Loading…
MCP server that converts plain-language automation goals into ready-to-execute agent command stacks with copy-paste commands, dry-run validation, and recovery guidance.
Do not connect
The assessed surface is high-risk. Remediate the findings before connecting.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The no-shell-agent-architect-mcp MCP server exposes 7 tools, focused primarily on developer and AI capabilities. Its published description reads: "MCP server that converts plain-language automation goals into ready-to-execute agent command stacks with copy-paste commands, dry-run validation, and recovery guidance". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates no-shell-agent-architect-mcp D — the assessed surface is high-risk and should be remediated before use. Its most notable findings include "Unguarded destructive tools" and "Unguarded destructive tools". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check no-shell-agent-architect-mcp's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add no-shell-agent-architect-mcp to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://no-shell-agent-architect-mcp.vercel.app/api/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: generate_no_shell_prompt
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
mpt Generate No-Shell Prompt Create a copy-paste natural-language comRecommendationAnnotate destructive tools and require human approval.
tool: audit_automation_plan
Financial data service providing fundamental information for 30,000+ listed companies across the US, Japan, and Korea, sourced directly from SEC, EDINET, and DART regulatory filings.
Search tours, attraction tickets, and holiday packages across 24 countries.
Turn a vague automation request into a tool/MCP/plugin/skill stack, permissioned account route, workflow phases, validation pack, and live-action boundary.
Create a copy-paste natural-language command that tells an agent how to execute the workflow without producing an empty shell.
Recommend MCP servers, Codex plugins, skills, permissioned account routes, and live-action boundaries for a requested automation.
Score an existing automation plan for shell-risk, missing inputs, missing validation, missing tool route, and missing recovery path.
Return dry-run, QA, audit, and PASS criteria for one automation workflow.
Generate a 10-minute intake questionnaire for a non-developer who wants one workflow automated.
Create a machine-readable package contract for agencies, SaaS builders, or other agents that want to integrate the No-Shell operating pack through MCP/API plus human-readable delivery artifacts.
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
mation plan for shell-risk, missing inputs, missing validation, missiRecommendationAnnotate destructive tools and require human approval.
tool: build_m2m_package_contract
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
ntegrate the No-Shell operating pack through MCP/API plus human-readaRecommendationAnnotate destructive tools and require human approval.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: generate_no_shell_prompt
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "generate_no_shell_prompt"RecommendationScope tools to the minimum needed.
tool: build_m2m_package_contract
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "build_m2m_package_contract"RecommendationScope tools to the minimum needed.
Agentic visitor analytics with five tools for CRO and session analysis.
52 paid x402 API endpoints for AI agents — crypto, data, DeFi, and market intelligence, settled on Base.
Access Vonage API documentation, code snippets, tutorials, and troubleshooting resources.