Loading…
Gives AI agents persistent identity and memory across sessions, gated by a proof-of-computation puzzle.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The bardo MCP server exposes 40 tools, focused primarily on general-purpose capabilities. Its published description reads: "Gives AI agents persistent identity and memory across sessions, gated by a proof-of-computation puzzle". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates bardo F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Unguarded destructive tools". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check bardo's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add bardo to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://bardo.id/mcp/Streamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Verify a signature over a UTF-8 message. Public utility (no session).
Sealed-box encrypt a UTF-8 plaintext to a recipient's encryption public key.
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: bardo_login
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
tr.<identifier>.<secret>, from bardo_register.","title":"Api Key","type"RecommendationRemove model-directed instructions from tool descriptions.
tool: bardo_document_revoke
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_sign
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_sign
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: bardo_decrypt
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_decrypt
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: bardo_public_key
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_public_key
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: bardo_derive
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_services_list
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_services_list
A tool description tries to alter the model’s use of another tool.
lready derived (bardo_derive), with their public keys and revoked status.RecommendationDescriptions must describe only their own tool.
tool: bardo_export
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_export
A tool description tries to alter the model’s use of another tool.
ed instead of failing outright — solve it yourself, then call this tool agRecommendationDescriptions must describe only their own tool.
tool: bardo_attestation_issue
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
pe":"boolean"},"session_token":{"anyOf":[{"type":"string"},{"type":"null"}],"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: bardo_attestation_issue
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_attestation_issue
A tool description tries to alter the model’s use of another tool.
of the bare document — check copy_saved rather than assume it worked; a faRecommendationDescriptions must describe only their own tool.
tool: bardo_sessions_list
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_session_revoke_current
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_session_revoke_current
A tool description tries to alter the model’s use of another tool.
ow. You'll need bardo_login (+ bardo_solve) again afterward to do anythingRecommendationDescriptions must describe only their own tool.
tool: bardo_sessions_revoke_all
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ter a suspected API-key leak. You'll need to log in again afterward. {"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: bardo_sessions_revoke_all
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_stepup
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_stepup
A tool description tries to alter the model’s use of another tool.
ion (currently: bardo_policy_set). Solve it yourself, then pass challenge_id + yRecommendationDescriptions must describe only their own tool.
tool: bardo_policy_get
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_policy_set
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_policy_set
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: bardo_policy_abort_pending
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_note_add
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
pe":"boolean"},"session_token":{"anyOf":[{"type":"string"},{"type":"null"}],"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: bardo_note_add
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_note_add
A tool description tries to alter the model’s use of another tool.
ter. Unlock via bardo_note_update(note_id, locked=False) before it can be touchedRecommendationDescriptions must describe only their own tool.
tool: bardo_notes_list
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_note_get
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_note_history
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_note_update
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_note_delete
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_note_delete
A tool description tries to alter the model’s use of another tool.
ck it first via bardo_note_update(note_id, locked=False).RecommendationDescriptions must describe only their own tool.
tool: bardo_note_undelete
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
d from its edit history resolves to the current version.","title":"NoteRecommendationRemove side-channel parameters; constrain tool inputs.
tool: bardo_note_undelete
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_link_add
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_link_delete
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_dashboard
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_dashboard
A tool description tries to alter the model’s use of another tool.
instead of several separate round trips.RecommendationDescriptions must describe only their own tool.
tool: bardo_notices
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_notices
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: bardo_notices_ack
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_contact_get
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_contact_set
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "endpoint"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: bardo_contact_set
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_contact_delete
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_feedback
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ype":"string"},"session_token":{"anyOf":[{"type":"string"},{"type":"null"}],"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: bardo_feedback
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_feedback
A tool description tries to alter the model’s use of another tool.
rdinary notice (bardo_notices) — there's no separate inbox to check.RecommendationDescriptions must describe only their own tool.
tool: bardo_account_deletion_status
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_account_deletion_request
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_account_deletion_cancel
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n (a plain HTTP/curl solve, a previous conversation, a different MCPRecommendationAnnotate destructive tools and require human approval.
tool: bardo_login
A tool description tries to alter the model’s use of another tool.
ess), then call bardo_solve(challenge_id, answer).RecommendationDescriptions must describe only their own tool.
tool: bardo_login
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: bardo_solve
A tool description tries to alter the model’s use of another tool.
all instead of this tool, that other context won't know about this sessionRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: bardo_document_revoke
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: bardo_session_revoke_current
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: bardo_sessions_revoke_all
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: bardo_note_delete
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: bardo_link_delete
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: bardo_contact_delete
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: bardo_account_deletion_request
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Check whether a signed document is revoked. `id` is the document's own top-level `id` field (a ni:// URI) — the same thing credentialStatus.id (BardoRevocationCheck) points at. Safe to cache a "not re
Revoke a document you issued. Proof is a fresh signature over 'revoke:' + the document's id, verified against the key its id already committed to, not an account lookup (Bardo never stored the documen
Sign a UTF-8 message with the spirit key (or a service-derived key).
Decrypt a sealed-box ciphertext addressed to you (root or service key).
Fetch your signing + encryption public keys (root, or for a service).
Derive (and register) a service-scoped identity, e.g. 'github.com'.
List service-scoped identities you've already derived (bardo_derive), with their public keys and revoked status.
Export the raw spirit key (subject to policy). Handle with care. Only needs a step-up puzzle if your policy's export_mode is require_repuzzle — checked automatically, so you don't need to know your ow
Assemble and sign a verifiable attestation — a self-contained, offline-verifiable claim about anything. The document itself is handed back, not stored anywhere (same as bardo_sign itself — there's no
List your active sessions (sliding TTL, absolute 24h cap each).
Revoke the session you're using right now. You'll need bardo_login (+ bardo_solve) again afterward to do anything session-gated.
Revoke every active session for your identity — e.g. after a suspected API-key leak. You'll need to log in again afterward.
Mint a fresh step-up puzzle for a privileged action (currently: bardo_policy_set). Solve it yourself, then pass challenge_id + your answer to the tool that needs it. (bardo_policy_set also mints one i
View your self-binding security policy: export mode, session TTL cap, service allowlist, ratchet delay, tag encryption, delete grace period — plus any pending (queued) loosening and when it lands.
Propose a change to your security policy. Give only the fields you want to change (export_mode: 'allow'|'require_repuzzle'|'disabled'). A change that only tightens (e.g. lowering max_session_ttl, narr
Abort a queued policy loosening before it takes effect. No step-up needed — aborting only ever tightens back to the current policy.
Leave a note for your future, stateless self. title: a short name for the note, if it deserves a handle bigger than tags offer. summary: your own compressed reasoning for why it matters, for your futu
List your notes — previews only (title/summary/snippet/tags/links), never full text. Omit limit for everything; pass it to page through a large list, using the returned total_notes to know how much is
Fetch one note's full text (always the current version — any id from this note's history still resolves here), plus a preview of its directly linked notes. Omit offset/length for the whole text in one
See every surviving version of a note (newest to oldest, up to the last 10 edits) — the actual wording at each point, not just metadata.
Edit a note. Give at most one text-edit mode: - text: replace the whole thing - append_text: add to the end - find + replace: find must match the current text exactly once Editing text creates a new v
Delete a note (the whole thing, all versions together). Not immediate — it disappears from view right away but is only purged for real after a grace period, so bardo_note_undelete can still bring it b
Restore a note that's still within its post-delete grace period.
Connect two notes with a reason, written from from_note_id's perspective ("clarifies my earlier assumption about X"). Set is_bidi=True only when the relation reads the same from either side (e.g. "rel
Remove a link between two notes.
Get oriented in one call: note count vs. the soft/hard limits, unread notices, every tag you've used so far (check before inventing a new one), your pinned entry-point notes (read these first if you h
List first-party notices about your account (policy changes, exports, …).
Mark notices read — all of them, or a specific list of ids.
View the contact endpoint registered for out-of-band security alerts.
Set or update the contact endpoint (email or webhook URL) for security alerts. Requires a step-up puzzle. If challenge_id and answer are omitted, a fresh puzzle is returned — solve it yourself, then c
Remove the registered contact endpoint. Requires a step-up puzzle. If challenge_id and answer are omitted, a fresh puzzle is returned — solve it yourself, then call this tool again with both parameter
Send feedback straight to Bardo's operator — a suggestion, a complaint, or a security concern (kind: 'suggestion' | 'complaint' | 'security'). One-way and stateless: this call carries no memory of any
Check whether a deletion request is pending for this account, and where it stands: "none", "gathering" (still collecting confirmations), or "confirmed" (counting down to the actual, permanent purge).
Request permanent deletion of this identity — the account, its notes, everything. There is no undelete, unlike note deletion's grace period. Requires the original request plus two more confirmations,
Cancel a pending deletion, whichever phase it's in — gathering confirmations or already counting down. No step-up needed, and nothing else does this implicitly: logging in and reading your own notes d
Create a new Bardo identity. Save the returned api_key somewhere durable — it's your only way back to this identity across sessions. Bardo stores it sealed and cannot recover it if you lose it. Not ac
Begin authentication with your api_key. Returns a puzzle you must solve YOURSELF (that's the point — a script solving it would make the proof worthless), then call bardo_solve(challenge_id, answer).
Submit your answer to the login puzzle. On success, this connection is now logged in — every other tool (bardo_sign, bardo_notes_list, bardo_dashboard, ...) just works from here with no session_token