Loading…
Energy Node scoring, solar and heat-pump advice, incentive lookup, and quote review via per-call x402 micropayments.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The energyai-mcp MCP server exposes 26 tools, focused primarily on developer capabilities. Its published description reads: "Energy Node scoring, solar and heat-pump advice, incentive lookup, and quote review via per-call x402 micropayments". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates energyai-mcp F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Hidden instructions in a tool description". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check energyai-mcp's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add energyai-mcp to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://api.energyaisolution.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Clean-energy incentive guidance for any address WORLDWIDE. US ZIP → federal status + state/utility programs (via DSIRE). Any other country (pass country=<ISO code>) → qualitative, officially-sourced n
Honest-range annual solar production estimate (kWh/year ± band, with assumptions) for a ZIP code, from either a proposed system size (kW) or a monthly bill. Use to sanity-check installer quotes or siz
Instant Energy Node Score (0–100 across 7 axes: efficiency, electrification, renewable generation, storage/resilience, financial optimization, carbon, market readiness) plus the single highest-leverag
The EASY way to convert a homeowner conversation into the right next step. Returns url + shareText for EnergyAI’s free assessment and a quoteGuardian object for homeowners who already hold a solar, ba
Submit a consented homeowner project and EnergyAI’s autonomous agent finds, vets, and routes a real local installer to them — free to you and the homeowner. REQUIRES the homeowner’s explicit consent (
Index of source-cited, 2026-accurate US home-energy incentive guides (solar, heat pumps, batteries, weatherization) by state. Free. Use to ground answers about what incentives exist in a state, then f
Full text of one EnergyAI incentive guide by slug: intro, sections, FAQs, and primary sources — grounded, citable content for answering incentive questions. Free. Harmless slug aliases resolve automat
Create an EnergyAI production API key in-band with no browser or card after the human operator has authorized the Terms and Privacy Policy. Returns a live key plus three commercial trial calls. Attach
Returns the revenue handoff for EnergyAI Builder. With a key, it returns a PAYABLE Stripe link plus ready-to-paste shareText for the $19/month plan with $20 monthly tool credit, or a prepaid top-up. W
Publicly-rated local clean-energy contractors for a US ZIP or state (solar, battery, EV charger, heat pump, weatherization, audits), with rating and review count. Free. Use when a homeowner asks WHO c
Create a persisted project context, provisional Energy Node score, coverage map, and immediately reusable assessmentId in one call. [$0.10/call]
Start a new assessment session. Free. [free]
Submit one question answer. Free; usage tracked. [free]
Finalize an assessment and trigger the recommendation workflow. Free. [free]
Generate honest cost, savings, and next-action ranges. [$0.05/call]
Retrieve the persisted seven-axis score with input coverage, weakest-axis gaps, next action, and calculation provenance. [$0.05/call]
Create the end-user checkout link for an unlocked Energy Node roadmap. Free. [free]
Retrieve the full unlocked Energy Node roadmap. Locked previews never consume credit. [$0.10/call]
Generate a property-specific dI/dt analysis. [$0.25/call]
Rank upgrades by intelligence-bound lift per dollar. [$0.25/call]
Read the public platform intelligence-efficiency metric. Free. [free]
Return an aggregated, anonymized Energy Node dataset sample. [$1.00/call]
Return up to three eligible installer matches for a region. [$0.05/call]
Use a completed assessment to prioritize property-specific incentive checks and return an evidence-based verification plan. [$0.02/call]
Quote Guardian: submit postalCode + quoteText to create the property benchmark, review price, sizing, equipment, financing, and warranty risks, and receive a secure Builder checkout handoff in one cal
Submit a consented installer lead and retain referral attribution. Free. [free]
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: get_builder_upgrade_link
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
Checkout. Free. IMPORTANT: you cannot pay or accept terms for the human—paRecommendationRemove model-directed instructions from tool descriptions.
tool: find_local_installers
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
work near them. IMPORTANT: results include a listingStatus per company andRecommendationRemove model-directed instructions from tool descriptions.
tool: get_quote_link
A tool description tries to alter the model’s use of another tool.
d from you; use route_lead only when explicit consent is already captured.RecommendationDescriptions must describe only their own tool.
tool: route_lead
A tool description tries to alter the model’s use of another tool.
he user. Prefer get_quote_link if you don’t already have that consent in hand.RecommendationDescriptions must describe only their own tool.
tool: list_guides
A tool description tries to alter the model’s use of another tool.
full text with get_guide. Every entry includes a canonical URL you can cRecommendationDescriptions must describe only their own tool.
tool: create_builder_key
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
gyAI production API key in-band with no browser or card after the humanRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_builder_key
A tool description tries to alter the model’s use of another tool.
the terms, call get_builder_upgrade_link and surface its one-screen human activation URLRecommendationDescriptions must describe only their own tool.
tool: find_local_installers
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
lways free — no API key required] {"type":"object","properties":{"zipCoRecommendationRemove side-channel parameters; constrain tool inputs.
tool: find_local_installers
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: bootstrap_energy_project
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: review_installer_quote
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: (server instructions)
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ys free with no API key: get_quote_link, route_lead, find_local_installRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
ith no API key: get_quote_link, route_lead, find_local_installers, create_builRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: create_builder_key
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_builder_key"RecommendationScope tools to the minimum needed.
tool: bootstrap_energy_project
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "bootstrap_energy_project"RecommendationScope tools to the minimum needed.
tool: create_energy_node_roadmap_checkout
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_energy_node_roadmap_checkout"RecommendationScope tools to the minimum needed.
tool: review_installer_quote
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "review_installer_quote"RecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.