Loading…
Connect AI to Nestr for Holacracy, Sociocracy, and self-organizing team management.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The Nestr MCP server exposes 79 tools, focused primarily on filesystem and communication capabilities. Its published description reads: "Connect AI to Nestr for Holacracy, Sociocracy, and self-organizing team management". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates Nestr F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check Nestr's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add Nestr to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.nestr.io/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Get Nestr documentation. Three modes: (1) internal MCP-flavoured topic — pass `topic` with one of the curated keys (search, labels, nest-model, inbox, daily-plan, notifications, insights, tension-proc
Server-side auth and session diagnostics. Call this FIRST when any other tool returns an auth error (AUTH_TOKEN_REJECTED_BY_NESTR / AUTH_REFRESH_FAILED / AUTH_SCOPE_INSUFFICIENT / AUTH_PROXY_HEADER_DR
List workspaces. Prefer nestr_get_me with fullWorkspaces:true at session start. Paginated with meta.total.
Get details of a specific workspace including its purpose and member count
Create a new workspace. Auth: OAuth only (user-scoped — workspace API keys cannot create new workspaces). On auth failure call nestr_diagnose. See nestr_help('workspace-setup') for guided setup.
Search nests in a workspace. Supports operators like label:, assignee:, createdby:, completed:, in:, sort:. createdby: accepts me, an email address, or a user id. Always use completed:false for active
Get nest details. Supports comma-separated IDs for batch fetch. Add hints=true for contextual signals, fieldsMetaData=true for field schemas. For a single nest you can also diagnose it: provenance, ri
Diagnose a single nest: WHY it looks and behaves as it does. Returns field/property provenance (which label and circle defines each field, value, and property such as the icon), the caller's composed
Get children of a nest. Paginated. Add hints=true for contextual signals.
Create a nest under a parent. Use labels to define type (e.g., ['project'], ['role']). Apply at most ONE prime label per nest (project, tension, role, circle, anchor-circle, meeting, metric, goal, res
Update nest properties. Set parentId to move. Only send fields you want to change. When replacing `labels`, keep at most ONE prime label (project, tension, role, circle, anchor-circle, meeting, metric
Delete a nest. For governance items in established workspaces, use tensions instead.
Add a comment to a nest. Supports HTML and @mentions — **mentions MUST be wrapped in literal curly braces** (e.g. `@{aBcD1234eFgH5678i:roleNestId}`, NOT `@aBcD1234eFgH5678i`); without the braces the u
Update an existing comment's body and/or labels. Supports HTML and @mentions — **mentions MUST be wrapped in literal curly braces** (e.g. `@{aBcD1234eFgH5678i:roleNestId}`, NOT `@aBcD1234eFgH5678i`);
Delete a comment (soft delete).
List all circles (teams/departments) in a workspace. Response includes meta.total showing total matching count.
Get all roles within a specific circle, including accountabilities. Response includes meta.total showing total matching count.
Which roles does a person actually FILL? Omit userId for yourself. This is the only correct way to answer "what are my roles?" — nestr_list_roles returns every role in the workspace, most of which are
List ALL roles that exist in a workspace, whoever fills them. Not the caller's roles: check each role's `users` array for who fills it, or use nestr_list_user_roles to ask who fills what. Response inc
Get organizational health metrics and trends. Each metric has currentValue and compareValue for direction. Pro plan: filter by circle (nestId) or user (userId). Requires Insights app. See nestr_help('
Get a single metric with its current and compare values. Use after nestr_get_insights to drill into a specific metric. Requires the Insights app to be enabled.
List members of a workspace. Response includes meta.total showing total matching count. Also the tool to resolve user ids in bulk: when presenting users to a person, show names and/or emails, never ba
List available labels in a workspace. Response includes meta.total showing total matching count.
List all projects in a workspace. Check fields['project.status'] for status (Future/Current/Waiting/Done). Paginated.
Get comments and discussion history on a nest, including full nested reply threads. By default returns only comments posted directly on the given nest. Widen with depth to also include comments on des
Get details of a specific circle including purpose, domains, and accountabilities.
Get details of a specific user including profile, roles, and contact info. Use it to resolve a user id to a name and email; when presenting users to a person, show names and/or emails, never bare ids.
Add a user to a workspace by email. Creates account if needed.
Get details of a specific label.
Get historical data points for a metric over time. Use from/to for date range. Requires Insights app.
List enabled apps/features in a workspace. Check before using features that require specific apps (e.g., Insights).
List items in the user's personal inbox. Spans all workspaces. Auth: OAuth only (user-scoped — workspace API keys lack user identity). On auth failure call nestr_diagnose.
Quick capture: add an item to the inbox for later processing. Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
Get details of a specific inbox item. Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
Update an inbox item. Set completed:true when processed. Use nestr_update_nest with parentId to move out of inbox. Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
Reorder inbox items. Provide a subset of IDs — they go to the top in given order, rest unchanged. Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
Reorder a single inbox item by positioning it before or after another inbox item. Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
List the current user's personal labels (not workspace labels). Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
Create a personal label. Can be used across workspaces. Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
Reorder a nest by positioning it before or after another nest.
Bulk reorder nests. Provide a subset of IDs — they go to the top in given order, rest unchanged.
Get the user's daily plan — items marked for today. Spans all workspaces. Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
The caller's own activity across ALL their workspaces, newest first (gated by workspace membership and the token's scope). Not scoped to a project or a single nest — it's everything you've done. For a
Another user's activity across the workspaces you share with them, newest first. Lets an agent see what a colleague or another agent has done: their past considerations (with the tools used and the ou
Add a label to a nest. Personal labels (like 'now') are automatically scoped to the authenticated user by the API. Will reject any attempt to add a prime label (project, tension, role, circle, anchor-
Remove a label from a nest. Personal labels (like 'now') are automatically scoped to the authenticated user by the API.
Add one or more items to the daily plan by applying the 'now' label. Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
Remove one or more items from the daily plan by removing the 'now' label. Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
CALL THIS FIRST at session start. Returns identity, operating mode, and workspaces. Use fullWorkspaces:true to include workspace details.
List tensions created by or assigned to the current user. Check at session start and natural breakpoints. Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
List tensions awaiting the current user's consent vote. Check proactively. Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
List notifications. Use type 'me' for direct (mentions, replies) or 'relevant' for organizational changes. Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
Mark all unread in-app notifications as read for the current user. Returns { status, data: { markedCount } }. Auth: OAuth only (user-scoped). On auth failure call nestr_diagnose.
Create a tension on a role or circle. Tensions drive organizational change. See nestr_help('tension-processing') for guidance on placement and pathways.
Get a single tension with its current status. Use nestr_get_tension_status for per-user voting details.
List tensions for a circle or role. Supports search filtering.
Update a tension's title, description, feeling, or needs.
Delete a tension (soft delete).
Get all parts (proposed changes) of a tension. Review before submitting.
Add a governance proposal part to a tension. Four modes: (1) propose a new item — omit _id, provide title/labels/etc.; (2) propose changes to an existing item — provide _id plus the fields to change (
Modify an existing proposal part. For individual accountability/domain changes, use the children tools.
Remove a proposal part, or propose deletion of an existing governance item.
List accountabilities/domains of a proposal part. Use to review before managing individually.
Add a new accountability or domain to a proposal part. When the proposal is enacted, this creates a new accountability/domain on the role.
Rename an accountability or domain within a proposal part. When the proposal is enacted, the original accountability/domain is updated.
Soft-delete an accountability or domain from a proposal part. When the proposal is enacted, the original accountability/domain is removed from the role.
Get the diff for a proposal part showing what will change (oldValue vs newValue).
Get detailed tension status with per-user voting responses and timestamps.
Submit a tension for voting ('proposed') or retract to 'draft'. Submitting notifies circle members.
Get nests linked via a named graph relation. Use 'meeting' relation to get agenda items or linked meetings.
Create a bidirectional graph link between two nests. E.g., link a tension to a meeting as an agenda item.
Remove a graph link between two nests. For example, remove a tension from a meeting's agenda by removing the 'meeting' relation.
List the workspace's connector catalog: the mcp / cli / api templates an admin has registered. Each entry holds no secret and shows its type, name, authStrategy, config, capabilities, exposure ({ user
Register a connector in the workspace catalog: a reusable mcp / cli / api template that holds no secret. Workspace-admin only. A non-admin caller gets AUTH_SCOPE_INSUFFICIENT (call nestr_diagnose on a
Bind a registered connector to an owner so that owner can use it. Owner types: 'user' or 'agent' (ownerId is the user ID), 'workspace' (ownerId is the workspace ID), or 'role-domain' (ownerId is the d
List a nest's file attachments. Images pasted into the nest's text are deliberately excluded — they belong to the text that references them; the inline_images hint counts those and their ids come from
Read a single file attachment on a nest (or comment). Branches on contentType: images (image/*) return as viewable image content so you can see them (very large images return metadata only); JSON and
Upload a file and attach it to a nest (or comment; files are keyed by nestId, so a comment ID attaches the file to that comment). Provide the file one of two ways: content (UTF-8 text, for text-native
Delete a file attachment from a nest (or comment). Get the file id from nestr_get_nest_files. A comment ID works as the nestId. This permanently removes the file. Auth: a token with delete access to t
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: nestr_list_workspaces
A tool description tries to alter the model’s use of another tool.
kspaces. Prefer nestr_get_me with fullWorkspaces:true at session start. PagiRecommendationDescriptions must describe only their own tool.
tool: nestr_create_workspace
A tool description tries to alter the model’s use of another tool.
r_diagnose. See nestr_help('workspace-setup') for guided setup.RecommendationDescriptions must describe only their own tool.
tool: nestr_search
A tool description tries to alter the model’s use of another tool.
ctive work. See nestr_help('search') for full syntax. Results carry user iRecommendationDescriptions must describe only their own tool.
tool: nestr_get_nest
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: nestr_explain_nest
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: nestr_create_nest
A tool description tries to alter the model’s use of another tool.
nsion flow. See nestr_help('labels') for available types.RecommendationDescriptions must describe only their own tool.
tool: nestr_update_nest
A tool description tries to alter the model’s use of another tool.
r tensions. See nestr_help('nest-model') for fields and data namespacing.RecommendationDescriptions must describe only their own tool.
tool: nestr_add_comment
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
of the nest or conversation the comment belongs to. Passing a comment ID inRecommendationRemove side-channel parameters; constrain tool inputs.
tool: nestr_update_comment
A tool description tries to alter the model’s use of another tool.
label set — use nestr_add_label / nestr_remove_label for incremental changes.RecommendationDescriptions must describe only their own tool.
tool: nestr_list_user_roles
A tool description tries to alter the model’s use of another tool.
re my roles?" — nestr_list_roles returns every role in the workspace, most of whRecommendationDescriptions must describe only their own tool.
tool: nestr_list_roles
A tool description tries to alter the model’s use of another tool.
ills it, or use nestr_list_user_roles to ask who fills what. Response includes meta.tRecommendationDescriptions must describe only their own tool.
tool: nestr_get_insights
A tool description tries to alter the model’s use of another tool.
sights app. See nestr_help('insights').RecommendationDescriptions must describe only their own tool.
tool: nestr_get_insight
A tool description tries to alter the model’s use of another tool.
lues. Use after nestr_get_insights to drill into a specific metric. Requires the IRecommendationDescriptions must describe only their own tool.
tool: nestr_get_comments
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
and discussion history on a nest, including full nested reply threads.RecommendationRemove side-channel parameters; constrain tool inputs.
tool: nestr_list_inbox
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ped — workspace API keys lack user identity). On auth failure call nestrRecommendationRemove side-channel parameters; constrain tool inputs.
tool: nestr_list_inbox
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_create_inbox_item
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_get_inbox_item
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_update_inbox_item
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_reorder_inbox
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_reorder_inbox_item
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_list_personal_labels
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_create_personal_label
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_get_daily_plan
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_my_activity
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_user_activity
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_add_to_daily_plan
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_remove_from_daily_plan
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_list_my_tensions
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: nestr_list_my_tensions
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_list_tensions_awaiting_consent
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: nestr_list_tensions_awaiting_consent
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_list_notifications
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_mark_notifications_read
A tool description tries to alter the model’s use of another tool.
th failure call nestr_diagnose.RecommendationDescriptions must describe only their own tool.
tool: nestr_create_tension
A tool description tries to alter the model’s use of another tool.
nal change. See nestr_help('tension-processing') for guidance on placementRecommendationDescriptions must describe only their own tool.
tool: nestr_get_tension
A tool description tries to alter the model’s use of another tool.
ent status. Use nestr_get_tension_status for per-user voting details.RecommendationDescriptions must describe only their own tool.
tool: nestr_add_tension_part
A tool description tries to alter the model’s use of another tool.
es/domains. See nestr_help('tension-processing').RecommendationDescriptions must describe only their own tool.
tool: nestr_list_connectors
A tool description tries to alter the model’s use of another tool.
e's domain with nestr_bind_connector, then a human or agent connects the account viaRecommendationDescriptions must describe only their own tool.
tool: nestr_register_connector
A tool description tries to alter the model’s use of another tool.
UFFICIENT (call nestr_diagnose on any auth error). Provide type ('mcp' or 'apiRecommendationDescriptions must describe only their own tool.
tool: nestr_bind_connector
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
materialises a credentials field on the domain nest, so the role can use tRecommendationRemove side-channel parameters; constrain tool inputs.
tool: nestr_bind_connector
A tool description tries to alter the model’s use of another tool.
be registered (nestr_register_connector) and enabled.RecommendationDescriptions must describe only their own tool.
tool: nestr_get_nest_files
A tool description tries to alter the model’s use of another tool.
e and size. Use nestr_read_file with a returned id to read one (images come bacRecommendationDescriptions must describe only their own tool.
tool: nestr_read_file
A tool description tries to alter the model’s use of another tool.
t file ids from nestr_get_nest_files, or, for an image pasted into a nest's text, frRecommendationDescriptions must describe only their own tool.
tool: nestr_upload_file
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
size). Auth: a token with write access to the nest. {"type":"object"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: nestr_delete_file
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
str_delete_file Delete a file attachment from a nest (or comment). Get the fiRecommendationAnnotate destructive tools and require human approval.
tool: nestr_delete_file
A tool description tries to alter the model’s use of another tool.
he file id from nestr_get_nest_files. A comment ID works as the nestId. This permaneRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: nestr_delete_nest
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: nestr_delete_comment
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: nestr_delete_tension
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: nestr_remove_tension_part
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: nestr_create_tension_part_child
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "nestr_create_tension_part_child"RecommendationScope tools to the minimum needed.
tool: nestr_delete_tension_part_child
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "nestr_delete_tension_part_child"RecommendationScope tools to the minimum needed.
tool: nestr_remove_graph_link
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: nestr_read_file
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
nestr_read_file Read a single file attachment on a nest (or comment). Branches onRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: nestr_delete_file
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.