Loading…
Interactive video form platform for capturing authentic user responses through video-based surveys.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 9 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The clipform-mcp-server MCP server exposes 29 tools, focused primarily on web and AI capabilities. Its published description reads: "Interactive video form platform for capturing authentic user responses through video-based surveys". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates clipform-mcp-server F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Data-exfiltration parameters" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check clipform-mcp-server's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add clipform-mcp-server to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.clipform.ioStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Create a new Clipform (interactive video-style form). Returns a viewer URL and form ID. When connected via an authenticated MCP client (e.g. claude.ai), the form lands directly in the user's workspace
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: clipform_update_form
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "logo_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: clipform_update_form
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: clipform_add_node
A tool description tries to alter the model’s use of another tool.
g schemas match clipform_create_form.RecommendationDescriptions must describe only their own tool.
tool: clipform_update_node
A tool description tries to alter the model’s use of another tool.
te tool calls. Requires node IDs (returned by clipform_create_form, clipfoRecommendationDescriptions must describe only their own tool.
tool: clipform_upload_media_asset
A tool description tries to alter the model’s use of another tool.
follow up with clipform_attach_node_media to place the returned media_asset_id on a node.RecommendationDescriptions must describe only their own tool.
tool: clipform_complete_media_upload
A tool description tries to alter the model’s use of another tool.
url returned by clipform_upload_media_asset. The API verifies the object actually landed inRecommendationDescriptions must describe only their own tool.
tool: clipform_attach_node_media
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: clipform_set_logic
A tool description tries to alter the model’s use of another tool.
e tool calls. Linear routing (A to B to C) is supported. NOTE: ConditionalRecommendationDescriptions must describe only their own tool.
tool: clipform_search_news
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
imeless topics (history, geography, science). Narrower and less currentRecommendationRemove side-channel parameters; constrain tool inputs.
tool: clipform_generate_video
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "audio_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: clipform_generate_video
A tool description tries to alter the model’s use of another tool.
manually chain clipform_upload_media_asset + clipform_attach_node_media; fire the render aRecommendationDescriptions must describe only their own tool.
tool: clipform_search_media
A tool description tries to alter the model’s use of another tool.
tool calls. Use results to feed into clipform_generate_video for narratedRecommendationDescriptions must describe only their own tool.
tool: clipform_render_composition
A tool description tries to alter the model’s use of another tool.
manually chain clipform_upload_media_asset + clipform_attach_node_media; fire the render aRecommendationDescriptions must describe only their own tool.
tool: clipform_search_music
A tool description tries to alter the model’s use of another tool.
audio track to clipform_generate_video, or as the audio for the slideshow video templaRecommendationDescriptions must describe only their own tool.
tool: clipform_list_compositions
A tool description tries to alter the model’s use of another tool.
rom images, use clipform_generate_video instead.RecommendationDescriptions must describe only their own tool.
tool: clipform_list_video_templates
A tool description tries to alter the model’s use of another tool.
rs directly via clipform_render_composition instead.RecommendationDescriptions must describe only their own tool.
tool: clipform_render_video_template
A tool description tries to alter the model’s use of another tool.
rs. Call clipform_list_video_templates first for available template namesRecommendationDescriptions must describe only their own tool.
tool: clipform_check_render
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: clipform_get_guide
A tool description tries to alter the model’s use of another tool.
workflow - use clipform_get_workflow for that. Available types: quiz, survey, interRecommendationDescriptions must describe only their own tool.
tool: clipform_get_workflow
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "youtube_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: clipform_get_workflow
A tool description tries to alter the model’s use of another tool.
workflow. Optional args by type: - quiz: topic, question_count (8) - quizRecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
form type, and clipform_get_guide for craft detail. Every *_id argument is a UUIDRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: clipform_create_form
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_update_form
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_delete_form
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_update_node
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_delete_node
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_attach_node_media
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_delete_node_media
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_set_logic
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_set_logic
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
eature - do not create conditional branching paths. Each rule maps an option (by its text contentRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: clipform_search_news
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_generate_video
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_search_media
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_render_composition
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_search_music
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_render_video_template
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_fetch_boundary
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: clipform_create_form
An unusually long description is a common injection-padding tactic.
description length 3498 charsRecommendationKeep descriptions concise.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
List forms in your workspace with optional filtering. Returns paginated results (cursor-based). next_cursor is included when more results exist.
Retrieve a form's details including all nodes in sequential order. Returns title, settings, and every node with its options, config, and media status.
Update a form's title, publish status, settings, or tags. Only sends fields that are provided - omitted fields remain unchanged. AI-PROTECTED parameters have restrictions noted in their descriptions.
Move a form and all its nodes to the trash. It stops accepting responses immediately and can be restored later. Requires user confirmation before it runs.
Add a new node to an existing form. Inserted before the end screen by default; after_node_id controls insertion position. Node types and config schemas match clipform_create_form.
Update one or more existing nodes' text, type, config, or options. Pass multiple updates in one call instead of separate tool calls. Requires node IDs (returned by clipform_create_form, clipform_add_n
Delete a node from a form. The logic chain is automatically re-linked (the previous node will point to the next one). Cannot delete the start node or the last end screen. Requires user confirmation be
Put one or more media files into your workspace media library (max 10, uploaded sequentially). This is step one of attaching media to a node - follow up with clipform_attach_node_media to place the re
Confirm a signed-PUT still image upload finished, after PUTting the bytes to the upload_url returned by clipform_upload_media_asset. The API verifies the object actually landed in storage before flipp
Attach an existing workspace media asset (from clipform_upload_media_asset) to one or more nodes (max 10). Pass one item or many; multiple items attach sequentially. Only works on node types that supp
Get the media attached to a node, including processing status. Useful for checking if a video upload has finished processing.
Remove media from a node. Deletes the media record and cleans up external resources (Mux video asset, storage file). Requires user confirmation before it runs.
Set routing logic on one or more nodes. Pass multiple nodes in one call instead of separate tool calls. Linear routing (A to B to C) is supported. NOTE: Conditional branching (different paths based on
Save an audit trail for a generated form. Records where content came from - the sources and image attributions.
Fallback news lookup for clients without native web search. Returns structured current-news articles from NewsAPI and The Guardian. Coverage: recent events, people, and topics (post-May-2025). Does NO
Generate narration audio from text with word-level captions. Use this for quiz question narration, survey introductions, form instructions, or any node that benefits from a human voice. Proactively su
Generate a video from images, video clips, or both, synced to an audio track. Use this for narrated question backgrounds, topic visualisations, or any form node that benefits from video. Combine with
Search images or stock video clips. Pass one query or many (max 10) - multiple queries run in one call instead of separate tool calls. Use results to feed into clipform_generate_video for narrated sli
Render a specialised video composition to MP4 or PNG - custom animated visuals that clipform_generate_video can't provide, such as geography animations or designed motion graphics. Available compositi
Search for royalty-free music tracks and ambient sounds. Quiz forms especially benefit from background music - it keeps energy up between questions. Also consider it for multi-step surveys and longer
Browse available video compositions and their expected props schemas. Call this before using clipform_render_composition to discover visual styles and their input props. For narrated slideshows from i
Browse available video templates - curated Scene arrangements (bed + overlay + sane defaults) that render through the Scene composition from a small controls object. Call this before clipform_render_v
Render a curated video template (a pre-arranged Scene: bed + overlay + sane defaults) to MP4 or PNG from a small controls object, instead of hand-assembling Scene layers. Call clipform_list_video_temp
List available creative assets (sound effects, animations, fonts) for video compositions.
Check the status of render jobs started by clipform_generate_video, clipform_render_video_template, or clipform_render_composition. Pass job_ids to check a whole batch in ONE call - one line of status
Fetch a GeoJSON boundary polygon for a country, city, or region. Returns simplified GeoJSON ready to use as the 'boundary' prop in the Map composition. mainlandOnly excludes small islands and overseas
Retrieve craft knowledge for building a specific form type. Returns question psychology, difficulty curves, narration style, scoring setup, and writing principles as markdown. Does NOT return a step-b
Retrieve a step-by-step build workflow for creating a specific form type. Returns the exact tool sequence, form settings, node configuration, scoring setup, and end screen config as a build recipe. Do