Mcp — the complete, unedited output of the deterministic mcptrustchecker engine v1.10.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.10.0",
"methodologyVersion": "mcptrustchecker-1.9"
},
"target": {
"id": "https://mcp.redu.cloud/mcp",
"source": {
"kind": "http",
"origin": "https://mcp.redu.cloud/mcp"
},
"server": {
"name": "redu-cloud-mcp",
"version": "2.0.0"
}
},
"grade": "B",
"score": {
"score": 82,
"threatScore": 88,
"grade": "B",
"band": "B",
"categorySubtotals": {
"injection": 2.1,
"exfiltration": 0,
"permissions": 9.45,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "threat",
"ruleId": "MTC-CAP-003",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 1,
"appliedPenalty": 6.3
},
{
"kind": "threat",
"ruleId": "MTC-CAP-003",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.5,
"appliedPenalty": 3.15
},
{
"kind": "threat",
"ruleId": "MTC-INJ-TARGET-1",
"category": "injection",
"severity": "low",
"confidence": "heuristic",
"rawWeight": 3,
"confidenceMult": 0.4,
"diminishingFactor": 1,
"appliedPenalty": 1.2
},
{
"kind": "threat",
"ruleId": "MTC-INJ-TARGET-1",
"category": "injection",
"severity": "low",
"confidence": "heuristic",
"rawWeight": 3,
"confidenceMult": 0.4,
"diminishingFactor": 0.5,
"appliedPenalty": 0.6
},
{
"kind": "threat",
"ruleId": "MTC-INJ-TARGET-1",
"category": "injection",
"severity": "low",
"confidence": "heuristic",
"rawWeight": 3,
"confidenceMult": 0.4,
"diminishingFactor": 0.25,
"appliedPenalty": 0.3
},
{
"kind": "client",
"term": "capability-exposure",
"level": "high",
"label": "capability blast radius (high) — client exposure if the model is manipulated",
"appliedPenalty": 6
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "live",
"label": "inspection depth (live) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.9"
},
"capability": {
"level": "high",
"reasons": [
"can send data / act on an external service",
"can execute shell commands or code"
],
"tags": [
"code-exec",
"external-sink"
]
},
"coverage": {
"level": "live",
"inputs": {
"toolSurface": true,
"implementationSource": false,
"packageMetadata": false,
"liveTransport": true
},
"caveats": []
},
"findings": [
{
"ruleId": "MTC-CAP-001",
"title": "Tool \"upgrade_to_cluster\" exposes command/code execution",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "Tool \"upgrade_to_cluster\" appears to run shell commands or evaluate code (parameter \"command\"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
"remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
"location": {
"kind": "tool",
"name": "upgrade_to_cluster"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-001",
"title": "Tool \"deploy_compose\" exposes command/code execution",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "Tool \"deploy_compose\" appears to run shell commands or evaluate code (parameter \"command\"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
"remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
"location": {
"kind": "tool",
"name": "deploy_compose"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-007",
"title": "Unconstrained URL/host parameter \"controller_url\" on \"trigger_agent_batch\"",
"category": "network",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"trigger_agent_batch\" takes a URL/host parameter \"controller_url\" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).",
"remediation": "Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.",
"location": {
"kind": "tool",
"name": "trigger_agent_batch",
"field": "inputSchema.properties.controller_url"
},
"owasp": "LLM06:2025 Excessive Agency",
"data": {
"param": "controller_url"
}
},
{
"ruleId": "MTC-CAP-003",
"title": "Annotation contradicts behavior on \"upgrade_to_cluster\"",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "Tool \"upgrade_to_cluster\" advertises destructiveHint=false but its derived capabilities include state-modifying actions (code-exec). Tool annotations are attacker-controllable and must never be trusted; a mismatch like this is exactly how a hostile server hides a destructive tool.",
"remediation": "Ignore server-provided annotations for security decisions; gate destructive tools on explicit user consent.",
"location": {
"kind": "tool",
"name": "upgrade_to_cluster"
},
"owasp": "LLM06:2025 Excessive Agency",
"data": {
"tags": [
"code-exec"
],
"annotations": {
"readOnlyHint": false,
"destructiveHint": false,
"idempotentHint": true,
"openWorldHint": true
}
}
},
{
"ruleId": "MTC-CAP-003",
"title": "Annotation contradicts behavior on \"deploy_compose\"",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "Tool \"deploy_compose\" advertises destructiveHint=false but its derived capabilities include state-modifying actions (code-exec). Tool annotations are attacker-controllable and must never be trusted; a mismatch like this is exactly how a hostile server hides a destructive tool.",
"remediation": "Ignore server-provided annotations for security decisions; gate destructive tools on explicit user consent.",
"location": {
"kind": "tool",
"name": "deploy_compose"
},
"owasp": "LLM06:2025 Excessive Agency",
"data": {
"tags": [
"code-exec"
],
"annotations": {
"readOnlyHint": false,
"destructiveHint": false,
"idempotentHint": true,
"openWorldHint": true
}
}
},
{
"ruleId": "MTC-CAP-006",
"title": "Unconstrained command parameter \"migrate_command\" on \"deploy_compose\"",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"deploy_compose\" takes a command-shaped parameter \"migrate_command\" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.",
"remediation": "Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.",
"location": {
"kind": "tool",
"name": "deploy_compose",
"field": "inputSchema.properties.migrate_command"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"param": "migrate_command"
}
},
{
"ruleId": "MTC-INJ-TARGET-1",
"title": "Reference to a credential-exfiltration path in metadata",
"category": "injection",
"severity": "low",
"confidence": "heuristic",
"description": "Reference to a credential-exfiltration path in metadata detected in the inputSchema.properties.public_key.description of tool \"import_keypair\". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.",
"remediation": "Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.",
"location": {
"kind": "tool",
"name": "import_keypair",
"field": "inputSchema.properties.public_key.description"
},
"evidence": "id_rsa",
"owasp": "LLM01:2025 Prompt Injection",
"data": {
"kind": "sensitive-target"
}
},
{
"ruleId": "MTC-INJ-TARGET-1",
"title": "Reference to a credential-exfiltration path in metadata",
"category": "injection",
"severity": "low",
"confidence": "heuristic",
"description": "Reference to a credential-exfiltration path in metadata detected in the description of tool \"get_ssh_command\". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.",
"remediation": "Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.",
"location": {
"kind": "tool",
"name": "get_ssh_command",
"field": "description"
},
"evidence": "~/.ssh",
"owasp": "LLM01:2025 Prompt Injection",
"data": {
"kind": "sensitive-target"
}
},
{
"ruleId": "MTC-INJ-TARGET-1",
"title": "Reference to a credential-exfiltration path in metadata",
"category": "injection",
"severity": "low",
"confidence": "heuristic",
"description": "Reference to a credential-exfiltration path in metadata detected in the inputSchema.properties.keypair_name.description of tool \"get_ssh_command\". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.",
"remediation": "Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.",
"location": {
"kind": "tool",
"name": "get_ssh_command",
"field": "inputSchema.properties.keypair_name.description"
},
"evidence": "~/.ssh",
"owasp": "LLM01:2025 Prompt Injection",
"data": {
"kind": "sensitive-target"
}
},
{
"ruleId": "MTC-NET-005",
"title": "Remote HTTP MCP endpoint",
"category": "network",
"severity": "info",
"confidence": "strong",
"description": "Remote endpoint mcp.redu.cloud. MCP Trust Checker does not test server-side authentication/authorization; verify the endpoint requires auth.",
"location": {
"kind": "transport"
}
}
],
"toxicFlows": [],
"capabilities": [
{
"tool": "whoami",
"tags": [],
"reasons": {}
},
{
"tool": "check_deploy_prerequisites",
"tags": [],
"reasons": {}
},
{
"tool": "deploy_overview",
"tags": [],
"reasons": {}
},
{
"tool": "create_api_key",
"tags": [],
"reasons": {}
},
{
"tool": "integrate_overview",
"tags": [],
"reasons": {}
},
{
"tool": "prepare_upload",
"tags": [],
"reasons": {}
},
{
"tool": "scaffold_local",
"tags": [],
"reasons": {}
},
{
"tool": "plan_instance",
"tags": [],
"reasons": {}
},
{
"tool": "plan_managed_datastore",
"tags": [],
"reasons": {}
},
{
"tool": "select_surface",
"tags": [],
"reasons": {}
},
{
"tool": "plan_deploy",
"tags": [],
"reasons": {}
},
{
"tool": "list_instances",
"tags": [],
"reasons": {}
},
{
"tool": "list_flavors",
"tags": [],
"reasons": {}
},
{
"tool": "list_images",
"tags": [],
"reasons": {}
},
{
"tool": "list_keypairs",
"tags": [],
"reasons": {}
},
{
"tool": "list_security_groups",
"tags": [],
"reasons": {}
},
{
"tool": "list_private_networks",
"tags": [],
"reasons": {}
},
{
"tool": "list_volumes",
"tags": [],
"reasons": {}
},
{
"tool": "list_snapshots",
"tags": [],
"reasons": {}
},
{
"tool": "list_backups",
"tags": [],
"reasons": {}
},
{
"tool": "list_clusters",
"tags": [],
"reasons": {}
},
{
"tool": "list_dns_entries",
"tags": [],
"reasons": {}
},
{
"tool": "list_domains",
"tags": [],
"reasons": {}
},
{
"tool": "list_regions",
"tags": [],
"reasons": {}
},
{
"tool": "list_databases",
"tags": [],
"reasons": {}
},
{
"tool": "list_relational_databases",
"tags": [],
"reasons": {}
},
{
"tool": "list_media_spaces",
"tags": [],
"reasons": {}
},
{
"tool": "list_clickhouse_databases",
"tags": [],
"reasons": {}
},
{
"tool": "list_redis",
"tags": [],
"reasons": {}
},
{
"tool": "create_media_space",
"tags": [],
"reasons": {}
},
{
"tool": "upgrade_to_cluster",
"tags": [
"code-exec"
],
"reasons": {
"code-exec": [
"parameter \"command\""
]
}
},
{
"tool": "update_cluster",
"tags": [],
"reasons": {}
},
{
"tool": "delete_cluster",
"tags": [],
"reasons": {}
},
{
"tool": "import_keypair",
"tags": [],
"reasons": {}
},
{
"tool": "delete_keypair",
"tags": [],
"reasons": {}
},
{
"tool": "get_ssh_command",
"tags": [],
"reasons": {}
},
{
"tool": "get_instance_logs",
"tags": [],
"reasons": {}
},
{
"tool": "instance_action",
"tags": [],
"reasons": {}
},
{
"tool": "create_instance",
"tags": [],
"reasons": {}
},
{
"tool": "delete_instance",
"tags": [],
"reasons": {}
},
{
"tool": "create_database",
"tags": [],
"reasons": {}
},
{
"tool": "delete_database",
"tags": [],
"reasons": {}
},
{
"tool": "create_relational_database",
"tags": [],
"reasons": {}
},
{
"tool": "delete_relational_database",
"tags": [],
"reasons": {}
},
{
"tool": "create_clickhouse",
"tags": [],
"reasons": {}
},
{
"tool": "delete_clickhouse",
"tags": [],
"reasons": {}
},
{
"tool": "create_redis",
"tags": [],
"reasons": {}
},
{
"tool": "delete_redis",
"tags": [],
"reasons": {}
},
{
"tool": "deploy_app",
"tags": [],
"reasons": {}
},
{
"tool": "deploy_compose",
"tags": [
"code-exec"
],
"reasons": {
"code-exec": [
"parameter \"command\""
]
}
},
{
"tool": "deploy_vpn",
"tags": [],
"reasons": {}
},
{
"tool": "list_deployments",
"tags": [],
"reasons": {}
},
{
"tool": "delete_deployment",
"tags": [],
"reasons": {}
},
{
"tool": "get_deployment",
"tags": [],
"reasons": {}
},
{
"tool": "architecture_diagram",
"tags": [],
"reasons": {}
},
{
"tool": "create_snapshot",
"tags": [],
"reasons": {}
},
{
"tool": "delete_snapshot",
"tags": [],
"reasons": {}
},
{
"tool": "create_backup",
"tags": [],
"reasons": {}
},
{
"tool": "restore_backup",
"tags": [],
"reasons": {}
},
{
"tool": "delete_backup",
"tags": [],
"reasons": {}
},
{
"tool": "set_managed_backups",
"tags": [],
"reasons": {}
},
{
"tool": "create_volume",
"tags": [],
"reasons": {}
},
{
"tool": "get_domain_verification",
"tags": [],
"reasons": {}
},
{
"tool": "verify_domain",
"tags": [],
"reasons": {}
},
{
"tool": "check_agent_prerequisites",
"tags": [],
"reasons": {}
},
{
"tool": "create_controller",
"tags": [],
"reasons": {}
},
{
"tool": "trigger_agent_batch",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"keyword \"open_pr\""
]
}
},
{
"tool": "get_agent_status",
"tags": [],
"reasons": {}
},
{
"tool": "setup_agent_session",
"tags": [],
"reasons": {}
},
{
"tool": "setup_agent_fleet",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "4d22d12186af92acc344eaba475b4004039f109a78c6b03894c3323519721104",
"stats": {
"tools": 70,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 2,
"medium": 4,
"low": 3,
"info": 1
}
}
}