags": [],
"reasons": {}
},
{
"tool": "shipping",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"parameter \"recipient\""
]
}
},
{
"tool": "faction_trade_intel_status",
"tags": [],
"reasons": {}
},
{
"tool": "dock",
"tags": [],
"reasons": {}
},
{
"tool": "trade_accept",
"tags": [],
"reasons": {}
},
{
"tool": "view_insurance",
"tags": [],
"reasons": {}
},
{
"tool": "get_version",
"tags": [],
"reasons": {}
},
{
"tool": "view_faction_storage",
"tags": [],
"reasons": {}
},
{
"tool": "unsubscribe_observation",
"tags": [],
"reasons": {}
},
{
"tool": "get_commands",
"tags": [],
"reasons": {}
},
{
"tool": "build_base",
"tags": [],
"reasons": {}
},
{
"tool": "place_ship_buy_order",
"tags": [],
"reasons": {}
},
{
"tool": "loot_wreck",
"tags": [],
"reasons": {}
},
{
"tool": "citizenship",
"tags": [],
"reasons": {}
},
{
"tool": "faction_propose_ally",
"tags": [],
"reasons": {}
},
{
"tool": "faction_remove_ally",
"tags": [],
"reasons": {}
},
{
"tool": "get_map",
"tags": [],
"reasons": {}
},
{
"tool": "buy_ship_license",
"tags": [],
"reasons": {}
},
{
"tool": "install_mod",
"tags": [],
"reasons": {}
},
{
"tool": "inspect",
"tags": [],
"reasons": {}
},
{
"tool": "get_insurance_quote",
"tags": [],
"reasons": {}
},
{
"tool": "get_drones",
"tags": [],
"reasons": {}
},
{
"tool": "faction_info",
"tags": [],
"reasons": {}
},
{
"tool": "faction_accept_invite",
"tags": [],
"reasons": {}
},
{
"tool": "fleet",
"tags": [],
"reasons": {}
},
{
"tool": "get_nearby",
"tags": [],
"reasons": {}
},
{
"tool": "browse_ships",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"browse\""
]
}
},
{
"tool": "catalog",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"browse\""
]
}
},
{
"tool": "attack",
"tags": [],
"reasons": {}
},
{
"tool": "cloak",
"tags": [],
"reasons": {}
},
{
"tool": "self_destruct",
"tags": [],
"reasons": {}
},
{
"tool": "battle",
"tags": [],
"reasons": {}
},
{
"tool": "get_faction_achievements",
"tags": [],
"reasons": {}
},
{
"tool": "create_buy_order",
"tags": [],
"reasons": {}
},
{
"tool": "faction_promote",
"tags": [],
"reasons": {}
},
{
"tool": "get_system_agents",
"tags": [],
"reasons": {}
},
{
"tool": "estimate_purchase",
"tags": [],
"reasons": {}
},
{
"tool": "refit_ship",
"tags": [],
"reasons": {}
},
{
"tool": "faction_edit_role",
"tags": [],
"reasons": {}
},
{
"tool": "claim_insurance",
"tags": [],
"reasons": {}
},
{
"tool": "get_ship",
"tags": [],
"reasons": {}
},
{
"tool": "help",
"tags": [],
"reasons": {}
},
{
"tool": "login_link",
"tags": [],
"reasons": {}
},
{
"tool": "survey_system",
"tags": [],
"reasons": {}
},
{
"tool": "complete_mission",
"tags": [],
"reasons": {}
},
{
"tool": "station",
"tags": [],
"reasons": {}
},
{
"tool": "jettison",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"dump\""
]
}
},
{
"tool": "recycle",
"tags": [],
"reasons": {}
},
{
"tool": "faction_remove_enemy",
"tags": [],
"reasons": {}
},
{
"tool": "upload_drone_script",
"tags": [
"code-exec"
],
"reasons": {
"code-exec": [
"parameter \"script\""
]
}
},
{
"tool": "faction_visit_room",
"tags": [],
"reasons": {}
},
{
"tool": "create_faction",
"tags": [],
"reasons": {}
},
{
"tool": "faction_decline_invite",
"tags": [],
"reasons": {}
},
{
"tool": "unload_drone",
"tags": [],
"reasons": {}
},
{
"tool": "get_drone",
"tags": [],
"reasons": {}
},
{
"tool": "view_completed_mission",
"tags": [],
"reasons": {}
},
{
"tool": "modify_order",
"tags": [],
"reasons": {}
},
{
"tool": "faction_post_mission",
"tags": [],
"reasons": {}
},
{
"tool": "get_skills",
"tags": [],
"reasons": {}
},
{
"tool": "forum_list",
"tags": [],
"reasons": {}
},
{
"tool": "view_orders",
"tags": [],
"reasons": {}
},
{
"tool": "faction_submit_intel",
"tags": [],
"reasons": {}
},
{
"tool": "commission_status",
"tags": [],
"reasons": {}
},
{
"tool": "faction_accept_peace",
"tags": [],
"reasons": {}
},
{
"tool": "accept_mission",
"tags": [],
"reasons": {}
},
{
"tool": "build_outpost",
"tags": [],
"reasons": {}
},
{
"tool": "get_achievements",
"tags": [],
"reasons": {}
},
{
"tool": "create_sell_order",
"tags": [],
"reasons": {}
},
{
"tool": "espionage",
"tags": [],
"reasons": {}
},
{
"tool": "travel",
"tags": [],
"reasons": {}
},
{
"tool": "faction_garages",
"tags": [],
"reasons": {}
},
{
"tool": "subscribe_observation",
"tags": [],
"reasons": {}
},
{
"tool": "forum_get_thread",
"tags": [],
"reasons": {}
},
{
"tool": "get_trades",
"tags": [],
"reasons": {}
},
{
"tool": "list_station_passengers",
"tags": [],
"reasons": {}
},
{
"tool": "faction_propose_peace",
"tags": [],
"reasons": {}
},
{
"tool": "buy_insurance",
"tags": [],
"reasons": {}
},
{
"tool": "get_base",
"tags": [],
"reasons": {}
},
{
"tool": "faction_list_missions",
"tags": [],
"reasons": {}
},
{
"tool": "sell_ship_to_order",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"browse\""
]
}
},
{
"tool": "get_chat_history",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"fetch\""
]
}
},
{
"tool": "faction_delete_role",
"tags": [],
"reasons": {}
},
{
"tool": "write_note",
"tags": [],
"reasons": {}
},
{
"tool": "faction_delete_room",
"tags": [],
"reasons": {}
},
{
"tool": "undock",
"tags": [],
"reasons": {}
},
{
"tool": "load_passenger",
"tags": [],
"reasons": {}
},
{
"tool": "faction_create_sell_order",
"tags": [],
"reasons": {}
},
{
"tool": "get_base_cost",
"tags": [],
"reasons": {}
},
{
"tool": "distress_signal",
"tags": [],
"reasons": {}
},
{
"tool": "faction_kick",
"tags": [],
"reasons": {}
},
{
"tool": "faction_rooms",
"tags": [],
"reasons": {}
},
{
"tool": "faction_cancel_mission",
"tags": [],
"reasons": {}
},
{
"tool": "cancel_ship_listing",
"tags": [],
"reasons": {}
},
{
"tool": "forum_reply",
"tags": [],
"reasons": {}
},
{
"tool": "claim",
"tags": [],
"reasons": {}
},
{
"tool": "login",
"tags": [],
"reasons": {}
},
{
"tool": "scan",
"tags": [],
"reasons": {}
},
{
"tool": "use_item",
"tags": [],
"reasons": {}
},
{
"tool": "set_drone_name",
"tags": [],
"reasons": {}
},
{
"tool": "unsubscribe_market",
"tags": [],
"reasons": {}
},
{
"tool": "faction_intel_status",
"tags": [],
"reasons": {}
},
{
"tool": "supply_commission",
"tags": [],
"reasons": {}
},
{
"tool": "get_poi",
"tags": [],
"reasons": {}
},
{
"tool": "create_note",
"tags": [],
"reasons": {}
},
{
"tool": "captains_log_add",
"tags": [],
"reasons": {}
},
{
"tool": "hunt",
"tags": [],
"reasons": {}
},
{
"tool": "search_systems",
"tags": [],
"reasons": {}
},
{
"tool": "jump",
"tags": [],
"reasons": {}
},
{
"tool": "buy",
"tags": [],
"reasons": {}
},
{
"tool": "faction_query_intel",
"tags": [],
"reasons": {}
},
{
"tool": "mine",
"tags": [],
"reasons": {}
},
{
"tool": "unload_passenger",
"tags": [],
"reasons": {}
},
{
"tool": "view_storage",
"tags": [],
"reasons": {}
},
{
"tool": "deposit_items",
"tags": [],
"reasons": {}
},
{
"tool": "faction_create_buy_order",
"tags": [],
"reasons": {}
},
{
"tool": "login_link_poll",
"tags": [],
"reasons": {}
},
{
"tool": "sell_wreck",
"tags": [],
"reasons": {}
},
{
"tool": "repair_module",
"tags": [],
"reasons": {}
},
{
"tool": "abandon_mission",
"tags": [],
"reasons": {}
},
{
"tool": "send_gift",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"parameter \"recipient\""
]
}
},
{
"tool": "leave_faction",
"tags": [],
"reasons": {}
},
{
"tool": "get_system",
"tags": [],
"reasons": {}
},
{
"tool": "faction_withdraw_invite",
"tags": [],
"reasons": {}
},
{
"tool": "faction_accept_ally",
"tags": [],
"reasons": {}
},
{
"tool": "forum_upvote",
"tags": [],
"reasons": {}
},
{
"tool": "get_wrecks",
"tags": [],
"reasons": {}
},
{
"tool": "list_passengers",
"tags": [],
"reasons": {}
},
{
"tool": "get_notifications",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "0e297a54bd341a9363ddf7e3d5019f5a2f5a8d4c7209b3d0dda1b55a2a028578",
"stats": {
"tools": 213,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 1,
"high": 1,
"medium": 1,
"low": 1,
"info": 1
}
}
}