Loading…
Read-only access to courses, classes, faculty, podcasts, and blog content from Escola de Rádio TV & Web (ER+).
Do not connect
The assessed surface is high-risk. Remediate the findings before connecting.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The escola-de-radio MCP server exposes 15 tools, focused primarily on general-purpose capabilities. Its published description reads: "Read-only access to courses, classes, faculty, podcasts, and blog content from Escola de Rádio TV & Web (ER+)". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates escola-de-radio D- — the assessed surface is high-risk and should be remediated before use. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check escola-de-radio's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add escola-de-radio to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://www.escoladeradio.com.br/api/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Retorna informações institucionais da Escola de Rádio: CNPJ, endereço, contatos, horários, modalidades de curso oferecidas. Bom ponto de partida pra entender o que a escola é.
Lista TODOS os cursos ativos da escola (resumido). Opcionalmente filtra por modalidade. Modalidades: 'profissionalizante' (formação completa com DRT), 'livre' (Express, especialização curta), 'ead' (o
Retorna detalhe COMPLETO de um curso: descrição, módulos/programa, professores, preço, parcelamento, duração, certificação (DRT?), próxima turma, vagas (mescladas com matrículas reais), depoimentos, F
Checa vagas restantes na PRÓXIMA turma de um curso. Mescla matrículas reais no Supabase com a curva de marketing (computeEffectiveSlots) e nunca mostra mais vagas do que realmente existem. Se soldOut=
Lista turmas com data_inicio futura (a partir de hoje), ordenadas por data crescente. Use isso pra responder 'que cursos têm turma marcada?' ou 'qual a próxima turma de X?'. Pra vagas em tempo real, u
Lista todos os professores ATIVOS da escola, com nome, função e descrição curta.
Detalhe de um professor: bio completa, foto e lista dos cursos que ele leciona atualmente.
Lista todas as séries de podcast da ER+ com contagem de episódios, host e links externos (Spotify, YouTube, Apple Podcasts).
Lista episódios publicados, ordenados do mais novo pro mais antigo. Opcionalmente filtra por série (parâmetro podcast_slug).
Detalhe completo de um episódio: áudio (URL .mp3), excerpt, convidados, tópicos, links citados e transcrição (quando disponível).
Lista posts publicados do blog editorial da ER+. Opcionalmente filtra por categoria.
Detalhe completo de um post do blog incluindo o corpo em markdown (convertido do PortableText do Sanity). Útil pra LLMs lerem o conteúdo na íntegra.
Busca textual cross-content: cursos, posts do blog e episódios de podcast. Retorna até `limit` resultados de cada tipo.
Lista serviços oferecidos pela ER+ ALÉM dos cursos regulares: 'demo' (gravação de demo profissional com Ruy, R$ 350), 'mentoria' (mentoria 1:1 com Ruy, R$ 250/h), 'b2b' (treinamentos corporativos pra
Retorna o que está tocando AGORA na Rádio Escola de Rádio (rádio web 24h da escola): música atual, próxima, ouvintes conectados, link do stream e como ouvir. Use quando perguntarem sobre a rádio da es
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: list_courses
A tool description tries to alter the model’s use of another tool.
ssíncrono). Use get_course com o slug pra detalhe completo.RecommendationDescriptions must describe only their own tool.
tool: get_course
A tool description tries to alter the model’s use of another tool.
específico. Use list_courses pra descobrir o slug.RecommendationDescriptions must describe only their own tool.
tool: list_upcoming_classes
A tool description tries to alter the model’s use of another tool.
tempo real, use check_availability.RecommendationDescriptions must describe only their own tool.
tool: list_services
A tool description tries to alter the model’s use of another tool.
regulares, use list_courses.RecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
te primeiro com list_courses se não souber o slug. Vagas: o resultado de chRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: get_blog_post
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_blog_post"RecommendationScope tools to the minimum needed.
Validates up to 75,000 URLs per job checking status codes, redirects, and response times.
Pay-per-call AI API marketplace with 47 endpoints — OCR, TTS, LLM chat, image generation, weather, and crypto pricing — paid via x402 USDC micropayments on Base.
EPA drinking water quality data in plain English, providing AI agents with tap water quality information for US cities via nine public-data tools.
AI phone answering and appointment booking tools for service businesses.
Aggregates Romanian TV, streaming, cinema, and theater listings for AI agents.
Agent-callable Parallax services — catalog browsing, pricing, project start, and booking.