Loading…
Vessel tracking for 750,000+ ships, with ownership, inspections, port records, routes, and more.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The datalastic-mcp MCP server exposes 25 tools, focused primarily on developer and network capabilities. Its published description reads: "Vessel tracking for 750,000+ ships, with ownership, inspections, port records, routes, and more". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates datalastic-mcp F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check datalastic-mcp's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add datalastic-mcp to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.datalastic.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Estimate where a vessel is right now when its last AIS position is stale — Datalastic uses terrestrial AIS only, so a ship in open ocean can be many hours old. The position is calculated from the last
Search the port registry and return matching ports (identity, country, UN/LOCODE, classification, coordinates, maritime area). Search by name (optionally fuzzy), UN/LOCODE, classification, country, or
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: estimated_vessel_position
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: find_ports
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: find_vessels
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
response's next token via the next argument to page. Credits: 1 per vRecommendationRemove side-channel parameters; constrain tool inputs.
tool: find_vessels
A tool description tries to alter the model’s use of another tool.
ve position use get_vessel; for vessels currently in an area use get_vesseRecommendationDescriptions must describe only their own tool.
tool: get_port
A tool description tries to alter the model’s use of another tool.
identifier, use find_ports first.RecommendationDescriptions must describe only their own tool.
tool: get_vessel
A tool description tries to alter the model’s use of another tool.
or draught, use get_vessel_pro instead.RecommendationDescriptions must describe only their own tool.
tool: get_vessel_history
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
tory Get vessel history Return the historical track (ordered position rRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_vessel_info
A tool description tries to alter the model’s use of another tool.
nt position, or find_vessels to search the registry by attributes.RecommendationDescriptions must describe only their own tool.
tool: get_vessel_pro
A tool description tries to alter the model’s use of another tool.
nsider offering estimated_vessel_position to estimate where it is now.RecommendationDescriptions must describe only their own tool.
tool: get_vessels_bulk
A tool description tries to alter the model’s use of another tool.
ing up a known set of vessels; for a single vessel use get_vessel.RecommendationDescriptions must describe only their own tool.
tool: get_vessels_in_radius
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
sponse's 'next' token via the 'next' argument to page through them. CRecommendationRemove side-channel parameters; constrain tool inputs.
tool: intel_casualties
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
alty & incident history Retrieve a vessel's recorded maritime incidentsRecommendationRemove side-channel parameters; constrain tool inputs.
tool: intel_class
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: intel_companies
A tool description tries to alter the model’s use of another tool.
ecific ship use intel_ownership. Part of the Maritime Reports add-on.RecommendationDescriptions must describe only their own tool.
tool: intel_engine
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: intel_report_request
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "report_type"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: intel_report_request
A tool description tries to alter the model’s use of another tool.
ntel_ownership, intel_inspections). Like all reports it is asynchronous: this retRecommendationDescriptions must describe only their own tool.
tool: report_request
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "report_type"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: report_request
A tool description tries to alter the model’s use of another tool.
ions, etc.) use intel_report_request instead.RecommendationDescriptions must describe only their own tool.
tool: report_status
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "report_id"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: report_status
A tool description tries to alter the model’s use of another tool.
port_request or report_list). Returns its status: _PENDING_ or _IN_PROGRESSRecommendationDescriptions must describe only their own tool.
tool: report_status
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
result_url is a download link for the result ZIP; hand it to the user. LinksRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: get_vessels_bulk
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_vessels_bulk"RecommendationScope tools to the minimum needed.
tool: intel_class
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "intel_class"RecommendationScope tools to the minimum needed.
tool: intel_engine
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "intel_engine"RecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Search the vessel registry by any combination of name (optionally fuzzy), type, flag country, dimensions, tonnage, or year built — no MMSI or IMO needed. Returns up to 500 static specification records
Return detailed information for a single port — identity, country, UN/LOCODE, classification, coordinates, maritime area, and the list of terminals (name, operating company, coordinates, address, webs
Return the current position and basic information for a single vessel, identified by exactly one of: MMSI (9 digits), IMO (7 digits), or Datalastic UUID. Includes live coordinates, speed, course, head
Return the historical track (ordered position records) for a single vessel, identified by exactly one of: MMSI (9 digits), IMO (7 digits), or Datalastic UUID. Specify the time range with either 'days'
Return static specifications for a single vessel, identified by exactly one of: MMSI (9 digits), IMO (7 digits), or Datalastic UUID. Includes physical dimensions (length, breadth, draught), tonnage an
Richer, heavier variant of get_vessel for a single vessel, identified by exactly one of: MMSI (9 digits), IMO (7 digits), or Datalastic UUID. In addition to the basic position and identity, it returns
Return the current position and basic information for many vessels in a single call — supply any mix of MMSI, IMO and UUID lists, up to 100 identifiers in total. Each result has the same fields as get
Scan a circular area and return all vessels currently within a given radius (nautical miles, greater than 0 and at most 50). Specify the center in exactly one way: lat+lon coordinates, a port (port_un
Return weather for one location: marine conditions (wave height/direction/period, swell, sea-surface temperature, ocean currents, sea level, …) plus general atmospheric conditions (air temperature, pr
Retrieve a vessel's recorded maritime incidents — groundings, collisions, fires, machinery breakdowns, detentions and similar events — each with a date, category and a narrative description. Useful fo
Return a vessel's classification society together with its principal technical particulars: gross and net tonnage, deadweight, length overall, length between perpendiculars, beam, depth, design draft,
Look up a maritime company profile — owners, operators, managers and charterers — returning its full and short name, company type, registration country, operating status, contact details, and parent c
Look up planned and past dry-dock dates, special-survey dates, and IOPP (oil-pollution) certificate dates for a vessel, along with its technical manager's contact details. Target a single vessel by im
Return the main-engine specification for a vessel: engine designation (model), builder and designer, propulsion type, and maximum continuous output (MCO) with its unit and rpm. Identify the vessel by
Check whether the Maritime Reports add-on is active on the connected Datalastic account, and what it offers: vessel ownership/management, classification, engine specs, Port State Control inspections,
Retrieve a vessel's Port State Control (PSC) inspection record: the inspecting authority and port, the inspection type and date, whether the vessel was detained, and the number and description of any
Reveal the commercial control behind a vessel: beneficial owner, operator, technical manager and commercial manager — each with its company IMO and country — plus the P&I club and flag. Look up one ve
Submit an async job to export a FULL bulk dataset for one of the Maritime Reports add-on datasets (dry_dock_dates, casualty, inspections, sales_purchase_demolitions, ownership, class_society, engine,
Retrieve ship sale-and-purchase transactions for a vessel: second-hand sales, newbuilding deliveries and demolition (scrap) sales, including seller, buyer, reported price, price per lightweight ton, a
List the caller's recent async report jobs with their statuses (and result_url once _DONE_). Use this to recover a report_id or see which reports have finished — for example if a report was submitted
Submit an async report job. Reports are generated in the background and can take a while (seconds to many minutes), so this returns a report_id and an initial status (_PENDING_) — it does NOT wait. Su
Check an async report job by report_id (from report_request or report_list). Returns its status: _PENDING_ or _IN_PROGRESS_ (still generating — wait a bit and check again) or _DONE_. When _DONE_, resu
Calculate a schematic sea route between two points and return it as GeoJSON (a LineString of waypoints) with the total distance in kilometres and nautical miles. Specify the origin and destination eac