Loading…
Hypothesis-free pattern discovery in tabular data with statistical validation.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 8 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The Disco MCP server exposes 14 tools, focused primarily on general-purpose capabilities. Its published description reads: "Hypothesis-free pattern discovery in tabular data with statistical validation". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates Disco F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Data-exfiltration parameters" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check Disco's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add Disco to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://disco.leap-labs.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
List available Disco plans with pricing. No authentication required. Returns all available subscription tiers with credit allowances and pricing. Use this to help users choose a plan.
Estimate the credits required to run a Disco analysis. Returns `required_credits` for public (always 0) and private, with private split by whether LLMs are enabled (use_llms=False is faster, use_llms=
Upload a dataset file and return a file reference for use with discovery_analyze. Call this before discovery_analyze. Pass the returned result directly to discovery_analyze as the file_ref argument. P
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: discovery_estimate
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
uired — when an API key is supplied, also returns the caller's avaiRecommendationRemove side-channel parameters; constrain tool inputs.
tool: discovery_estimate
A tool description tries to alter the model’s use of another tool.
all this before discovery_analyze whenever cost or feasibility is unclear. ARecommendationDescriptions must describe only their own tool.
tool: discovery_estimate
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: discovery_upload
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
file_content: File contents, base64-encoded. For small files when a URL orRecommendationRemove side-channel parameters; constrain tool inputs.
tool: discovery_upload
A tool description tries to alter the model’s use of another tool.
ce for use with discovery_analyze. Call this before discovery_analyze. PassRecommendationDescriptions must describe only their own tool.
tool: discovery_upload
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: discovery_analyze
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
(email code, no password needed). Call discovery_upload first to upRecommendationRemove side-channel parameters; constrain tool inputs.
tool: discovery_analyze
A tool description tries to alter the model’s use of another tool.
edits. Call discovery_estimate first to check cost. Private report URLs requirRecommendationDescriptions must describe only their own tool.
tool: discovery_analyze
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: discovery_status
A tool description tries to alter the model’s use of another tool.
s after calling discovery_analyze. Use discovery_get_results to fetch full reRecommendationDescriptions must describe only their own tool.
tool: discovery_status
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: discovery_get_results
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
nalyze. api_key: Disco API key (disco_...). Optional if DISCOVERecommendationRemove side-channel parameters; constrain tool inputs.
tool: discovery_get_results
A tool description tries to alter the model’s use of another tool.
ID returned by discovery_analyze. api_key: Disco API key (disco_...). OpRecommendationDescriptions must describe only their own tool.
tool: discovery_get_results
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: discovery_account
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: discovery_signup
A tool description tries to alter the model’s use of another tool.
mail, then call discovery_signup_verify to complete signup and receive the API key.RecommendationDescriptions must describe only their own tool.
tool: discovery_signup_verify
A tool description tries to alter the model’s use of another tool.
Call this after discovery_signup returns {"status": "verification_required"}.RecommendationDescriptions must describe only their own tool.
tool: discovery_login
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
login Get a new API key for an existing Disco account. Sends a 6-dRecommendationRemove side-channel parameters; constrain tool inputs.
tool: discovery_login
A tool description tries to alter the model’s use of another tool.
his email — use discovery_signup instead. Args: email: Email addresRecommendationDescriptions must describe only their own tool.
tool: discovery_login_verify
A tool description tries to alter the model’s use of another tool.
Call this after discovery_login returns {"status": "verification_required"}.RecommendationDescriptions must describe only their own tool.
tool: discovery_add_payment_method
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
's API. api_key: Disco API key (disco_...). Optional if DISCOVERecommendationRemove side-channel parameters; constrain tool inputs.
tool: discovery_add_payment_method
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: discovery_purchase_credits
A tool description tries to alter the model’s use of another tool.
on file — use discovery_add_payment_method first. Args: packs: Number of 100-RecommendationDescriptions must describe only their own tool.
tool: discovery_purchase_credits
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: discovery_subscribe
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: discovery_analyze
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: discovery_purchase_credits
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: discovery_subscribe
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: discovery_analyze
An unusually long description is a common injection-padding tactic.
description length 2332 charsRecommendationKeep descriptions concise.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Run Disco on tabular data to find novel, statistically validated patterns. This is NOT another data analyst — it's a discovery pipeline that systematically searches for feature interactions, subgroup
Check the status of a Disco run. Returns current status and progress details: - status: "pending" | "processing" | "completed" | "failed" - job_status: underlying job queue status - queue_position: po
Fetch the full results of a completed Disco run. Returns discovered patterns (with conditions, p-values, novelty scores, citations), feature importance scores, a summary with key insights, column stat
Check your Disco account status. Returns current plan, available credits (subscription + purchased), and payment method status. Use this to verify you have sufficient credits before running a private
Create a Disco account and get an API key. Provide an email address to start the signup flow. If email verification is required, returns {"status": "verification_required"} — the user will receive a 6
Complete Disco signup using an email verification code. Call this after discovery_signup returns {"status": "verification_required"}. The user receives a 6-digit code by email — pass it here along wit
Get a new API key for an existing Disco account. Sends a 6-digit verification code to the email address. Call discovery_login_verify with the code to receive a new API key. Use this when you need an A
Complete login and receive a new API key. Call this after discovery_login returns {"status": "verification_required"}. The user receives a 6-digit code by email — pass it here along with the same emai
Attach a Stripe payment method to your Disco account. The payment method must be tokenized via Stripe's API first — card details never touch Disco's servers. Required before purchasing credits or subs
Purchase Disco credit packs using a stored payment method. Credits cost $0.10 each, sold in packs of 100 ($10/pack). Credits are used for private analyses (public analyses are free). Requires a paymen
Subscribe to or change your Disco plan. Available plans: - "free_tier": Explorer — free, 10 credits/month - "tier_1": Researcher — $49/month, 500 credits/month - "tier_2": Team — $199/month, 2000 cred