Loading…
Print and physically mail documents to US addresses via PostAgent's API, with per-send USDC payments.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The PostAgent MCP server exposes 14 tools, focused primarily on communication capabilities. Its published description reads: "Print and physically mail documents to US addresses via PostAgent's API, with per-send USDC payments". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates PostAgent F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Data-exfiltration parameters" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check PostAgent's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add PostAgent to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://api.postagent.sh/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Fetches the live PostAgent agent manifest. Call this before using PostAgent in a new session, after reconnecting the MCP server, or when an installed PostAgent skill may be stale. If the installed ski
Upload and normalize a FINISHED, ready-to-mail document to PDF. Choose this when the content is final and IDENTICAL for every recipient — including when you mail the same letter to many people (just q
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: create_letter
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_letter
A tool description tries to alter the model’s use of another tool.
ts printed. Use create_template instead only when the content must vary per recRecommendationDescriptions must describe only their own tool.
tool: create_template
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_template
A tool description tries to alter the model’s use of another tool.
r everyone, use create_letter instead (this tool rejects input with no `{{fieRecommendationDescriptions must describe only their own tool.
tool: create_mail_quote
A tool description tries to alter the model’s use of another tool.
rl>`). The MCP `submit_paid_mail_job` tool is a fallback for clients that can emit aRecommendationDescriptions must describe only their own tool.
tool: pay_mail_with_shared_payment_token
A tool description tries to alter the model’s use of another tool.
and price from create_mail_quote. Minting the token (the agent's responsibilityRecommendationDescriptions must describe only their own tool.
tool: prepare_mail_payment
A tool description tries to alter the model’s use of another tool.
ature flow via `submit_paid_mail_job`.RecommendationDescriptions must describe only their own tool.
tool: submit_paid_mail_job
A tool description tries to alter the model’s use of another tool.
ice returned by create_mail_quote, and after obtaining the signed x402 payment heRecommendationDescriptions must describe only their own tool.
tool: create_postcard_art
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_postcard_art
A tool description tries to alter the model’s use of another tool.
then quote with create_postcard_quote. Free; no payment required. Provide the artworRecommendationDescriptions must describe only their own tool.
tool: create_postcard_quote
A tool description tries to alter the model’s use of another tool.
k, uploaded via create_postcard_art). Sizes: 4x6 (default), 6x9, 6x11 — postcards aRecommendationDescriptions must describe only their own tool.
tool: verify_address
A tool description tries to alter the model’s use of another tool.
eed this tool — create_mail_quote already verifies sender and recipient for freeRecommendationDescriptions must describe only their own tool.
tool: create_campaign_quote
A tool description tries to alter the model’s use of another tool.
hed letter with create_letter, then call this with `recipients` (each `to` aRecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
Shared Payment Token) if available; if the payer is a human with onlRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
a session, call check_postagent_updates or read postagent://agent-manifest. If the maniRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: check_postagent_updates
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_letter
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_template
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_mail_quote
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_card_checkout
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: pay_mail_with_shared_payment_token
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: prepare_mail_payment
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: submit_paid_mail_job
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: get_mail_job_status
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_postcard_art
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_postcard_quote
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: verify_address
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_campaign_quote
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_campaign_quote
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
paign access at https://interpretai.tech/contact (this URL is also returned in the 403's detailsRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: get_campaign_status
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: (server instructions)
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
quest access at https://interpretai.tech/contact (also in the 403's details.contactUrl) to get eRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Upload a REUSABLE template containing `{{field}}` placeholders (e.g. `Dear {{name}},` or `Balance due: {{amount}}`). Choose this ONLY when the content must vary per recipient (mail merge) — recipient
Verifies the recipient and sender US addresses and locks a 15-minute USDC price for a documentId. Does not charge or mail anything. Returns a `paymentUrl` (a per-quote x402-payable URL); the preferred
Creates a Stripe-hosted Checkout page for a locked quote and returns a `checkoutUrl` plus a `statusUrl`. Use this as the LAST-RESORT payment rail, when the payer is a human paying by credit card (the
Autonomous, no-browser FIAT payment for a locked quote using a Stripe Shared Payment Token (SPT / Machine Payments Protocol). Use this when the agent can mint an SPT on the buyer's behalf and wants to
Returns the x402 PAYMENT-REQUIRED challenge for a locked quote so an x402-capable wallet client can sign it. No payment is taken at this step. Probes the canonical per-quote pay URL (`/v1/quotes/:quot
Detached-signature fallback for x402 wallets that can emit a standalone PAYMENT-SIGNATURE header. THE PRIMARY/RECOMMENDED PATH is for the agent's wallet to pay the quote's `paymentUrl` in-band (e.g. `
Returns normalized status, carrier/tracking/proof data, and tracking events for a previously created job.
Upload ONE side of a postcard (front or back) as single-page PDF, PNG, or JPEG artwork. The file is stored VERBATIM — no page-size normalization and no reserved address zone — so you are responsible f
Verifies the recipient and sender addresses and locks a 15-minute USDC price for mailing a postcard built from two postcard_art documents (front + back, uploaded via create_postcard_art). Sizes: 4x6 (
Standalone paid address verification — no mail is sent. Checks whether an address is deliverable and returns the standardized form (US: CASS with ZIP+4; international: per-country matching). Costs a s
Quote ONE bulk send to MANY recipients (up to 500): a single template or static document, fulfilled through PostAgent's campaign workflow. Price is an inclusive customer-facing total, locked for 15 mi
Returns a campaign's validation/sending progress: status (validating | sent | partial | failed), recipient counts (total / validated / failed), and a failures report URL when some recipients could not