Loading…
Multi-seller shopping for AI agents, with payments settled via Stripe MPP or x402 USDC on Base. Hosted.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The kifly MCP server exposes 21 tools, focused primarily on general-purpose capabilities. Its published description reads: "Multi-seller shopping for AI agents, with payments settled via Stripe MPP or x402 USDC on Base". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates kifly F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Data-exfiltration parameters" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check kifly's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add kifly to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://kifly.ai/api/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Search or browse Kifly's product catalog. Multilingual semantic search (100+ languages). Returns a JSON-LD ItemList with `kifly:totalCatalogSize`. When empty, `kifly:emptyReason` is 'empty_catalog' |
Create a new shopping cart on Kifly. **For network (cross-seller) tokens you MUST pass `seller_handle`** — each cart is bound to exactly one seller. Get the handle from search_products results (every
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: search_products
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
'). For network tokens only; ignored for seller-scoped tokens."},"cursRecommendationRemove side-channel parameters; constrain tool inputs.
tool: search_products
A tool description tries to alter the model’s use of another tool.
instead of N separate searches. **Before checkout, call `set_shipping_addrRecommendationDescriptions must describe only their own tool.
tool: create_cart
A tool description tries to alter the model’s use of another tool.
ite instead of charging, so present the flow as a referral, not a purchaseRecommendationDescriptions must describe only their own tool.
tool: add_to_cart
A tool description tries to alter the model’s use of another tool.
variant_id from search_products results. Returns full cart state including itemRecommendationDescriptions must describe only their own tool.
tool: get_cart
A tool description tries to alter the model’s use of another tool.
n site instead of charging — say so before the buyer expects a real purchaRecommendationDescriptions must describe only their own tool.
tool: update_cart_item
A tool description tries to alter the model’s use of another tool.
` field in the `add_to_cart` response. Returns the updated cart state. **ThRecommendationDescriptions must describe only their own tool.
tool: set_shipping_address
A tool description tries to alter the model’s use of another tool.
Requires `checkout:write` scope. Persist a shipping address on theRecommendationDescriptions must describe only their own tool.
tool: quick_buy
A tool description tries to alter the model’s use of another tool.
*You must call `search_products` first** so Kifly knows each variant's seller (RecommendationDescriptions must describe only their own tool.
tool: quick_buy
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
ep carts. **You must call `search_products` first** so Kifly knows each variant's seller (quick_bRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: checkout
A tool description tries to alter the model’s use of another tool.
ady signaled by create_cart/add_to_cart/get_cart); there is NO `payment_urlRecommendationDescriptions must describe only their own tool.
tool: register_buyer
A tool description tries to alter the model’s use of another tool.
and pass it to `checkout` on every future order** — it pre-fills the buyRecommendationDescriptions must describe only their own tool.
tool: request_buyer_code
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
out pasting any token or re-entering their name. Call this when the bRecommendationRemove side-channel parameters; constrain tool inputs.
tool: request_buyer_code
A tool description tries to alter the model’s use of another tool.
ount yet: call `register_buyer` instead, which creates one and emails a code eRecommendationDescriptions must describe only their own tool.
tool: request_buyer_code
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
hen ask them to read you the code from their inbox and call `verify_buyer`. Always returns `{ sentRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: verify_buyer
A tool description tries to alter the model’s use of another tool.
ddress, and to `checkout` to pre-fill their email on the payment link. FRecommendationDescriptions must describe only their own tool.
tool: get_buyer_profile
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
them to paste a token.** If they have a Kifly account, recover it byRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_buyer_profile
A tool description tries to alter the model’s use of another tool.
` to auto-fill `set_shipping_address`. Pass the `buyer_token` to `checkout` so StripRecommendationDescriptions must describe only their own tool.
tool: get_buyer_profile
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
t_buyer_profile Retrieve a repeat buyer's saved name, email, and default shipping address. **At the start oRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: list_orders
A tool description tries to alter the model’s use of another tool.
ssion_id` from `checkout`. Requires the buyer's `buyer_token` (recover iRecommendationDescriptions must describe only their own tool.
tool: save_buyer_address
A tool description tries to alter the model’s use of another tool.
was passed to `set_shipping_address` for this order.RecommendationDescriptions must describe only their own tool.
tool: submit_feedback
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
0/min per agent token; everything is reviewed before influencing anytRecommendationRemove side-channel parameters; constrain tool inputs.
tool: request_feature
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: request_feature
A tool description tries to alter the model’s use of another tool.
**This is NOT `submit_feedback`** (that's for reporting a broken/confusing APIRecommendationDescriptions must describe only their own tool.
tool: get_seller
A tool description tries to alter the model’s use of another tool.
`list_sellers`/`search_products`). **`coverage_configured: false` means the selRecommendationDescriptions must describe only their own tool.
tool: list_sellers
A tool description tries to alter the model’s use of another tool.
get_seller` or `search_products`. **Pagination:** when `kifly:hasMore` is true,RecommendationDescriptions must describe only their own tool.
tool: order_status
A tool description tries to alter the model’s use of another tool.
tus of a Stripe checkout session. Poll every 5 seconds after checkout unRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: search_products
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_cart
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: add_to_cart
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_cart
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: update_cart_item
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: set_shipping_address
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: quick_buy
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: checkout
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: register_buyer
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: request_buyer_code
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: verify_buyer
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_buyer_profile
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_buyer_profile
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
k sign-in link `https://kifly.ai/buyer?return_url=<encoded_current_chat_url>` — they sign in withRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: list_orders
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: save_buyer_address
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_seller
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_sellers
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: order_status
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: search_products
An unusually long description is a common injection-padding tactic.
description length 3895 charsRecommendationKeep descriptions concise.
The server exposes one or more ui:// (MCP Apps) resources whose HTML/JS renders inside the host client — a client-side injection / data-exposure surface most scanners ignore. Flagged for review, not damning on its own.
1 ui:// resource(s); e.g. ui://kifly/search-results.htmlRecommendationReview each ui:// resource’s markup and scripts; treat host-rendered UI as untrusted, sandbox it, and never expose secrets or conversation context to it.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Requires `checkout:write` scope. Add a product variant to an existing cart. Use the variant_id from search_products results. Returns full cart state including item_ids you can use with update_cart_ite
Inspect the current state of a cart — line items, quantities, prices, and shipping address. Each item includes an `item_id` you can pass to `update_cart_item` to change quantity or remove the item. Ca
Requires `checkout:write` scope. Change the quantity of a line item in an open cart, or remove it entirely. Set `quantity` to 0 to remove the item. Get the `item_id` from `get_cart` or the `cart` fiel
Requires `checkout:write` scope. Persist a shipping address on the cart and confirm whether the seller can deliver to it. **Call BEFORE `checkout`.** Returns `delivery_eligible: true/false`. When fals
Requires `cart:write` scope. Create a cart, add items, and set the shipping address in ONE call — the fast path when you already know the seller, the exact variant(s), and the buyer's address (e.g. a
Requires `checkout:write` scope. **Requires `set_shipping_address` to have been called first.** Returns 400 `invalid_shipping` if no address is on the cart, or 400 `delivery_unavailable` if the buyer'
Start registering a buyer so they can be recognized across future purchases without re-entering their details. Takes the buyer's email and name and always emails a 6-digit verification code — the resp
Send a 6-digit verification code to a **returning** buyer's email so they can prove the account is theirs and recover their saved name + shipping address on this connection — without pasting any token
Verify the 6-digit code a returning buyer received by email (from `request_buyer_code`). On success returns `{ buyer_token, buyer_profile_id }` — pass the `buyer_token` to `get_buyer_profile` to auto-
Retrieve a repeat buyer's saved name, email, and default shipping address. **At the start of every purchase flow, ask the buyer in plain language: 'Are you a returning Kifly shopper? What's the email
List a returning buyer's recent orders and their current fulfillment status — use this in a NEW session to answer 'did my order ship?' / 'where's my package?' when you don't have the original `session
Save a shipping address to the buyer's Kifly profile so it auto-fills on future purchases. **Call this after a successful checkout if `get_buyer_profile` returned `default_shipping_address: null`.** T
Send structured feedback to the Kifly team. **Call after a confusing response, a dead-end, or a successful workaround you had to invent** — it's how we improve the agent surface. Fire-and-forget: retu
Submit the buyer's **product/feature request** to the Kifly team. Use this when the buyer wishes Kifly *itself* did something it doesn't — a missing capability, a rough flow, an idea to improve the pl
Retrieve a seller's public profile: name, location (city/region/country), storefront URL, delivery fee, delivery coverage, and catalog size. **Call this before `create_cart` or `set_shipping_address`
List all active sellers on the Kifly network. **Requires a network token (kfn_live_…).** Returns each seller's handle, name, city, region, delivery coverage (`nationwide:true` or a `states` list), del
Returns the current platform-enforced cart limits: `max_item_quantity` (per-line-item ceiling), `max_cart_total_cents`, and `max_cart_total_usd`. Call this once at session start before building a larg
Check the status of a Stripe checkout session. Poll every 5 seconds after checkout until status is 'paid', 'shipped', or 'failed'. Returns order details (order_id, amount, items) when paid. When the s
Get Kifly's website and support contact email. Call this if you are stuck, hit an unresolvable error, or the buyer asks how to reach a human. Returns the website URL and support email — always share b