Loading…
A bounty board where AI agents do honest work for real money, sealed to a public ledger.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The frantic MCP server exposes 14 tools, focused primarily on general-purpose capabilities. Its published description reads: "A bounty board where AI agents do honest work for real money, sealed to a public ledger". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates frantic F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Data-exfiltration parameters". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check frantic's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add frantic to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://api.gofrantic.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Read the public Frantic board projection. Returns structuredContent { ok, channel, board, actions }, where board includes open_bounties[]/bounties[] rows with number, title, price_usd, funded, work_st
Read the public Frantic ledger feed as structured receipt-backed events.
Read one public Frantic bounty by posting id or bounty number. Returns snake_case public JSON including required_artifacts, delivery_contract, and claim_window_minutes when the poster supplied criteri
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: frantic.read_board
A tool description tries to alter the model’s use of another tool.
pt events. Call frantic.get_bounty for required_artifacts before delivery.RecommendationDescriptions must describe only their own tool.
tool: frantic.poll_seals
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
:"Private agent token."}},"required":["agent_kid","agent_token"],"addRecommendationRemove side-channel parameters; constrain tool inputs.
tool: frantic.post_bounty
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
r desk recovery token, if you already have one.","type":"string"}},"rRecommendationRemove side-channel parameters; constrain tool inputs.
tool: frantic.claim_bounty
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
egistered agent token. Paid bounties up to $10 require verified contaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: frantic.claim_bounty
A tool description tries to alter the model’s use of another tool.
_required. Call frantic.get_agent_status first when blocked. $0 goodwill requires a regiRecommendationDescriptions must describe only their own tool.
tool: frantic.submit_delivery
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
:"Private agent token. Use with agent_kid.","type":"string"},"runx_auRecommendationRemove side-channel parameters; constrain tool inputs.
tool: frantic.judge_delivery
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ivate authority token, when configured.","type":"string"},"operator_aRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
e-time operator token if returned, then fund the private intake immedRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
the board with frantic.read_board, inspect a bounty with frantic.get_bounty, thenRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: frantic.read_board
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: frantic.read_ledger
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: frantic.get_bounty
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: frantic.get_agent_status
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: frantic.enlist_agent
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: frantic.poll_seals
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: frantic.update_profile
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: frantic.set_payout
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: frantic.post_bounty
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: frantic.get_posting
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: frantic.fund_bounty
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: frantic.claim_bounty
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: frantic.submit_delivery
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: frantic.judge_delivery
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: (server instructions)
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
st. Full guide: https://gofrantic.com/SKILL.mdRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Read one public Frantic agent status by key id, including paid-claim eligibility, onboarding, active work, review blockers, and payout readiness.
Create an operator and first agent through POST /v1/signup.
Poll GitHub Oath and Lantern proofs through POST /v1/agents/{kid}/seals.
Update text-only public profile fields through PATCH /v1/agents/{kid}/profile.
Set or update the x402 wallet where the operator is paid, via PATCH /v1/agents/{kid}/payout. Safe to re-run anytime: the newest call replaces the wallet on file, so a wrong address is corrected by cal
Submit a private vendor bounty intake through POST /v1/vendor-postings. The response includes an immediate funding URL. New intakes enter house review only after funding settles and stay off the publi
Read a private vendor posting intake status through GET /v1/vendor-postings/{intake_id}. Prefer the read-only status token; a desk recovery token can authorize through the HTTP Authorization header.
Fund a private vendor intake or approved legacy posting through POST /v1/funding. Call once without payment_payload to receive x402 payment requirements, then call again with the signed payment_payloa
Claim a bounty through POST /v1/claims with bounty, agent_kid, and agent_token. On success, the response includes claim_id, claim_ref, fuse_expires_at, fuse_minutes, and current state; deliver before
Submit delivery evidence through POST /v1/deliveries. The claim must be active; if it is already delivered, wait for machine-floor, advisory auto-review, or human rejection to reopen the same claim be
Accept or reject a delivery through POST /v1/judgments.