Loading…
Agent infrastructure for email, phone, social accounts, domains, VPS, and crypto wallets, paid per-action via x402 with no API key required.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The ai.palmyr/palmyr MCP server exposes 33 tools, focused primarily on communication capabilities. Its published description reads: "Agent infrastructure for email, phone, social accounts, domains, VPS, and crypto wallets, paid per-action via x402 with no API key required". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates ai.palmyr/palmyr F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check ai.palmyr/palmyr's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add ai.palmyr/palmyr to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://palmyr.ai/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
List every paid Palmyr capability and its live x402 price (USDC on Solana/Base). Free — no payment required.
List the i402 capabilities Palmyr can plan and execute (the intent-resolver catalog). Free — no payment required.
State an intent, get a priced execution plan. The i402 orchestrator turns a natural-language outcome into an ordered list of x402 calls your agent signs and runs. Costs 0.10 USDC per plan, paid per-ac
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: card_buy
A tool description tries to alter the model’s use of another tool.
ration_id: poll card_status until ready (~10s), then fetch the number withRecommendationDescriptions must describe only their own tool.
tool: card_status
A tool description tries to alter the model’s use of another tool.
hase started by card_buy (free). done=true when status is 'ready' (fetchRecommendationDescriptions must describe only their own tool.
tool: card_list
A tool description tries to alter the model’s use of another tool.
re per-card via card_get). 0.01 USDC ownership proof.RecommendationDescriptions must describe only their own tool.
tool: email_extend_temp
A tool description tries to alter the model’s use of another tool.
y a new one via email_create_temp). Costs 0.50 USDC, paid per-action via x402.RecommendationDescriptions must describe only their own tool.
tool: wait_for_otp
A tool description tries to alter the model’s use of another tool.
that blows its per-match budget is dropped mid-wait and pattern_timeoutRecommendationDescriptions must describe only their own tool.
tool: phone_temp_number
A tool description tries to alter the model’s use of another tool.
ted number with phone_buy_number. Pool numbers are recycled after the lease, soRecommendationDescriptions must describe only their own tool.
tool: phone_extend_temp
A tool description tries to alter the model’s use of another tool.
a fresh one via phone_temp_number). Costs 0.20 USDC, paid per-action via x402.RecommendationDescriptions must describe only their own tool.
tool: tiktok_post
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "video_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: tiktok_post
A tool description tries to alter the model’s use of another tool.
on to poll with tiktok_operation_status. Costs 0.01 USDC, paid per-action via x402.RecommendationDescriptions must describe only their own tool.
tool: tiktok_operation_status
A tool description tries to alter the model’s use of another tool.
tion started by tiktok_post / tiktok_analytics / tiktok_cancel_scheduled (fRecommendationDescriptions must describe only their own tool.
tool: tiktok_connect
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
th the returned token. Costs 0.01 USDC, paid per-action via x402. {"tRecommendationRemove side-channel parameters; constrain tool inputs.
tool: tiktok_connect
A tool description tries to alter the model’s use of another tool.
er. Async: poll tiktok_connect_status with the returned token. Costs 0.01 USDC, paidRecommendationDescriptions must describe only their own tool.
tool: tiktok_connect_status
A tool description tries to alter the model’s use of another tool.
ogin started by tiktok_connect (free). done=true when state is 'completed' (thRecommendationDescriptions must describe only their own tool.
tool: tiktok_analytics
A tool description tries to alter the model’s use of another tool.
on to poll with tiktok_operation_status. Costs 0.005 USDC, paid per-action via x402.RecommendationDescriptions must describe only their own tool.
tool: tiktok_series
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
kTok engagement history Read the stored per-post history for an accountRecommendationRemove side-channel parameters; constrain tool inputs.
tool: tiktok_series
A tool description tries to alter the model’s use of another tool.
mples come from tiktok_analytics runs, so history exists only for what you haveRecommendationDescriptions must describe only their own tool.
tool: tiktok_hooks
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ding no posting history — the answer for a brand-new account (0.05 USDCRecommendationRemove side-channel parameters; constrain tool inputs.
tool: tiktok_hooks
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: tiktok_niches
A tool description tries to alter the model’s use of another tool.
List the niches tiktok_hooks can report on, with how fresh each corpus is. FRecommendationDescriptions must describe only their own tool.
tool: tiktok_scheduled
A tool description tries to alter the model’s use of another tool.
ave queued with tiktok_post(schedule_at), and whether each is still pendingRecommendationDescriptions must describe only their own tool.
tool: tiktok_cancel_scheduled
A tool description tries to alter the model’s use of another tool.
ost queued with tiktok_post(schedule_at). TikTok has no 'unschedule', so thRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: palmyr_capabilities
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "palmyr_capabilities"RecommendationScope tools to the minimum needed.
tool: email_send
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "email_send"RecommendationScope tools to the minimum needed.
tool: phone_send_sms
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "phone_send_sms"RecommendationScope tools to the minimum needed.
tool: twitter_post
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "twitter_post"RecommendationScope tools to the minimum needed.
tool: tiktok_post
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "tiktok_post"RecommendationScope tools to the minimum needed.
tool: tiktok_analytics
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "tiktok_analytics"RecommendationScope tools to the minimum needed.
tool: tiktok_series
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "tiktok_series"RecommendationScope tools to the minimum needed.
tool: tiktok_cancel_scheduled
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "tiktok_cancel_scheduled"RecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Buy a USA prepaid Visa card loaded with EXACTLY the requested balance ($5–$1000). Dynamic x402 price = amount + fee (3% min 0.50 USDC) — the 402 instructions carry the exact total. Returns 202 with an
Poll a card purchase started by card_buy (free). done=true when status is 'ready' (fetch details with card_get) or 'failed' (payment auto-refunded — see refund_status).
Retrieve a prepaid card you own: full card number, CVV, expiry, live balance. Owner-verified (0.01 USDC ownership proof; the paying wallet must be the card's buyer).
List cards owned by the paying wallet: status, last4, balance (never full numbers — those are per-card via card_get). 0.01 USDC ownership proof.
Provision an email inbox at {name}@palmyr.ai (or a custom domain you own), keyed to your wallet. Costs 2.00 USDC, paid per-action via x402.
Provision a cheap, disposable, receive-only email inbox — ideal for receiving a one-off verification or order-confirmation email during a checkout/signup flow. The address (a natural-looking handle on
Rent another 7 days on a live disposable temp inbox — each call pushes expires_at exactly 7 days further (fixed, stackable, no cap). Owner-only; expired temp inboxes cannot be revived (buy a new one v
Send an email from an inbox you own. Costs 0.08 USDC, paid per-action via x402.
Read decrypted messages from an inbox you own (payment wallet must match the inbox). Costs 0.02 USDC, paid per-action via x402.
Provision a real phone number (SMS + voice) for your agent. Costs 3.00 USDC, paid per-action via x402.
Send an SMS from a phone number you own. Costs 0.05 USDC, paid per-action via x402.
Read SMS messages received on a phone number you own. Costs 0.02 USDC, paid per-action via x402.
Wait for an SMS verification code / OTP to arrive on a Palmyr phone number you own, and return the parsed code. Blocks up to timeout_s (default 60, max 90) checking every ~2s — one call replaces hand-
Lease a cheap, instant, receive-only US phone number from a pool to receive one SMS verification code — the phone analogue of a disposable temp email inbox. $0.20 for 30 min (ttl_seconds, clamped 300–
Rent another 30 minutes on a live disposable temp number — each call pushes expires_at 30 min further (stackable up to 24h total lease). Owner-only; expired temp leases cannot be revived (lease a fres
Post a tweet from an X account you control (via injected session cookies). Costs 0.001 USDC, paid per-action via x402.
Post a video to a TikTok account you control (from video_base64 or video_url), immediately or scheduled. Async: returns an operation to poll with tiktok_operation_status. Costs 0.01 USDC, paid per-act
Poll an async TikTok operation started by tiktok_post / tiktok_analytics / tiktok_cancel_scheduled (free). done=true when status is 'posted' / 'done' (carries video_url or the op's result) or 'failed'
Attach a TikTok account by logging in ON THE SERVER, into that account's own persistent browser profile: returns a connect_url to hand a human, who scans the QR in the TikTok app. The recommended path
Poll a server-side login started by tiktok_connect (free). done=true when state is 'completed' (the account is live and usable with cookies omitted) or 'failed'.
List the TikTok accounts the paying wallet owns, with session health (status, profile_present, hours_since_success, last_error_code) — i.e. which of your accounts are still logged in. Costs 0.001 USDC
Scrape per-post analytics (views, likes, comments, shares) for a TikTok account you control, and record a sample so tiktok_series can answer 'is it still growing'. Async: returns an operation to poll
Read the stored per-post history for an account you own: the full time series for one video (video_id), per-video growth over a window (hours), or the latest sample per video (neither). Samples come f
Which caption openings actually earn views. Pass account_id or tag to measure YOUR accounts against their own median (0.001 USDC). Pass niche to report what is working in that niche across TikTok, nee
List the niches tiktok_hooks can report on, with how fresh each corpus is. Free — an agent should not pay to learn what it may ask for.
List the posts you have queued with tiktok_post(schedule_at), and whether each is still pending, due, or confirmed published. Palmyr's own record — TikTok exposes no way to read pending posts back, so
Cancel a post queued with tiktok_post(schedule_at). TikTok has no 'unschedule', so this deletes the held video — the cancellation is recorded only once that succeeded. Async: returns an operation to p
Check domain availability and per-TLD pricing. Pass a full domain (example.com) or a bare name to scan popular TLDs. Free — no payment required.
Register a domain to your wallet. Priced per TLD — the exact quote is returned in the 402 challenge, paid per-action via x402.
Deploy a cloud VPS keyed to your wallet (optionally auto-installs OpenClaw/skills). Priced per server type — the exact quote is returned in the 402 challenge, paid per-action via x402.