Loading…
Detects AI-generated images, videos, and audio including deepfakes using the identifAI analysis platform.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 7 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The identifai-mcp-server MCP server exposes 19 tools, focused primarily on web capabilities. Its published description reads: "Detects AI-generated images, videos, and audio including deepfakes using the identifAI analysis platform". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates identifai-mcp-server F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Data-exfiltration parameters" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check identifai-mcp-server's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add identifai-mcp-server to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.identifai.netStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Upload an image file to detect whether it is human-made or AI-generated. Provide the image content as a base64-encoded string. Returns a classification identifier for async result retrieval. WARNING:
Submit a publicly accessible image URL to detect whether it is human-made or AI-generated. Returns a classification identifier for result retrieval. Supports the same analysis options as file-based cl
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: classify_image
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
your Identifai API key via the apiKey parameter or configure the X-ApiRecommendationRemove side-channel parameters; constrain tool inputs.
tool: classify_image
A tool description tries to alter the model’s use of another tool.
than 4 MB, use classify_image_url instead and provide a publicly accessible URL tRecommendationDescriptions must describe only their own tool.
tool: classify_image
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: classify_image_url
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
your Identifai API key via the apiKey parameter or configure the X-ApiRecommendationRemove side-channel parameters; constrain tool inputs.
tool: classify_image_url
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_image_classification
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"properties":{"apiKey":{"description":"Identifai API key used to authRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_image_classification
A tool description tries to alter the model’s use of another tool.
ier returned by classify_image or classify_image_url. Poll this endpoint untilRecommendationDescriptions must describe only their own tool.
tool: get_image_classification
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_all_image_classifications
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"properties":{"apiKey":{"description":"Identifai API key used to authRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_all_image_classifications
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_classification_heatmap
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"properties":{"apiKey":{"description":"Identifai API key used to authRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_classification_heatmap
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: override_image_classification
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"properties":{"apiKey":{"description":"Identifai API key used to authRecommendationRemove side-channel parameters; constrain tool inputs.
tool: override_image_classification
A tool description tries to alter the model’s use of another tool.
lassification verdict for a previously classified image. Sets the resultRecommendationDescriptions must describe only their own tool.
tool: override_image_classification
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: classify_video
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
your Identifai API key via the apiKey parameter or configure the X-ApiRecommendationRemove side-channel parameters; constrain tool inputs.
tool: classify_video
A tool description tries to alter the model’s use of another tool.
than 10 MB, use classify_video_url instead and provide a publicly accessible URL tRecommendationDescriptions must describe only their own tool.
tool: classify_video
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: classify_video_url
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
your Identifai API key via the apiKey parameter or configure the X-ApiRecommendationRemove side-channel parameters; constrain tool inputs.
tool: classify_video_url
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_video_classification
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"properties":{"apiKey":{"description":"Identifai API key used to authRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_video_classification
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_all_video_classifications
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"properties":{"apiKey":{"description":"Identifai API key used to authRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_all_video_classifications
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: override_video_classification
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"properties":{"apiKey":{"description":"Identifai API key used to authRecommendationRemove side-channel parameters; constrain tool inputs.
tool: override_video_classification
A tool description tries to alter the model’s use of another tool.
lassification verdict for a previously classified video. Sets the resultRecommendationDescriptions must describe only their own tool.
tool: override_video_classification
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: classify_audio
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
your Identifai API key via the apiKey parameter or configure the X-ApiRecommendationRemove side-channel parameters; constrain tool inputs.
tool: classify_audio
A tool description tries to alter the model’s use of another tool.
than 10 MB, use classify_audio_url instead and provide a publicly accessible URL tRecommendationDescriptions must describe only their own tool.
tool: classify_audio
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: classify_audio_url
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
your Identifai API key via the apiKey parameter or configure the X-ApiRecommendationRemove side-channel parameters; constrain tool inputs.
tool: classify_audio_url
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_audio_classification
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"properties":{"apiKey":{"description":"Identifai API key used to authRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_audio_classification
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_all_audio_classifications
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"properties":{"apiKey":{"description":"Identifai API key used to authRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_all_audio_classifications
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: override_audio_classification
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"properties":{"apiKey":{"description":"Identifai API key used to authRecommendationRemove side-channel parameters; constrain tool inputs.
tool: override_audio_classification
A tool description tries to alter the model’s use of another tool.
lassification verdict for a previously classified audio file. Sets the rRecommendationDescriptions must describe only their own tool.
tool: override_audio_classification
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_user_credits
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"properties":{"apiKey":{"description":"Identifai API key used to authRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_user_credits
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: submit_tampering_tickets
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
your Identifai API key via the apiKey parameter or configure the X-ApiRecommendationRemove side-channel parameters; constrain tool inputs.
tool: submit_tampering_tickets
A tool description tries to alter the model’s use of another tool.
nchronously via get_tampering_batch_results using the returned batch_id. Supports PDF filesRecommendationDescriptions must describe only their own tool.
tool: submit_tampering_tickets
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_tampering_batch_results
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"properties":{"apiKey":{"description":"Identifai API key used to authRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_tampering_batch_results
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "apiKey"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: classify_image
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "classify_image"RecommendationScope tools to the minimum needed.
tool: override_image_classification
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "override_image_classification"RecommendationScope tools to the minimum needed.
tool: classify_video
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "classify_video"RecommendationScope tools to the minimum needed.
tool: override_video_classification
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "override_video_classification"RecommendationScope tools to the minimum needed.
tool: classify_audio
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "classify_audio"RecommendationScope tools to the minimum needed.
tool: override_audio_classification
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "override_audio_classification"RecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Retrieve the classification result for a previously submitted image. Use the identifier returned by classify_image or classify_image_url. Poll this endpoint until the result is available.
Retrieve classification results for multiple images in a single request. Accepts up to 100 identifiers. Useful for batch result polling.
Retrieve a visual heatmap highlighting which regions of the image were detected as AI-generated. Requires the classification to have been submitted with withHeatmap enabled.
Manually override the classification verdict for a previously classified image. Sets the result to either "human" or "artificial". Used for corrections and feedback.
Upload a video file to detect whether it is human-made or AI-generated. Provide the video content as a base64-encoded string. The video is split into frames which are individually classified. Returns
Submit a publicly accessible video URL for AI-generated content detection. Supports the same frame extraction and analysis options as file-based classification. Authentication: provide your Identifai
Retrieve the classification result for a previously submitted video. Poll until the result is ready — video classification is always asynchronous.
Retrieve classification results for multiple videos in a single request. Accepts up to 100 identifiers.
Manually override the classification verdict for a previously classified video. Sets the result to either "human" or "artificial".
Upload an audio or speech file to detect whether it is human-recorded or AI-synthesized. Provide the audio content as a base64-encoded string. Returns a classification identifier for async result retr
Submit a publicly accessible audio URL for AI-generated speech detection. Returns a classification identifier for async result retrieval. Authentication: provide your Identifai API key via the apiKey
Retrieve the classification result for a previously submitted audio file. Poll until the result is ready.
Retrieve classification results for multiple audio files in a single request. Accepts up to 100 identifiers.
Manually override the classification verdict for a previously classified audio file. Sets the result to either "human" or "artificial".
Retrieve the current available and used classification credits for the authenticated Identifai account. Use this to check quota status before submitting large batches.
Submit one or more ticket images (as base64-encoded strings) to the Identifai v2 API for batch tampering detection. Each ticket is analysed independently; results are retrieved asynchronously via get_
Retrieve the tampering detection results for a previously submitted batch of tickets. Poll until the "done" field is true. Each result contains a verdict ("authentic" or "tampered") and per-heuristic