Loading…
Create and track AI-generated music videos and audio-reactive visuals from songs.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The compeller-mcp MCP server exposes 30 tools, focused primarily on communication capabilities. Its published description reads: "Create and track AI-generated music videos and audio-reactive visuals from songs". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates compeller-mcp F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Data-exfiltration parameters" and "Data-exfiltration parameters". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check compeller-mcp's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add compeller-mcp to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://compeller.ai/api/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Get Compeller platform capabilities, supported features, and API version.
Get current Compeller subscription plans and pricing.
List available visual styles for Compeller video generation.
Get upload instructions for media files (audio, images, video). Returns the upload URL and required headers. Requires API token authentication.
Search Deezer preview tracks by song, artist, or album. Use this when the user provides a song string but no MP3/WAV/FLAC file.
Create a compel from a selected Deezer preview track. If the user provides an audio file instead, upload that file and use create_compel.
Create a Compeller generation job from primary audio media and optional reference media. Returns compel id, status, and links to track progress and retrieve renderings.
Get the current status, progress, and details of a Compeller generation job.
Start rendering a READY compel with default configuration so an agent can continue to final MP4 without opening the browser UI.
List all Compeller generation jobs for the authenticated account, newest first.
Search Compeller generation jobs by title for the authenticated account.
List all video renderings for a specific compel.
Get details of a specific video rendering.
Search and list uploaded media files for the authenticated account.
Register an HTTPS endpoint to receive signed push notifications for compel lifecycle events (compel.ready when renderable, compel.completed, compel.failed). Returns webhook_id and the HMAC-SHA256 sign
List all webhook endpoints registered for the authenticated account. Secrets are never returned by this tool.
Delete a webhook endpoint by id. Removes the registration and stops future deliveries.
Synchronously POST a synthetic webhook.test event to a registered endpoint. Uses the same HMAC-SHA256 signature as real deliveries, runs the standard URL safety check at delivery time, and returns {we
Update one or more mutable fields on a registered webhook endpoint: url, events, active. At least one of these must be provided. Validation mirrors register_webhook (https-only, <= 2048 chars, URL saf
Mint a new HMAC-SHA256 signing secret for a registered webhook endpoint. The previous secret is invalidated immediately - integrators must update their receiver before the next compel terminal event f
Cancel an in-progress compel. Dequeues it if still queued, otherwise cancels any active external (AI provider) tasks and transitions it to CANCELLED. Idempotent - cancelling an already-CANCELLED compe
Get the authenticated account's render-minute balance and plan: minutes remaining (free + paid), monthly allowance, plan code, and whether the quota is exceeded. Call before starting an expensive rend
List the COM-497 starter lighting effects available to launch as cues (e.g. "gobo-cycle", "x-move", "dimmer-pulse"). Each effect carries an id, the capabilities it needs, and a launch_contract templat
Launch a starter lighting effect onto a stage as a live cue (e.g. "gobo-cycle on the stage's 7R beams at speed 0.5"). Pass effect_id (from list_lighting_effects) and optional variables to override eff
List the live (non-stopped) lighting cues REACT is executing, including each cue's launch_id, resolved variables, launch_contract, and feedback. Optionally scope to one stage.
Fetch a single live lighting cue by its launch_id, including resolved variables, launch_contract, and REACT feedback.
Stop a live cue by its launch_id. Idempotent - the cue is marked stop-requested so REACT drops it on its next refresh.
Update variables on a live cue (e.g. change cycle speed or intensity mid-show). Only the variables you pass change; the rest keep their current values. Stopped cues are rejected.
REACT/BAE acknowledgement for a launch_id. Idempotently records whether the executor accepted or rejected the cue and which executor observed it.
REACT/BAE report-back for cue status, active variables, skipped bindings, capability misses, last_frame_at, and errors.
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: upload_media
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
s. Requires API token authentication. {"type":"object","properties":{RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_compel_from_music
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "artist_context"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_compel_from_music
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: create_compel
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "artist_context"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_compel
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: register_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: delete_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "webhook_id"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: test_webhook_delivery
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "webhook_id"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "webhook_id"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_webhook
A tool description tries to alter the model’s use of another tool.
idation mirrors register_webhook (https-only, <= 2048 chars, URL safety blocklisRecommendationDescriptions must describe only their own tool.
tool: rotate_webhook_secret
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "webhook_id"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: list_lighting_effects
A tool description tries to alter the model’s use of another tool.
s effect_id for launch_lighting_cue.RecommendationDescriptions must describe only their own tool.
tool: launch_lighting_cue
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: register_webhook
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: delete_webhook
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: test_webhook_delivery
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: update_webhook
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: rotate_webhook_secret
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: cancel_compel
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: stop_lighting_cue
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.