Loading…
Provides influencer discovery and creator search across Instagram, TikTok, and YouTube with audience analytics.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The influship MCP server exposes 22 tools, focused primarily on general-purpose capabilities. Its published description reads: "Provides influencer discovery and creator search across Instagram, TikTok, and YouTube with audience analytics". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates influship F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check influship's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add influship to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.influship.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Use this when a ChatGPT user wants to see what Influship can return before linking an account. Fetches one configured sample creator with social profile context. This is a preview tool and should not
Find a creator by name/handle, while preserving legacy semantic creator search. Use this as the default creator lookup tool when the user gives a creator-ish string but not a canonical creator UUID: a
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: search_creators
A tool description tries to alter the model’s use of another tool.
ement", prefer `semantic_search_creators` because its name is explicit and less likely tRecommendationDescriptions must describe only their own tool.
tool: semantic_search_creators
A tool description tries to alter the model’s use of another tool.
le lookup, use `search_creators`. For multiple known handles, use `lookup_profiRecommendationDescriptions must describe only their own tool.
tool: autocomplete_creators
A tool description tries to alter the model’s use of another tool.
— prefer over `search_creators` for handle-style queries where the user alreadRecommendationDescriptions must describe only their own tool.
tool: find_lookalike_creators
A tool description tries to alter the model’s use of another tool.
results. Use `semantic_search_creators` instead when you have a topic/niche but no seeRecommendationDescriptions must describe only their own tool.
tool: match_creators
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "intent_context"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: match_creators
A tool description tries to alter the model’s use of another tool.
discovery. Use `search_creators` first when you only need to resolve rough creaRecommendationDescriptions must describe only their own tool.
tool: get_creator
A tool description tries to alter the model’s use of another tool.
ID returned by `search_creators`, `semantic_search_creators`, `autocomplete_cRecommendationDescriptions must describe only their own tool.
tool: get_profile
A tool description tries to alter the model’s use of another tool.
de. Do not use `search_creators` for an exact platform+username lookup. ExamplRecommendationDescriptions must describe only their own tool.
tool: get_profile
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
rm, username). Always use this first when the user gives an exact handle on a specifRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: lookup_profiles
A tool description tries to alter the model’s use of another tool.
ame input, use `search_creators` or `autocomplete_creators`. Use `semantic_searRecommendationDescriptions must describe only their own tool.
tool: get_posts
A tool description tries to alter the model’s use of another tool.
nce, then call `match_creators`.RecommendationDescriptions must describe only their own tool.
tool: get_instagram_post_transcript
A tool description tries to alter the model’s use of another tool.
ost field; use `get_instagram_post` when you need post metadata with a cached tranRecommendationDescriptions must describe only their own tool.
tool: get_instagram_post_transcripts
A tool description tries to alter the model’s use of another tool.
ache hits; use `get_instagram_posts` when you also need post metadata for every shoRecommendationDescriptions must describe only their own tool.
tool: get_tiktok_video
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: list_tiktok_video_comments
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_tiktok_video_transcript
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: render_creator_shortlist
A tool description tries to alter the model’s use of another tool.
search_id after semantic_search_creators so the exact ranking, confidence, and evidenceRecommendationDescriptions must describe only their own tool.
tool: render_creator_shortlist
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
lookup results. Always call an Influship data tool first; do not invent IDs. This fetches stored creatorRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: render_creator_comparison
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context"RecommendationRemove side-channel parameters; constrain tool inputs.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: get_tiktok_profile
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_tiktok_profile_videos
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_tiktok_video
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_tiktok_video_comments
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_tiktok_video_transcript
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
The server exposes one or more ui:// (MCP Apps) resources whose HTML/JS renders inside the host client — a client-side injection / data-exposure surface most scanners ignore. Flagged for review, not damning on its own.
1 ui:// resource(s); e.g. ui://influship/creator-workspace-v3.htmlRecommendationReview each ui:// resource’s markup and scripts; treat host-rendered UI as untrusted, sandbox it, and never expose secrets or conversation context to it.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Semantic discovery search for influencers/content creators using natural-language queries. Use this only when the user asks to discover creators by topic, audience, geography, niche, content style, or
Autocomplete creator names, usernames, or display names from partial input. Use this for fast lookup when the user types a partial handle or name and you need to resolve it to canonical creator IDs (e
Find creators SIMILAR to one or more seed creators. Use this when the user already knows a creator they like and wants more like them (e.g., "find creators like @therock", "find more creators like the
Score how well specific creators fit a campaign brief or search intent. Use this when the user already has candidate creators in mind and wants to evaluate fit (e.g., "rate these 5 creators for a vega
Fetch the full record for a single creator by ID or exact platform username. Use this when you already have either: - a canonical creator UUID returned by `search_creators`, `semantic_search_creators`
Fetch a single social profile by (platform, username). Always use this first when the user gives an exact handle on a specific platform (for example "@niickjackson on Instagram") and you need the full
Batch-fetch up to 100 profiles by (platform, username) pairs. Use this when the user has a list of handles and you need profile data for all of them at once (e.g., "give me follower counts for these 3
Fetch a creator's posts, sorted and paginated. Use this when the user asks to see what a creator has posted (e.g., "show me Jane's last 20 posts", "what are this creator's top-engagement reels?", "pul
Fetch raw Instagram post-page data by shortcode. Use this when the user needs fresh raw Instagram post metadata that is not guaranteed on regular cached post-list endpoints yet, including coauthors, t
Fetch raw Instagram post-page data for a bounded list of shortcodes through the raw API. Transient upstream recovery is handled automatically within the request deadline. Returns one item per requeste
Transcribe an Instagram video post by shortcode through the raw API. The response includes raw post metadata on a transcript cache miss. A cache hit omits the post field; use `get_instagram_post` when
Transcribe a bounded list of Instagram video posts by shortcode through the raw API. Each successful item includes transcript data. The nested post field is present on cache misses and omitted on cach
Fetch a current, normalized TikTok profile by username. Returns identity, biography, verification, and audience metrics. A leading @ is accepted and usernames are normalized. This is a metered live-da
Fetch one cursor-paginated page of current TikTok videos for a username. Use the returned cursor to paginate and choose latest or popular ordering. Media URLs are temporary, while successful responses
Fetch normalized details and current engagement metrics for a TikTok video URL. Canonical video URLs and TikTok share URLs are accepted. Returned media URLs are temporary; the managed dataset captures
Fetch one cursor-paginated page of current comments for a TikTok video URL. Pass the returned cursor to retrieve the next page. This is a metered live-data request.
Fetch or generate a normalized TikTok video transcript. Returns plain text and timestamped segments. Canonical transcripts are reused on later requests because transcript content does not expire. This
Use this when discovery or lookup tools have returned results and the user would benefit from scanning 1–8 creator cards. Pass search_id after semantic_search_creators so the exact ranking, confidence
Use this when the user wants a visual deep dive on one canonical creator ID. It fetches the current creator record plus up to six recent posts and may consume Influship account or API usage.
Use this when the user has 2–4 canonical creator IDs and a specific campaign brief. It fetches current creator details, scores each creator against the brief, and renders a side-by-side comparison. Th