Mcp MCP Server
https://mcp.redu.cloud/mcp
Remote
v2.0.0
Published by mcp.redu.cloud — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
Agent-native cloud, EU-hosted. Provision VMs, networks & databases on redu.cloud via MCP.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 11.5 = 88. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −9.5 | Annotation contradicts behavior on "upgrade_to_cluster" ×2 MTC-CAP-003 | permissions |
| −2.1 | Reference to a credential-exfiltration path in metadata ×3 MTC-INJ-TARGET-1 | injection |
2. Client adoption risk — 88 − 6 = 82. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 9
high Tool "upgrade_to_cluster" exposes command/code executionMTC-CAP-001
Tool "upgrade_to_cluster" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool upgrade_to_cluster
high Tool "deploy_compose" exposes command/code executionMTC-CAP-001
Tool "deploy_compose" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool deploy_compose
medium Unconstrained URL/host parameter "controller_url" on "trigger_agent_batch"MTC-CAP-007
Tool "trigger_agent_batch" takes a URL/host parameter "controller_url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).
Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.
Location: tool trigger_agent_batch · inputSchema.properties.controller_url
medium Annotation contradicts behavior on "upgrade_to_cluster"MTC-CAP-003
Tool "upgrade_to_cluster" advertises destructiveHint=false but its derived capabilities include state-modifying actions (code-exec). Tool annotations are attacker-controllable and must never be trusted; a mismatch like this is exactly how a hostile server hides a destructive tool.
Fix: Ignore server-provided annotations for security decisions; gate destructive tools on explicit user consent.
Location: tool upgrade_to_cluster
medium Annotation contradicts behavior on "deploy_compose"MTC-CAP-003
Tool "deploy_compose" advertises destructiveHint=false but its derived capabilities include state-modifying actions (code-exec). Tool annotations are attacker-controllable and must never be trusted; a mismatch like this is exactly how a hostile server hides a destructive tool.
Fix: Ignore server-provided annotations for security decisions; gate destructive tools on explicit user consent.
Location: tool deploy_compose
medium Unconstrained command parameter "migrate_command" on "deploy_compose"MTC-CAP-006
Tool "deploy_compose" takes a command-shaped parameter "migrate_command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool deploy_compose · inputSchema.properties.migrate_command
low Reference to a credential-exfiltration path in metadataMTC-INJ-TARGET-1
Reference to a credential-exfiltration path in metadata detected in the inputSchema.properties.public_key.description of tool "import_keypair". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.
Evidence: id_rsa
Fix: Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.
Location: tool import_keypair · inputSchema.properties.public_key.description
low Reference to a credential-exfiltration path in metadataMTC-INJ-TARGET-1
Reference to a credential-exfiltration path in metadata detected in the description of tool "get_ssh_command". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.
Evidence: ~/.ssh
Fix: Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.
Location: tool get_ssh_command · description
low Reference to a credential-exfiltration path in metadataMTC-INJ-TARGET-1
Reference to a credential-exfiltration path in metadata detected in the inputSchema.properties.keypair_name.description of tool "get_ssh_command". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.
Evidence: ~/.ssh
Fix: Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.
Location: tool get_ssh_command · inputSchema.properties.keypair_name.description
Tools 70
Each tool and what it can reach — enumerated from the running server.
deploy_composeruns code / shelltrigger_agent_batchnetwork egressupgrade_to_clusterruns code / shellarchitecture_diagramno sensitive capabilitycheck_agent_prerequisitesno sensitive capabilitycheck_deploy_prerequisitesno sensitive capabilitycreate_api_keyno sensitive capabilitycreate_backupno sensitive capabilitycreate_clickhouseno sensitive capabilitycreate_controllerno sensitive capability
Show 60 more tools ↓
create_databaseno sensitive capabilitycreate_instanceno sensitive capabilitycreate_media_spaceno sensitive capabilitycreate_redisno sensitive capabilitycreate_relational_databaseno sensitive capabilitycreate_snapshotno sensitive capabilitycreate_volumeno sensitive capabilitydelete_backupno sensitive capabilitydelete_clickhouseno sensitive capabilitydelete_clusterno sensitive capabilitydelete_databaseno sensitive capabilitydelete_deploymentno sensitive capabilitydelete_instanceno sensitive capabilitydelete_keypairno sensitive capabilitydelete_redisno sensitive capabilitydelete_relational_databaseno sensitive capabilitydelete_snapshotno sensitive capabilitydeploy_appno sensitive capabilitydeploy_overviewno sensitive capabilitydeploy_vpnno sensitive capabilityget_agent_statusno sensitive capabilityget_deploymentno sensitive capabilityget_domain_verificationno sensitive capabilityget_instance_logsno sensitive capabilityget_ssh_commandno sensitive capabilityimport_keypairno sensitive capabilityinstance_actionno sensitive capabilityintegrate_overviewno sensitive capabilitylist_backupsno sensitive capabilitylist_clickhouse_databasesno sensitive capabilitylist_clustersno sensitive capabilitylist_databasesno sensitive capabilitylist_deploymentsno sensitive capabilitylist_dns_entriesno sensitive capabilitylist_domainsno sensitive capabilitylist_flavorsno sensitive capabilitylist_imagesno sensitive capabilitylist_instancesno sensitive capabilitylist_keypairsno sensitive capabilitylist_media_spacesno sensitive capabilitylist_private_networksno sensitive capabilitylist_redisno sensitive capabilitylist_regionsno sensitive capabilitylist_relational_databasesno sensitive capabilitylist_security_groupsno sensitive capabilitylist_snapshotsno sensitive capabilitylist_volumesno sensitive capabilityplan_deployno sensitive capabilityplan_instanceno sensitive capabilityplan_managed_datastoreno sensitive capabilityprepare_uploadno sensitive capabilityrestore_backupno sensitive capabilityscaffold_localno sensitive capabilityselect_surfaceno sensitive capabilityset_managed_backupsno sensitive capabilitysetup_agent_fleetno sensitive capabilitysetup_agent_sessionno sensitive capabilityupdate_clusterno sensitive capabilityverify_domainno sensitive capabilitywhoamino sensitive capability
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v2.0.0 latest |
B 82/100 | 9 | 1.10.0 | 2026-07-24 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan https://mcp.redu.cloud/mcp --onlineMore in AI & Agents
Security scan results for the Agent MCP server.
Security scan results for the Agent Claim MCP server.
Security scan results for the Agent Comm MCP server.
Security scan results for the Agent Comm MCP server.
Security scan results for the Agent Mcp Manager MCP server.
Security scan results for the Agent Mesh MCP server.