Loading…
Deploy files, sites, and Dockerfile apps to live URLs, with private drives for agent memory.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 7 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The dataecho MCP server exposes 26 tools, focused primarily on filesystem capabilities. Its published description reads: "Deploy files, sites, and Dockerfile apps to live URLs, with private drives for agent memory". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates dataecho F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Data-exfiltration parameters". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check dataecho's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add dataecho to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://dataecho.ai/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
DataEcho platform overview: what it can host, auth state of this connection, docs links. Call this first if unsure.
Start sign-in: email a one-time code to the user. Follow with verify_login_code.
Complete sign-in with the emailed code. Returns the apiKey ONCE — configure it as the `Authorization: Bearer <key>` header of this MCP connection (and/or save to ~/.artifact/credentials for the CLI sc
Deploy files to a live URL. No slug → create a NEW site (works without auth; anonymous sites expire in 24h — always show the user the claimUrl). With slug → UPDATE that site (complete snapshot: send A
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: request_login_code
A tool description tries to alter the model’s use of another tool.
er. Follow with verify_login_code.RecommendationDescriptions must describe only their own tool.
tool: publish_site
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
isten on process.env.PORT; persist under /data; poll app_status). ToRecommendationRemove side-channel parameters; constrain tool inputs.
tool: publish_site
A tool description tries to alter the model’s use of another tool.
der /data; poll app_status). Total payload ≤ 8 MB — for bigger sites use tRecommendationDescriptions must describe only their own tool.
tool: claim_site
A tool description tries to alter the model’s use of another tool.
claimToken from publish_site).RecommendationDescriptions must describe only their own tool.
tool: update_site_metadata
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: app_status
A tool description tries to alter the model’s use of another tool.
pp deployed via publish_site with a Dockerfile. Poll until status is `live`RecommendationDescriptions must describe only their own tool.
tool: drive_write_file
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
rite_file Write/overwrite one file in a drive (ETag-safe: pass ifMatch to assert tRecommendationAnnotate destructive tools and require human approval.
tool: drive_delete_file
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
ive_delete_file Delete one file from a drive. {"type":"object","properties":{"dRecommendationAnnotate destructive tools and require human approval.
tool: (server instructions)
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ng the platform API key as `Authorization: Bearer <key>` (get one via rRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
>` (get one via request_login_code → verify_login_code). Container apps: include aRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: publish_site
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "publish_site"RecommendationScope tools to the minimum needed.
tool: update_site_metadata
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "update_site_metadata"RecommendationScope tools to the minimum needed.
tool: delete_site
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_site"RecommendationScope tools to the minimum needed.
tool: create_drive
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_drive"RecommendationScope tools to the minimum needed.
tool: drive_read_file
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: drive_write_file
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "drive_write_file"RecommendationScope tools to the minimum needed.
tool: drive_write_file
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: drive_delete_file
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "drive_delete_file"RecommendationScope tools to the minimum needed.
tool: drive_delete_file
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: drive_share
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "drive_share"RecommendationScope tools to the minimum needed.
tool: drive_history
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "drive_history"RecommendationScope tools to the minimum needed.
tool: list_variables
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "list_variables"RecommendationScope tools to the minimum needed.
tool: set_variable
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "set_variable"RecommendationScope tools to the minimum needed.
tool: delete_variable
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_variable"RecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Make a previously-anonymous site permanent under the authenticated account (requires auth + the claimToken from publish_site).
List all sites owned by the authenticated account.
Full-text search across the authenticated account's sites (names, metadata, and text content).
Full details + current file manifest of an owned site.
Patch site settings without redeploying: viewer title/description, SPA mode, TTL, password (string sets, null removes).
Permanently delete an owned site. Irreversible — confirm with the user first.
Build/run status of a container app deployed via publish_site with a Dockerfile. Poll until status is `live` or `failed`.
List the authenticated account's private cloud drives.
Create a new private drive.
List files in a drive (by drive name or drv_… id), optionally under a path prefix.
Read a file from a drive. Text comes back as utf-8 `content`; binary as `contentBase64`. Files over 1 MB are refused (use the skill scripts).
Write/overwrite one file in a drive (ETag-safe: pass ifMatch to assert the version you read, otherwise the current version is used automatically).
Delete one file from a drive.
Move/rename a file inside a drive.
Mint a scoped drive access token for another agent (perms read|write, optional path prefix + TTL like `7d`). The secret is returned ONCE.
List active share tokens of a drive (secrets are never shown again).
Revoke a drive share token.
Version timeline of a drive (every write is a restorable version).
Restore a drive to a prior version (commits a new version; nothing is lost).
List account variable NAMES (values are write-only — they are injected into proxy calls and container apps, never read back).
Create/update a write-only account secret (uppercase name). Injected as env vars into container apps and as ${VAR} into proxy calls. Optionally pin which upstream hosts may receive it.
Delete an account variable.