Ractermx MCP Server
@ractermx/mcp-server
npm
v4.0.0
Published by @ractermx — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
MCP server for managing RacterMX email forwarding via AI assistants
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 4 = 96. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 3
medium Untrusted input can drive an external actionMTC-FLOW-005
Untrusted-input tools ([get_compliance_export_status, download_compliance_export]) co-exist with external-action tools ([send_email, create_webhook, update_webhook, delete_webhook, test_webhook, rotate_webhook_secret, retry_webhook_delivery, initiate_domain_transfer, create_alert_rule, update_alert_rule]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.
Evidence: untrusted [get_compliance_export_status, download_compliance_export] → sinks [send_email, create_webhook, update_webhook, delete_webhook, test_webhook, rotate_w
Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.
Location: flow get_compliance_export_status → send_email
medium Unconstrained URL/host parameter "url" on "create_webhook"MTC-CAP-007
Tool "create_webhook" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).
Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.
Location: tool create_webhook · inputSchema.properties.url
medium Unconstrained URL/host parameter "url" on "update_webhook"MTC-CAP-007
Tool "update_webhook" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).
Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.
Location: tool update_webhook · inputSchema.properties.url
Tools 131
Each tool and what it can reach — statically extracted from the published source.
create_alert_rulenetwork egresscreate_webhooknetwork egressdelete_webhooknetwork egressdownload_compliance_exportingests untrusted inputget_compliance_export_statusingests untrusted inputinitiate_domain_transfernetwork egressretry_webhook_deliverynetwork egressrotate_webhook_secretnetwork egresssend_emailnetwork egresstest_webhooknetwork egress
Show 121 more tools ↓
update_alert_rulenetwork egressupdate_webhooknetwork egressacknowledge_driftno sensitive capabilityadd_blocklist_entryno sensitive capabilityadd_domainno sensitive capabilityapply_dmarc_policyno sensitive capabilityapply_security_fixno sensitive capabilityassign_tags_to_domainno sensitive capabilitybulk_move_domainsno sensitive capabilitybulk_update_aliasesno sensitive capabilitycancel_domain_transferno sensitive capabilitycheck_shared_alias_availabilityno sensitive capabilitycreate_aliasno sensitive capabilitycreate_api_keyno sensitive capabilitycreate_domain_smtp_credentialno sensitive capabilitycreate_organizationno sensitive capabilitycreate_routing_ruleno sensitive capabilitycreate_shared_aliasno sensitive capabilitycreate_smtp_credentialno sensitive capabilitycreate_tagno sensitive capabilitycreate_zone_recordno sensitive capabilitydelete_alert_ruleno sensitive capabilitydelete_aliasno sensitive capabilitydelete_domainno sensitive capabilitydelete_notificationno sensitive capabilitydelete_organizationno sensitive capabilitydelete_routing_ruleno sensitive capabilitydelete_shared_aliasno sensitive capabilitydelete_smtp_credentialno sensitive capabilitydelete_tagno sensitive capabilitydelete_zone_recordno sensitive capabilitydisable_anonymous_replyno sensitive capabilitydisable_wildcardno sensitive capabilityenable_wildcardno sensitive capabilityexport_aliasesno sensitive capabilityexport_dmarc_reportno sensitive capabilitygenerate_security_reportno sensitive capabilityget_account_contextno sensitive capabilityget_alert_ruleno sensitive capabilityget_alert_rule_historyno sensitive capabilityget_aliasno sensitive capabilityget_alias_activityno sensitive capabilityget_alias_statisticsno sensitive capabilityget_check_catalogno sensitive capabilityget_daily_statisticsno sensitive capabilityget_dashboardno sensitive capabilityget_dmarc_complianceno sensitive capabilityget_dmarc_reportno sensitive capabilityget_dmarc_sourcesno sensitive capabilityget_domainno sensitive capabilityget_domain_dns_recordsno sensitive capabilityget_domain_healthno sensitive capabilityget_domain_statisticsno sensitive capabilityget_email_logno sensitive capabilityget_mail_flowno sensitive capabilityget_notification_preferencesno sensitive capabilityget_quotano sensitive capabilityget_rate_limit_statusno sensitive capabilityget_reputation_blacklistsno sensitive capabilityget_reputation_deliverabilityno sensitive capabilityget_reputation_ipsno sensitive capabilityget_reputation_recommendationsno sensitive capabilityget_reputation_scoreno sensitive capabilityget_reputation_trendsno sensitive capabilityget_retention_policyno sensitive capabilityget_routing_ruleno sensitive capabilityget_security_checksno sensitive capabilityget_security_historyno sensitive capabilityget_security_scoreno sensitive capabilityget_statisticsno sensitive capabilityget_statistics_by_domainno sensitive capabilityget_webhook_secretno sensitive capabilityinvite_to_organizationno sensitive capabilitylist_alert_rulesno sensitive capabilitylist_aliasesno sensitive capabilitylist_all_aliasesno sensitive capabilitylist_all_smtp_credentialsno sensitive capabilitylist_anonymous_repliesno sensitive capabilitylist_api_keysno sensitive capabilitylist_blocklistno sensitive capabilitylist_dmarc_reportsno sensitive capabilitylist_domainsno sensitive capabilitylist_email_logsno sensitive capabilitylist_notificationsno sensitive capabilitylist_organization_domainsno sensitive capabilitylist_organization_membersno sensitive capabilitylist_organizationsno sensitive capabilitylist_routing_rulesno sensitive capabilitylist_shared_aliasesno sensitive capabilitylist_shared_domainsno sensitive capabilitylist_smtp_credentialsno sensitive capabilitylist_tagsno sensitive capabilitylist_webhook_delivery_logsno sensitive capabilitylist_webhooksno sensitive capabilitylist_zone_recordsno sensitive capabilitymark_all_notifications_readno sensitive capabilitymark_notification_readno sensitive capabilitymove_domain_to_organizationno sensitive capabilityregenerate_shared_alias_smtpno sensitive capabilityremove_blocklist_entryno sensitive capabilityremove_organization_memberno sensitive capabilityremove_tag_from_domainno sensitive capabilityreorder_routing_rulesno sensitive capabilityreset_smtp_passwordno sensitive capabilityrevoke_api_keyno sensitive capabilitysearchno sensitive capabilityset_check_overrideno sensitive capabilityset_notification_preferencesno sensitive capabilityset_smtp_reply_fromno sensitive capabilitytest_alert_ruleno sensitive capabilitytrigger_compliance_exportno sensitive capabilitytrigger_security_scanno sensitive capabilityupdate_aliasno sensitive capabilityupdate_domainno sensitive capabilityupdate_organizationno sensitive capabilityupdate_retention_policyno sensitive capabilityupdate_routing_ruleno sensitive capabilityupdate_shared_aliasno sensitive capabilityupdate_tagno sensitive capabilityupdate_zone_recordno sensitive capabilityverify_domain_dnsno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (131 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 2
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v4.0.0 latest |
A 96/100 | 3 | 1.13.0 | 2026-09-07 |
v3.0.1 |
A 96/100 | 3 | 1.12.1 | 2026-08-03 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @ractermx/mcp-server --onlineMore in API Development
Adapters for the FrontMCP framework
Transcend MCP Server — Admin tools.
Transcend MCP Server — Assessments tools.
MCP Server for Bling
MCP Server for Blogger API
Official MCP server for Brilliant Directories — manage members, posts, leads, reviews, and more.