Loading…
Feedback layer for video: reviewers leave timestamped comments and voice notes that AI agents read as structured feedback.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 8 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The flask MCP server exposes 17 tools, focused primarily on filesystem capabilities. Its published description reads: "Feedback layer for video: reviewers leave timestamped comments and voice notes that AI agents read as structured feedback". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates flask F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check flask's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add flask to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://api.flask.do/api/mcp/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Browse contents. Without folder_id: lists what's at the team's top level (root) — both folders and assets that live directly at root. With folder_id: opens that folder and returns its child folders an
List top-level feedback on an asset. Returns each item's text body, tags (by name), author, timestamp, and reply_count. Recording items are ONE comment per recording: the text body is the AI-organized
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: feedback_list
A tool description tries to alter the model’s use of another tool.
o see them. Use feedback_get to read full reply threads.RecommendationDescriptions must describe only their own tool.
tool: feedback_get
A tool description tries to alter the model’s use of another tool.
ender them with get_annotated_frames), and all nested replies.RecommendationDescriptions must describe only their own tool.
tool: wait_for_feedback
A tool description tries to alter the model’s use of another tool.
stead of repeatedly calling feedback_list.RecommendationDescriptions must describe only their own tool.
tool: feedback_post
A tool description tries to alter the model’s use of another tool.
anchored) note. tags applies the team's EXISTING tags by name (see tRecommendationDescriptions must describe only their own tool.
tool: feedback_update
A tool description tries to alter the model’s use of another tool.
team's existing tags by NAME and work on ANY feedback item you can cRecommendationDescriptions must describe only their own tool.
tool: get_annotated_frames
A tool description tries to alter the model’s use of another tool.
l unclear, call get_frame to drill into a specific moment (at) or spokenRecommendationDescriptions must describe only their own tool.
tool: get_frame
A tool description tries to alter the model’s use of another tool.
word). Use when get_annotated_frames did not show what a reference ('this','here','tRecommendationDescriptions must describe only their own tool.
tool: recent_activity
A tool description tries to alter the model’s use of another tool.
and trends use feedback_stats instead.RecommendationDescriptions must describe only their own tool.
tool: upload_video
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "video_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: upload_video
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: upload_file_start
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
bytes with the curl command from next_step, then call upload_file_cRecommendationAnnotate destructive tools and require human approval.
tool: upload_file_start
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: upload_file_complete
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
only AFTER the curl PUT has finished successfully. Verifies the filRecommendationAnnotate destructive tools and require human approval.
tool: upload_file_complete
A tool description tries to alter the model’s use of another tool.
ad started with upload_file_start. Call this only AFTER the curl PUT has finishedRecommendationDescriptions must describe only their own tool.
tool: feedback_stats
A tool description tries to alter the model’s use of another tool.
instead of calling feedback_list per asset. For reading the feedback textRecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
t a headless/CI/SSH run), also open the link for them so the windowRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
L and the exact curl command to upload the bytes. - Upload (WRITE):RecommendationAnnotate destructive tools and require human approval.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
d of typing. AI extracts summaries and transcripts from recordings. All tRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: contents
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
With folder_id: opens that folder and returns its child folders and assets (videoRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: contents
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "folder_id"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: feedback_update
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: upload_video
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: upload_video
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
You still need edit access on the folder if one is given. For a LOCAL file on disk, useRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: upload_video
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "folder_id"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: upload_file_start
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: upload_file_start
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
You still need edit access on the folder if one is given. {"$schema":"http://json-schemaRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: upload_file_start
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "folder_id"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: upload_file_complete
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: (server instructions)
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
[View feedback](https://flask.do/a/def?element=123) > **Mike** · 1 day ago · 1:45 > "Love this trRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Get a single feedback item with its full reply thread. Returns the item's text body (for recordings: the AI-organized feedback), tags (by name), author, video timestamp, the recording's full verbatim
Wait for NEW feedback on an asset. Blocks up to timeout_seconds (default 45) and returns as soon as feedback newer than `since` arrives, or times out with an empty list. To listen continuously, call i
Create a feedback comment on an asset, as the connected user. PREFER passing timestamp (seconds into the video) whenever the source material has one - e.g. when importing feedback from an email like '
Edit an existing feedback item. content (replaces the text) and timestamp (video time in seconds) can only be changed on the connected user's OWN comments. add_tags / remove_tags apply the team's exis
Supplementary visuals for a feedback item. For recording items: the media under review with the reviewer's drawing rendered in, plus their shared SCREEN when they demonstrated something (e.g. a Photos
Drill into a recording for MORE visual detail: get the exact frame at a specific time (at) or when a specific word/phrase was spoken (word). Use when get_annotated_frames did not show what a reference
Check the processing status of a video asset. Returns progress percentage for videos being processed, or confirms the asset is ready.
See who has access to a folder and their permission levels (full_access, comment, view, none). Returns team members with their roles, plus link and team-member default access levels.
Search across your team's folders, assets, and feedback by text. Always returns all three categories together.
Get the latest comments across your team, newest first. Returns a mix of text and recording comments with author, timestamp, and a link to jump into the conversation. Each item has a `type` field ("te
List the team's tags and show the share of each tag (plus an 'untagged' bucket) across a scope. Scope defaults to the whole team; pass folder_id to narrow to one folder, or asset_id to narrow to one a
Upload a video from a public URL (a direct video file link or a Google Drive share link) into Flask. Flask downloads it, stores it, and starts processing. Returns the new asset_id — poll asset_status(
Start uploading a LOCAL video file from the user's machine into Flask. Returns the shareable Flask link immediately, plus a presigned upload URL. After calling this, upload the file bytes with the cur
Finalize a local file upload started with upload_file_start. Call this only AFTER the curl PUT has finished successfully. Verifies the file landed in storage and starts video processing. Safe to retry
Aggregate feedback statistics across many assets in ONE call - counts per asset and per version (v1, v2, ...), split by type (text/recording), tag, and author, with first/last feedback timestamps. Sco