Tenzro MCP Server
tenzro-mcp-server
PyPI
v0.1.1
Published by tenzro — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
MCP server for Tenzro Network — 360 tools for AI agents
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 11 = 89. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 5
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: download_model → get_token_balance → register_webhook. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow download_model → get_token_balance → register_webhook
high Tool "spawn_agent" exposes command/code executionMTC-CAP-001
Tool "spawn_agent" appears to run shell commands or evaluate code (keyword "spawn" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool spawn_agent
high Tool "spawn_from_template" exposes command/code executionMTC-CAP-001
Tool "spawn_from_template" appears to run shell commands or evaluate code (keyword "spawn" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool spawn_from_template
low Mutating tool "spawn_agent" declares no destructiveHintMTC-CAP-005
Tool "spawn_agent" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool spawn_agent
low Mutating tool "spawn_from_template" declares no destructiveHintMTC-CAP-005
Tool "spawn_from_template" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool spawn_from_template
Tools 200
Each tool and what it can reach — statically extracted from the published source.
download_modelingests untrusted inputget_agent_capability_attestationsingests untrusted inputget_block_rangeingests untrusted inputget_capability_attestationsingests untrusted inputget_download_progressingests untrusted inputget_settle_authorized_outcomeingests untrusted inputget_token_balancereads sensitive dataget_token_inforeads sensitive dataget_validator_stateingests untrusted inputregister_webhooknetwork egress
Show 190 more tools ↓
spawn_agentruns code / shellspawn_from_templateruns code / shellap2_protocol_infono sensitive capabilityap2_sign_mandateno sensitive capabilityap2_validate_mandate_pairno sensitive capabilityap2_verify_mandateno sensitive capabilityassign_taskno sensitive capabilityauthorize_database_readno sensitive capabilityauthorize_sessionno sensitive capabilitybridge_quoteno sensitive capabilitybridge_tokensno sensitive capabilitybridge_with_hookno sensitive capabilitycancel_taskno sensitive capabilitychat_by_intentno sensitive capabilitychat_completionno sensitive capabilitychat_streamno sensitive capabilitycheck_complianceno sensitive capabilityclose_payment_channelno sensitive capabilitycomplete_taskno sensitive capabilitycreate_databaseno sensitive capabilitycreate_escrowno sensitive capabilitycreate_mpc_walletno sensitive capabilitycreate_nft_collectionno sensitive capabilitycreate_payment_challengeno sensitive capabilitycreate_swarmno sensitive capabilitycreate_tokenno sensitive capabilitycreate_walletno sensitive capabilitycreate_zk_proofno sensitive capabilitycross_vm_transferno sensitive capabilitydatabase_queryno sensitive capabilitydebridge_get_chainsno sensitive capabilitydebridge_get_instructionsno sensitive capabilitydebridge_search_tokensno sensitive capabilitydecode_resultno sensitive capabilitydecrypt_datano sensitive capabilitydelete_modelno sensitive capabilitydeploy_contractno sensitive capabilityderegister_agentno sensitive capabilityderive_keyno sensitive capabilitydetect_teeno sensitive capabilitydiscover_modelsno sensitive capabilitydrop_databaseno sensitive capabilityencode_functionno sensitive capabilityencrypt_datano sensitive capabilityexchange_tokenno sensitive capabilityexport_keystoreno sensitive capabilityfind_best_agent_for_capabilityno sensitive capabilityforget_identityno sensitive capabilityfreeze_addressno sensitive capabilitygenerate_keypairno sensitive capabilityget_agent_infono sensitive capabilityget_agent_templateno sensitive capabilityget_appno sensitive capabilityget_balanceno sensitive capabilityget_blockno sensitive capabilityget_bridge_routesno sensitive capabilityget_databaseno sensitive capabilityget_database_partitionno sensitive capabilityget_escrowno sensitive capabilityget_eventsno sensitive capabilityget_fee_historyno sensitive capabilityget_gas_priceno sensitive capabilityget_hardware_profileno sensitive capabilityget_key_sharesno sensitive capabilityget_max_priority_fee_per_gasno sensitive capabilityget_nft_infono sensitive capabilityget_node_statusno sensitive capabilityget_priceno sensitive capabilityget_provenanceno sensitive capabilityget_provider_statsno sensitive capabilityget_skillno sensitive capabilityget_skill_usageno sensitive capabilityget_spending_limitsno sensitive capabilityget_svm_cross_vm_program_infono sensitive capabilityget_swarm_statusno sensitive capabilityget_taskno sensitive capabilityget_tee_attestationno sensitive capabilityget_template_statsno sensitive capabilityget_tool_infono sensitive capabilityget_tool_usageno sensitive capabilityget_trainer_daemon_statusno sensitive capabilityget_transaction_receiptno sensitive capabilityget_voting_powerno sensitive capabilityhash_keccak256no sensitive capabilityhash_sha256no sensitive capabilityimport_keystoreno sensitive capabilityintrospect_tokenno sensitive capabilityissue_database_connectionno sensitive capabilityjoin_as_participantno sensitive capabilitylink_wallet_for_authno sensitive capabilitylist_active_validatorsno sensitive capabilitylist_agent_templatesno sensitive capabilitylist_agentsno sensitive capabilitylist_appsno sensitive capabilitylist_bridge_adaptersno sensitive capabilitylist_canton_domainsno sensitive capabilitylist_capabilitiesno sensitive capabilitylist_daml_contractsno sensitive capabilitylist_database_enginesno sensitive capabilitylist_database_partitionsno sensitive capabilitylist_databasesno sensitive capabilitylist_mandatesno sensitive capabilitylist_model_endpointsno sensitive capabilitylist_modelsno sensitive capabilitylist_nft_collectionsno sensitive capabilitylist_payment_protocolsno sensitive capabilitylist_proposalsno sensitive capabilitylist_providersno sensitive capabilitylist_registered_toolsno sensitive capabilitylist_skillsno sensitive capabilitylist_tasksno sensitive capabilitylist_tee_providersno sensitive capabilitylist_tokensno sensitive capabilitylist_validatorsno sensitive capabilitylist_x402_schemesno sensitive capabilitylist_zk_circuitsno sensitive capabilitymint_nftno sensitive capabilityoauth_discoveryno sensitive capabilityonboard_autonomous_agentno sensitive capabilityonboard_delegated_agentno sensitive capabilityonboard_humanno sensitive capabilityopen_payment_channelno sensitive capabilitypost_taskno sensitive capabilityquote_taskno sensitive capabilityrate_templateno sensitive capabilityrecord_route_outcomeno sensitive capabilityrefresh_tokenno sensitive capabilityrefund_escrowno sensitive capabilityregister_agentno sensitive capabilityregister_agent_templateno sensitive capabilityregister_appno sensitive capabilityregister_complianceno sensitive capabilityregister_identityno sensitive capabilityregister_nft_pointerno sensitive capabilityregister_providerno sensitive capabilityregister_skillno sensitive capabilityregister_toolno sensitive capabilityrelease_escrowno sensitive capabilityrequest_faucetno sensitive capabilityrescale_databaseno sensitive capabilityresolve_didno sensitive capabilityresolve_usernameno sensitive capabilityrevoke_didno sensitive capabilityrevoke_sessionno sensitive capabilityrotate_keysno sensitive capabilityrotate_validator_keyno sensitive capabilityroute_by_intentno sensitive capabilityroute_difficulty_statsno sensitive capabilityseal_datano sensitive capabilitysearch_agent_templatesno sensitive capabilitysearch_skillsno sensitive capabilitysearch_toolsno sensitive capabilitysend_agent_messageno sensitive capabilitysend_self_custody_transactionno sensitive capabilitysend_transactionno sensitive capabilityserve_modelno sensitive capabilityset_app_statusno sensitive capabilityset_delegation_scopeno sensitive capabilityset_spending_limitsno sensitive capabilityset_usernameno sensitive capabilitysettle_authorizedno sensitive capabilitysettle_paymentno sensitive capabilitysign_messageno sensitive capabilitystake_tokensno sensitive capabilitystop_modelno sensitive capabilitysubmit_daml_createno sensitive capabilitysubmit_daml_exerciseno sensitive capabilitysubscribe_eventsno sensitive capabilitysubscribe_events_streamno sensitive capabilityterminate_swarmno sensitive capabilitytoken_balanceno sensitive capabilitytotal_supplyno sensitive capabilitytransfer_nftno sensitive capabilityunseal_datano sensitive capabilityunstake_tokensno sensitive capabilityuse_registered_toolno sensitive capabilityuse_skillno sensitive capabilityverify_paymentno sensitive capabilityverify_signatureno sensitive capabilityverify_tee_attestation_rpcno sensitive capabilityverify_zk_proofno sensitive capabilityvote_on_proposalno sensitive capabilitywrap_tnzono sensitive capabilityx25519_key_exchangeno sensitive capabilityx402_deregister_resourceno sensitive capabilityx402_discover_resourcesno sensitive capabilityx402_payment_idno sensitive capabilityx402_protocol_infono sensitive capabilityx402_register_resourceno sensitive capabilityx402_verify_offerno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.1.1 latest |
B 89/100 | 5 | 1.13.0 | 2026-08-25 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan tenzro-mcp-server --online --registry pypiMore in Developer Tools
Hotel booking MCP server — 300K+ properties, real confirmation numbers, loyalty programs. Builders monetize every booking via Stripe Connect. The first MCP server that completes real hotel reservations inside AI conversations.
Manage AdGuard Home through AI assistants
Read-only Azure DevOps for MCP clients using only your existing browser session — no PAT, no Azure CLI. Browse work items, pull requests, comments, attachments and Artifacts feeds across every project, repo and feed you can access.
MCP server for Adobe Experience Manager Assets integration development
Servidor MCP para el tiempo oficial de España (API pública OpenData de AEMET). Predicción, observación y avisos como herramientas MCP tipadas.
A standalone MCP stdio bridge for Affinity by Canva's local MCP SSE server.