Loading…
Generate game assets with AI including sprites, 3D models, animations, sound effects, music, and voices.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 8 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The ludoai MCP server exposes 32 tools, focused primarily on AI capabilities. Its published description reads: "Generate game assets with AI including sprites, 3D models, animations, sound effects, music, and voices". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates ludoai F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Data-exfiltration parameters". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check ludoai's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add ludoai to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.ludo.ai/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Validates an API key. Returns 200 if valid, 403 if invalid.
Generate game-art images from a text prompt alone, selecting an image_type (e.g. sprite) and optionally art_style, perspective, and aspect_ratio. Synchronous: the call blocks until generation finishes
Generate new images that match the visual style of a reference image: supply a style_image (URL or base64) plus a text prompt describing what to create and an image_type (defaults to sprite). Synchron
Modify an existing image according to text instructions: supply a source image (URL or base64) and a prompt describing the changes (e.g. "add clouds", "warmer color scheme"), with an optional referenc
Animate a static sprite into a spritesheet driven by a motion text prompt (image-to-spritesheet): supply an initial_image (URL or base64) plus a motion_prompt like "walking" or "attack slash", and opt
Animate a sprite through up to three fixed keyframes — initial_image, middle_image and final_image (each a URL or base64) — producing a spritesheet that interpolates through the provided frames in ord
Re-pose an existing sprite into a new target pose while preserving the character, taking a source image (URL or base64), a pose name (or "Other" with a free-text description), and an optional n (1-4)
Re-render an existing sprite from a different camera viewpoint while keeping the same character and pose, taking a source image (URL or base64), a required camera_rotation azimuth (one of 0, 45, 90, 1
Transfer motion from a reference video or a named animation preset onto a static sprite image, producing an animated spritesheet that mimics the reference movement. Provide the sprite as image (URL or
List the available animation presets along with their perspectives and the eight supported compass directions (N, NE, E, SE, S, SW, W, NW). Synchronous GET with no request body: it returns an animatio
Edit a previously generated spritesheet: re-prompt its underlying animation (edit_mode "prompt"), extend the frame beyond its borders ("outpaint"), or repair a bad loop ("fix_loop"). Pass the `sprites
Generate a short video clip from a source image and a motion text prompt (image-to-video). Synchronous: the call blocks until rendering finishes and returns the video URL and its actual duration in se
Generate a video from 1-5 reference images and a text prompt (references-to-video). Unlike createVideo, which animates a single source image, this composes a new scene that borrows characters, objects
Edit a previously generated video with a text prompt and optional reference images (video-to-video). Pass the video `url` you received from `createVideo`, `createVideoFromReferences`, or an earlier ed
Upscale a previously generated video to twice its resolution (2x). Pass the video `url` you received from `createVideo`, `createVideoFromReferences`, or `editVideo` — it must be a video you generated
Remove the background from a single image, returning the subject isolated on a transparent background. Supply the source image (URL or base64); optionally set crop to trim the result to the content, a
Convert a single source image into a textured 3D model (image-to-3D). Synchronous: the call blocks while the mesh is generated, decompressed, and re-uploaded, then returns a downloadable GLB model_url
Rig a 3D model: generate a skeleton and skin weights for an existing GLB so it can be animated. Accepts a URL or base64-encoded GLB in `model`. Synchronous: the call blocks while the rig is generated,
Generate text-driven skeletal animations for an already-rigged 3D model. Pass the rigged GLB in `model` (URL or base64) and a motion `prompt` (e.g. "walking", "swinging its axe"). The model must alrea
Apply a curated animation preset to an already-rigged 3D model (retargeting). Pass the rigged GLB in `model` (URL or base64) and a `preset_id` from the animation presets list (see the spritesheet anim
Produce a short sound effect (SFX) from a text description, such as "laser gun firing" or "footsteps on gravel". Synchronous: the call blocks until generation finishes and returns a single audio resul
Produce a looping background ambiance soundscape from a text description, such as "windy forest at dusk" or "busy tavern interior". Synchronous: the call blocks until generation finishes and returns a
Produce a piece of music from a text description, such as "epic orchestral battle theme" or "calm piano melody", with optional lyrics. Synchronous: the call blocks until generation finishes and return
Remix an existing audio sample (a sound effect, ambiance, or music clip) into a variation guided by a text prompt, for example turning a track into an 80s synthwave or metal version. Both the sample a
Design a new voice from a character description (such as "deep-voiced warrior" or "cheerful young girl") and have it speak a short line of text, returning a sample of that newly created voice. Both vo
Convert text to speech by cloning the voice from an audio sample you provide (voice-cloning text-to-speech). Both text and sample are required; the text is limited to 1000 characters and the sample is
Convert text to speech using a named built-in preset voice, with optional emotion and language settings. Both text and voice_preset_id are required and the text is limited to 1000 characters; invalid
List images you previously generated through the API, most recent first. This is a free read-only history lookup (no credits, no generation); it does not create anything. Pass an optional request_id q
List spritesheets you previously generated through the API, most recent first. This is a free read-only history lookup (no credits, no generation); it does not create anything. Pass an optional reques
List videos you previously generated through the API, most recent first. This is a free read-only history lookup (no credits, no generation); it does not create anything. Pass an optional request_id q
List audio clips you previously generated through the API, most recent first. This is a free read-only history lookup (no credits, no generation); it does not create anything. Pass an optional request
List 3D models you previously generated through the API, most recent first. This is a free read-only history lookup (no credits, no generation); it does not create anything. Pass an optional request_i
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: (server instructions)
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
r instructions) IMPORTANT: Asset URLs returned by these tools point to GooRecommendationRemove model-directed instructions from tool descriptions.
tool: createImage
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ts. Requires an API key (user scope). Credits: This endpoint consumesRecommendationRemove side-channel parameters; constrain tool inputs.
tool: createImage
A tool description tries to alter the model’s use of another tool.
om scratch; use generateWithStyle to match a reference image's art style, editImaRecommendationDescriptions must describe only their own tool.
tool: generateWithStyle
A tool description tries to alter the model’s use of another tool.
stead of createImage when style consistency with an existing asset mattersRecommendationDescriptions must describe only their own tool.
tool: editImage
A tool description tries to alter the model’s use of another tool.
ting image; use createImage to generate from text alone, generateWithStyleRecommendationDescriptions must describe only their own tool.
tool: animateSprite
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ts. Requires an API key (user scope). Credits: cost varies by model anRecommendationRemove side-channel parameters; constrain tool inputs.
tool: animateSprite
A tool description tries to alter the model’s use of another tool.
dle frame), use animateSpriteKeyframes instead. Synchronous: the call blocks until theRecommendationDescriptions must describe only their own tool.
tool: animateSpriteKeyframes
A tool description tries to alter the model’s use of another tool.
requested. Use animateSprite instead for the classic single-image + text-proRecommendationDescriptions must describe only their own tool.
tool: generatePose
A tool description tries to alter the model’s use of another tool.
on_prompt) into animateSprite for the best animation quality; use rotateSpritRecommendationDescriptions must describe only their own tool.
tool: rotateSprite
A tool description tries to alter the model’s use of another tool.
the camera, and animateSprite or transferMotion to bring a sprite to life. PaRecommendationDescriptions must describe only their own tool.
tool: transferMotion
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ts. Requires an API key (user scope). Credits: cost varies by model anRecommendationRemove side-channel parameters; constrain tool inputs.
tool: transferMotion
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: listAnimationPresets
A tool description tries to alter the model’s use of another tool.
onto a sprite), animateSprite (text-prompt animation), or animate3DModelPreseRecommendationDescriptions must describe only their own tool.
tool: editSpritesheet
A tool description tries to alter the model’s use of another tool.
received from `animateSprite`, `transferMotion`, or an earlier edit — it musRecommendationDescriptions must describe only their own tool.
tool: createVideo
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
er. Requires an API key (user scope). Credits: cost varies by model anRecommendationRemove side-channel parameters; constrain tool inputs.
tool: createVideo
A tool description tries to alter the model’s use of another tool.
ted tools: use `createImage` for static images, `animateSprite` for sprite-RecommendationDescriptions must describe only their own tool.
tool: createVideoFromReferences
A tool description tries to alter the model’s use of another tool.
-video). Unlike createVideo, which animates a single source image, this comRecommendationDescriptions must describe only their own tool.
tool: editVideo
A tool description tries to alter the model’s use of another tool.
received from `createVideo`, `createVideoFromReferences`, or an earlier edRecommendationDescriptions must describe only their own tool.
tool: upscaleVideo
A tool description tries to alter the model’s use of another tool.
received from `createVideo`, `createVideoFromReferences`, or `editVideo` —RecommendationDescriptions must describe only their own tool.
tool: removeBackground
A tool description tries to alter the model’s use of another tool.
er edits, while createImage and generateWithStyle produce new images ratherRecommendationDescriptions must describe only their own tool.
tool: create3DModel
A tool description tries to alter the model’s use of another tool.
te it later via get3DModelResults. Requires an API key (user scope). Credits: ThRecommendationDescriptions must describe only their own tool.
tool: animate3DModel
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ss. Requires an API key (user scope). Credits: This endpoint consumesRecommendationRemove side-channel parameters; constrain tool inputs.
tool: createSoundEffect
A tool description tries to alter the model’s use of another tool.
ete sounds; use createAmbiance for a continuous looping background soundscape,RecommendationDescriptions must describe only their own tool.
tool: createAmbiance
A tool description tries to alter the model’s use of another tool.
ound loops; use createSoundEffect for short discrete sound effects, createMusic fRecommendationDescriptions must describe only their own tool.
tool: createMusic
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ts. Requires an API key (user scope). Credits: This endpoint consumesRecommendationRemove side-channel parameters; constrain tool inputs.
tool: createMusic
A tool description tries to alter the model’s use of another tool.
cal scores; use createSoundEffect for short sound effects, createAmbiance for looRecommendationDescriptions must describe only their own tool.
tool: createAudioTransform
A tool description tries to alter the model’s use of another tool.
ready have; use createSoundEffect, createAmbiance, or createMusic to generate audRecommendationDescriptions must describe only their own tool.
tool: createVoice
A tool description tries to alter the model’s use of another tool.
escription; use createSpeech for text-to-speech that clones a specific voiceRecommendationDescriptions must describe only their own tool.
tool: createSpeech
A tool description tries to alter the model’s use of another tool.
ce instead, and createVoice to design a brand-new voice from a text descripRecommendationDescriptions must describe only their own tool.
tool: createSpeechPreset
A tool description tries to alter the model’s use of another tool.
le instead, and createVoice to design a new voice from a text description.RecommendationDescriptions must describe only their own tool.
tool: getImageResults
A tool description tries to alter the model’s use of another tool.
iginally called createImage, editImage, generateWithStyle, generatePose, roRecommendationDescriptions must describe only their own tool.
tool: getSpriteResults
A tool description tries to alter the model’s use of another tool.
iginally called animateSprite or transferMotion. Requires an API key (user scRecommendationDescriptions must describe only their own tool.
tool: getVideoResults
A tool description tries to alter the model’s use of another tool.
iginally called createVideo. Requires an API key (user scope).RecommendationDescriptions must describe only their own tool.
tool: getAudioResults
A tool description tries to alter the model’s use of another tool.
iginally called createSoundEffect, createAmbiance, createMusic, createAudioTransfRecommendationDescriptions must describe only their own tool.
tool: get3DModelResults
A tool description tries to alter the model’s use of another tool.
iginally called create3DModel. Requires an API key (user scope).RecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: createImage
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "createImage"RecommendationScope tools to the minimum needed.
tool: generateWithStyle
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "generateWithStyle"RecommendationScope tools to the minimum needed.
tool: editImage
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "editImage"RecommendationScope tools to the minimum needed.
tool: animateSprite
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "animateSprite"RecommendationScope tools to the minimum needed.
tool: generatePose
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "generatePose"RecommendationScope tools to the minimum needed.
tool: createVideoFromReferences
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "createVideoFromReferences"RecommendationScope tools to the minimum needed.
tool: upscaleVideo
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "upscaleVideo"RecommendationScope tools to the minimum needed.
tool: removeBackground
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "removeBackground"RecommendationScope tools to the minimum needed.
tool: animate3DModelPreset
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "animate3DModelPreset"RecommendationScope tools to the minimum needed.
tool: createSoundEffect
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "createSoundEffect"RecommendationScope tools to the minimum needed.
tool: getImageResults
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "getImageResults"RecommendationScope tools to the minimum needed.
tool: getSpriteResults
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "getSpriteResults"RecommendationScope tools to the minimum needed.
tool: getVideoResults
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "getVideoResults"RecommendationScope tools to the minimum needed.
tool: getAudioResults
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "getAudioResults"RecommendationScope tools to the minimum needed.
tool: get3DModelResults
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get3DModelResults"RecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.