Loading…
Read-only access to the Islam West Africa Collection via Hugging Face datasets.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 9 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The iwac-mcp-server MCP server exposes 34 tools, focused primarily on web capabilities. Its published description reads: "Read-only access to the Islam West Africa Collection via Hugging Face datasets". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates iwac-mcp-server F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check iwac-mcp-server's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add iwac-mcp-server to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://islam.zmo.de/mcp/Streamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Search the Islam West Africa Collection across newspaper articles, Islamic publications, archival documents, academic references, audiovisual recordings, photographs, and the authority index (persons/
Retrieve the full text and metadata of one IWAC item by an id returned from `search` (format '<category>:<number>', e.g. 'articles:28576'). Returns {id, title, text, url, metadata}: `text` is the item
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: search
A tool description tries to alter the model’s use of another tool.
Pass an id to `fetch` to read the full text. For filtered queries (bRecommendationDescriptions must describe only their own tool.
tool: fetch
A tool description tries to alter the model’s use of another tool.
returned from `search` (format '<category>:<number>', e.g. 'articles:RecommendationDescriptions must describe only their own tool.
tool: search_articles
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
icle. Adds ~125 tokens/row, so `limit` defaults to 10 and caps at 25 wRecommendationRemove side-channel parameters; constrain tool inputs.
tool: search_articles
A tool description tries to alter the model’s use of another tool.
Search IWAC newspaper articles by keyword (title + OCRRecommendationDescriptions must describe only their own tool.
tool: get_article
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context_chars"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_article
A tool description tries to alter the model’s use of another tool.
ull (capped) OCR.RecommendationDescriptions must describe only their own tool.
tool: search_by_sentiment
A tool description tries to alter the model’s use of another tool.
often disagree; get_sentiment_distribution with model:"all" shows by how much. `subjectiviRecommendationDescriptions must describe only their own tool.
tool: search_index
A tool description tries to alter the model’s use of another tool.
Search the IWAC authority index (persons, places, orgaRecommendationDescriptions must describe only their own tool.
tool: get_temporal_distribution
A tool description tries to alter the model’s use of another tool.
rch results. Defaults to articles; also works on publications, references,RecommendationDescriptions must describe only their own tool.
tool: get_topic_distribution
A tool description tries to alter the model’s use of another tool.
g to map a corpus. Optional over_time returns per-year counts for the leadRecommendationDescriptions must describe only their own tool.
tool: get_place_distribution
A tool description tries to alter the model’s use of another tool.
his rather than get_field_distribution when the question is geographic — where coveragRecommendationDescriptions must describe only their own tool.
tool: search_publications
A tool description tries to alter the model’s use of another tool.
Search Islamic publications (periodical issues, books)RecommendationDescriptions must describe only their own tool.
tool: list_periodicals
A tool description tries to alter the model’s use of another tool.
aper` filter on search_publications.RecommendationDescriptions must describe only their own tool.
tool: get_publication_fulltext
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context_chars"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: search_references
A tool description tries to alter the model’s use of another tool.
Search academic references (journal articles, book chaRecommendationDescriptions must describe only their own tool.
tool: search_documents
A tool description tries to alter the model’s use of another tool.
Search the small archival-documents subset (~26 items:RecommendationDescriptions must describe only their own tool.
tool: get_document
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context_chars"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_document
A tool description tries to alter the model’s use of another tool.
l (capped) OCR — useful for long documents.RecommendationDescriptions must describe only their own tool.
tool: search_audiovisual
A tool description tries to alter the model’s use of another tool.
Search audiovisual materials by keyword and metadata:RecommendationDescriptions must describe only their own tool.
tool: search_images
A tool description tries to alter the model’s use of another tool.
Search the IWAC photographs (30 items: mosques, radioRecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
d of paging through search results. To characterise a whole set rather thaRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: (server instructions)
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
` field such as https://islam.zmo.de/s/afrique_ouest/item/28576 — always cite IWAC items using this full URL (rRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
The server exposes one or more ui:// (MCP Apps) resources whose HTML/JS renders inside the host client — a client-side injection / data-exposure surface most scanners ignore. Flagged for review, not damning on its own.
1 ui:// resource(s); e.g. ui://iwac/charts.htmlRecommendationReview each ui:// resource’s markup and scripts; treat host-rendered UI as untrusted, sandbox it, and never expose secrets or conversation context to it.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Search IWAC newspaper articles by keyword (title + OCR + AI abstracts, French and English), country, newspaper, subject, and date range. Use French concept keywords regardless of the user's report lan
Get one article (by id): full metadata, the AI abstract (description_ai), AI sentiment, and OCR text. Pass a `keyword` to get ~2000-char excerpts around each match instead of the full (capped) OCR.
Filter articles by gpt-5-6-luna sentiment labels (accent/case-insensitive exact match). One model's reading, not a consensus — 3 other models scored the same articles and often disagree; get_sentiment
Aggregate AI polarity, centrality and subjectivity across a filter set. 4 models scored the corpus independently — gpt-5-6-luna, mistral-small-2603, deepseek-v4-flash-0731, gemma-4-31b-it — so model:"
Search the IWAC authority index (persons, places, organisations, events, subjects) by name. Accent/case-insensitive.
Get full details of an index entry by id (raw dataset columns, French names — Titre, Prénom, Coordonnées…).
List sujets from the IWAC index, sorted by frequency (most-referenced first).
List lieux from the IWAC index, sorted by frequency (most-referenced first). The optional 'country' filter selects entries that APPEAR IN records from that country (mentioned-in, not located-in), rank
List personnes from the IWAC index, sorted by frequency (most-referenced first). The optional 'country' filter selects entries that APPEAR IN records from that country (mentioned-in, not located-in),
Overall statistics for every IWAC subset, including `fulltext_coverage` — how many items in each subset actually carry searchable full text in this public dataset. Read that before treating any keywor
Per-newspaper article counts and date ranges.
Compare article counts, newspaper counts, date ranges, and gpt-5-6-luna polarity across countries.
Counts of matching items per year (or month) — the direct way to chart coverage trends over time instead of paging through search results. Defaults to articles; also works on publications, references,
How a filtered set distributes across the precomputed LDA topics, each labelled by its top terms (articles carry 30 topics and are ~99.5% classified; references have their own 33-topic model and only
Rank the values of one multi-valued field across a filtered set — the direct way to answer 'which places does this coverage name most', 'who signs these articles', 'what subjects dominate'. Pipe-joine
How often the top values of a multi-valued field appear on the SAME item — a subject/place co-mention matrix. Answers 'what is X discussed alongside' without reading anything: the pair counts are the
Places named by a filtered set of items, joined to the index's authority records so each carries coordinates where the index has them. Use this rather than get_field_distribution when the question is
A 2-D scatter of a filtered set, projected from the stored 768-dimension embeddings by PCA. Shows which items sit near each other in meaning — where a set splits into distinct strands and where it is
The items nearest to a given one in meaning, by cosine similarity over the stored embeddings. Answers 'what else is like this' without a keyword — it finds pieces on the same event or theme that share
Readability, lexical richness and length of the press text, averaged by year, newspaper or country. `Lisibilite_OCR` is a French readability score (higher = easier); `Richesse_Lexicale_OCR` is MATTR,
Search Islamic publications (periodical issues, books). `keyword` matches title, subject, table of contents, and full OCR text (TOC hits come back as matching_toc_entries); use French concept keywords
List the Islamic periodical/series titles in the publications subset, with issue counts and year ranges. Use the returned newspaper value as the `newspaper` filter on search_publications.
Full OCR text of a publication, optionally returning ~2000-char excerpts around keyword matches (accent-insensitive; capped — see match_count vs excerpts_returned).
Search academic references (journal articles, book chapters, theses, books, reports) by keyword and metadata. `keyword` is a single substring match over title + abstract, so search ONE term per call (
Full bibliographic record for one academic reference (by id), including the complete abstract (present for ~51% of references), subjects, DOI/URL, and host-work details (book, volume, issue, pages).
Search the small archival-documents subset (~26 items: Islamic association reports, flyers, project documents — mostly Burkina Faso). Use French concept keywords regardless of the user's report langua
Get one archival document (by id): full metadata, AI description, and OCR text. Pass a `keyword` to get ~2000-char excerpts around each match instead of the full (capped) OCR — useful for long documen
Search audiovisual materials by keyword and metadata: francophone web video from Burkina Faso, Togo and Benin (TV reports, association and campus recordings), plus deposited Nigerian Hausa/Arabic reco
List audiovisual materials, newest first (francophone web video from Burkina Faso, Togo and Benin; deposited Nigerian Hausa/Arabic recordings). Filter by country, publishing channel or `source_type`.
Get one audiovisual record by id: full description and transcription (where one exists), creator/publishing channel, duration, medium, subjects, places, language, rights, source, and three distinct li
Search the IWAC photographs (30 items: mosques, radio stations, schools, signage and street scenes documented during fieldwork). Keyword matches title, creator, subject, place and the rare caption. Ea
Get one photograph by id: title, photographer, capture date, place and coordinates, subjects, rights, the IIIF manifest, and the full-resolution `image_url`. The server returns URLs, not image bytes.