Loading…
Validate trading signals, backtests, parameter sweeps, and track records: overfitting and PBO checks, signed verdicts. Not advice.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The alphaassay MCP server exposes 21 tools, focused primarily on general-purpose capabilities. Its published description reads: "Validate trading signals, backtests, parameter sweeps, and track records: overfitting and PBO checks, signed verdicts". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates alphaassay F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Data-exfiltration parameters". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check alphaassay's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add alphaassay to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.alphaassay.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Use this when you want to see AlphaAssay's exact verdict envelope -- schema, findings, leakage taxonomy -- on a built-in example before spending a check. A methodology audit; no buy/sell advice. Free
Use this when you have a backtest result or live track record (a trades log, equity curve or QuantConnect export) and need to know whether the edge is real or just overfitting, survivorship or luck. V
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: assay_demo
A tool description tries to alter the model’s use of another tool.
n strategy with assay_signal. Price: free.RecommendationDescriptions must describe only their own tool.
tool: assay_signal
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
repaid account (api_key required -- create one at https://api.alphaassaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_signal
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_reproduce
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
1/meta/pricing (api_key required -- account setup at https://api.alphaaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_reproduce
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_tradelog
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
1/meta/pricing (api_key required -- account setup at https://api.alphaaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_tradelog
A tool description tries to alter the model’s use of another tool.
ht lints shape, assay_reproduce audits arithmetic against candles; this tool neRecommendationDescriptions must describe only their own tool.
tool: assay_tradelog
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_forensics
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
1/meta/pricing (api_key required -- account setup at https://api.alphaaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_forensics
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_backtest
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
1/meta/pricing (api_key required -- account setup at https://api.alphaaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_backtest
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_gauntlet
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
1/meta/pricing (api_key required -- account setup at https://api.alphaaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_gauntlet
A tool description tries to alter the model’s use of another tool.
gate killed the signal first (machine-readable failure_codes), the placeboRecommendationDescriptions must describe only their own tool.
tool: assay_gauntlet
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_falsify
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
1/meta/pricing (api_key required -- account setup at https://api.alphaaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_falsify
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_pbo
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
1/meta/pricing (api_key required -- account setup at https://api.alphaaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_pbo
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_var_es
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
1/meta/pricing (api_key required -- account setup at https://api.alphaaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_var_es
A tool description tries to alter the model’s use of another tool.
set class. NOT financial advice; no order path. Price: per check; see httpRecommendationDescriptions must describe only their own tool.
tool: assay_var_es
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_conformal
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
1/meta/pricing (api_key required -- account setup at https://api.alphaaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_conformal
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_survivors
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
1/meta/pricing (api_key required -- account setup at https://api.alphaaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_survivors
A tool description tries to alter the model’s use of another tool.
N trial matrix assay_pbo grades (rows = time-ordered periods, columns =RecommendationDescriptions must describe only their own tool.
tool: assay_survivors
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_cpcv
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
u have a return history and want the full combinatorial purged cross-vaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_cpcv
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_batch
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
1/meta/pricing (api_key required -- account setup at https://api.alphaaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_batch
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: assay_batch
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_register
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
1/meta/pricing (api_key with the register scope required -- account setRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_register
A tool description tries to alter the model’s use of another tool.
later verdict (assay_verdict) uses exclusively data from AFTER registration.RecommendationDescriptions must describe only their own tool.
tool: assay_register
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_verdict
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
1/meta/pricing (api_key required -- account setup at https://api.alphaaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_verdict
A tool description tries to alter the model’s use of another tool.
registered with assay_register and the maturity window has passed -- get the pRecommendationDescriptions must describe only their own tool.
tool: assay_verdict
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: assay_provider_protocol
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
(the full issue history incl. losers), pre-registration (ten sealed forRecommendationRemove side-channel parameters; constrain tool inputs.
tool: assay_preflight
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
d of assuming universal fields. For example, Gauntlet exposes its first faRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: assay_signal
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_reproduce
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_reproduce
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
per check; see https://api.alphaassay.com/v1/meta/pricing (api_key required -- account setup at https://aRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: assay_tradelog
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_forensics
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_backtest
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_backtest
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
per check; see https://api.alphaassay.com/v1/meta/pricing (api_key required -- account setup at https://aRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: assay_gauntlet
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_gauntlet
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
per check; see https://api.alphaassay.com/v1/meta/pricing (api_key required -- account setup at https://aRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: assay_falsify
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_pbo
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_var_es
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_conformal
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_survivors
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_cpcv
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_batch
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_batch
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
id variant; see https://api.alphaassay.com/v1/meta/pricing (api_key required -- account setup at https://aRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: assay_register
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_verdict
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: assay_var_es
An unusually long description is a common injection-padding tactic.
description length 2260 charsRecommendationKeep descriptions concise.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Use this when someone hands you a claimed track record and you want to recompute it yourself from the fills and candles -- an arithmetic audit of the numbers, not buy/sell advice. Independently recomp
Use this when you have a raw fill or trade log and want it scanned for internal contradictions -- look-ahead timestamps, pnl that disagrees with the row's own prices, duplicate or out-of-order fills.
Use this when a signal looks good but you suspect leakage or look-ahead and want to know WHY it fails, not just that it fails -- a diagnostic audit, it does not give buy/sell advice. Leakage forensics
Use this when you want a code-computed DSL backtest whose deflated- Sharpe verdict still means something after repeated searching -- every run is priced into your family's trial ledger. A research aud
Use this when you want the whole reality-check battery on a strategy in one call -- overfitting, leakage, costs, regimes and a matched-random placebo -- as a demote-only dossier, never buy/sell advice
Use this when you want your strategy actively attacked -- execution lag, cost stress, regime split, parameter neighbourhood, drift-burst -- to see what kills it first. Demote-only; it does not give bu
Use this when you have the T x N returns of a grid search and want the probability of backtest overfitting (PBO, CSCV) -- did the sweep find an edge or manufacture one? A demote-only audit, not buy/se
Use this when you have VaR or Expected-Shortfall forecasts and need to know whether reality breached them more often or deeper than your claimed tail level allows -- a risk-forecast audit, not buy/sel
Use this when your model emits prediction intervals or confidence bands and you want to audit whether realised outcomes actually fall inside them at the claimed coverage -- a calibration audit, not ad
Use this when you ran a grid or parameter sweep and want to know WHICH variants survive family-wise error control (FWER) rather than surfacing by chance -- an error-budget disclosure, not buy/sell adv
Use this when you have a return history and want the full combinatorial purged cross-validation (CPCV) distribution -- not one walk-forward number -- to see how path-dependent the edge really is. The
Use this when you optimised over a grid and want to submit the WHOLE sweep honestly -- every variant a ledger trial the family budget prices, so selection bias cannot hide. A research audit, not buy/s
Use this when you want to seal a strategy and its success criteria NOW, before the forward data exists, so that registration cannot be adapted or backfilled against those later bars -- a commitment au
Use this when a signal was pre-registered with assay_register and the maturity window has passed -- get the post-cutoff verdict computed only from data after registration. A sealed audit, it gives no
Use this when you want to check, for free, how often a signal family (e.g. sma_cross) has already been falsified and what usually kills it, before spending a check. Anonymised stats only -- no buy/sel
Use this when you want to inspect AlphaAssay's current public calibration state for free rather than trust marketing. Calibration v0 is a population/status disclosure, not an outcome score or track re
Use this when someone hands you a signed AlphaAssay certificate and you want to verify both its Ed25519 signature and current platform trust. A verification tool, not buy/sell advice. Verify a signed
Use this when you want to judge ANY signal seller -- including us -- with a machine-readable seven-test falsification protocol you can run in an afternoon. It scores methodology, not markets: no buy/s
Use this when you want to lint the SHAPE of a submission (DSL spec, candles or trades) for free before spending a check, so a typo never costs you one. A format check only -- it gives no buy/sell advi