Loading…
Agent-native EU cloud: provision VMs, networks, and databases on redu.cloud via infrastructure-as-code tools.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The redu-cloud-mcp MCP server exposes 81 tools, focused primarily on developer, database, and network capabilities. Its published description reads: "Agent-native EU cloud: provision VMs, networks, and databases on redu.cloud via infrastructure-as-code tools". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates redu-cloud-mcp F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Hidden instructions in a tool description". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check redu-cloud-mcp's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add redu-cloud-mcp to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.redu.cloud/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Verifies your redu.cloud credential with a REAL server round-trip and returns your identity + live quota. A green result means the key actually works — not merely that one is configured. Use this firs
The deploy ENTRY GATE — run this first when a user wants to deploy. Verifies the account is ready and AUTO-SELECTS the network_id + keypair_name to pass to deploy_app (so you never hunt for them): (1)
Orientation for deploying an app on redu.cloud: the end-to-end flow, the two source modes (git vs upload), how to handle a missing Dockerfile or a database, when (and when NOT) to split a deploy acros
Mints a NEW least-privilege redu API key for a deployed app or automation to use (e.g. to add a backup feature). GUARDRAIL: the first call does NOT create anything. It returns a confirmation the user
Orientation for wiring a redu.cloud capability (backups, DNS, extra storage, a managed DB, ...) INTO an app already deployed on redu, e.g. 'add a backup feature to the Supabase I deployed on redu'. Ex
Returns the LOCAL shell commands to package your working directory and upload it for an upload-mode deploy (no git, no PAT). Run them in the user's terminal, capture `source_token` from the upload's J
OPTIONAL preflight: returns a podman-compose.yml + .env so the user can run the app (and a throwaway local Postgres) on THEIR machine before deploying to redu — to see it run / sanity-check the contai
Aggregates images/flavors/keypairs/networks/security groups into human-friendly choices. Does not create anything. Happy path: import_keypair → plan_instance → create_instance → get_ssh_command. Call
Plans a direct managed datastore create without provisioning anything. Use this before create_database, create_relational_database, create_redis, or create_clickhouse. For app deployments, prefer depl
For a repo with SEVERAL runnable parts, call this BEFORE plan_deploy. You enumerate the candidate surfaces (find every Dockerfile/Containerfile, OPEN each, classify by its EXPOSE + CMD — never by dire
Turns YOUR repo classification (you scan the repo and pass what you found) into a complete, approvable deploy plan WITHOUT creating anything. ⚡ REDU NEEDS THREE FILES IF THEY EXIST - redu.md, the comp
Lists your compute instances.
Lists available instance sizes.
Lists available OS images.
Lists your SSH keypairs. If empty, call import_keypair first before creating instances.
Lists your security groups.
Lists your private networks.
Lists your block storage volumes.
Lists your instance snapshots.
Lists your volume backups.
Lists your autoscaling clusters.
Lists DNS proxy host entries.
Lists custom domains you have verified ownership of.
Lists available regions.
Lists your managed PostgreSQL databases. Once a row's status is 'ready', it carries the private-network connection details (private_ip, port 5432, db_name, db_user).
Lists your managed MySQL/MariaDB databases (the relational-database resource). Each row carries its engine ('mysql'|'mariadb'); once status is 'ready' it has the private-network connection details (pr
Lists Redu media spaces: private NFS media VMs backed by persistent volumes. For WordPress/WooCommerce clusters, reuse one on the app's private network for wp-content/uploads, or pass create_media_spa
Lists your managed ClickHouse databases (OLAP / analytics — its own resource, not a relational DB). Once a row's status is 'ready' it carries the private-network connection details (private_ip, ClickH
Lists your managed Redis instances. Once a row's status is 'ready' it carries the private-network connection details (private_ip, port 6379) — connect from another instance on the same private network
Creates a private Redu media space: a small NFS VM backed by a persistent volume, intended for WordPress/WooCommerce wp-content/uploads in autoscaling clusters. Prefer letting deploy_app/deploy_compos
THE WAY TO MAKE AN EXISTING APP HIGHLY AVAILABLE. If the user asks for high availability, redundancy, no single point of failure, surviving a host or VM failure, or 'stay up if a machine dies', this i
Updates a running autoscaling cluster to a new app version IN PLACE, with NO URL change: snapshots the 'hero' VM (the source/master VM you SSH into and change — it is also the always-on baseline membe
Changes the PUBLIC HOSTNAME a cluster serves on, so the user can put THEIR OWN production domain (shop.acme.com, app.theircompany.com) in front of it instead of the auto-generated redu.cloud URL. That
Deletes an autoscaling cluster — tears down the WHOLE cluster: every autoscaled EXTRA member VM, the load balancer, the pool, the cluster security group, and the cluster's *.redu.cloud proxy host. You
Registers an existing SSH public key on your account. Use this to import your own public key so you can SSH into instances. The private key never leaves your machine.
Removes an SSH keypair from your account by name.
Returns the SSH command to connect to an instance via the redu.cloud TCP proxy. ACCEPTS an instance id, a deployment's id / name / instance_id, OR a MANAGED DATASTORE's id / name / instance_id (Postgr
The VM's SERIAL CONSOLE: kernel messages and early-boot/cloud-init output. ⛔ THIS IS NOT YOUR APPLICATION'S LOGS. For a deployed app - a crash loop, a 500, a failed DB connection - use get_container_l
Start, stop, or reboot an instance. action must be START, STOP, REBOOT_SOFT, or REBOOT_HARD.
Creates a raw compute instance for custom OS/cloud-init workflows. For app/source deployments, prefer check_deploy_prerequisites -> plan_deploy -> deploy_app/deploy_compose; do not use create_instance
Permanently deletes an instance. This cannot be undone.
Provisions a managed PostgreSQL database on a dedicated VM on your private network. Requires a recent plan_managed_datastore. For app deployments, prefer deploy_app database:'managed' so plan_deploy i
Deletes a managed Postgres database and its underlying VM. Pass the numeric database id from list_databases. This cannot be undone.
Provisions a managed MySQL (or MariaDB) database on a dedicated VM on your private network — the relational-database resource (use this instead of create_database when the app needs MySQL/MariaDB, e.g
Deletes a managed MySQL/MariaDB database and its underlying VM. Pass the numeric id from list_relational_databases. This cannot be undone.
Provisions a managed ClickHouse database (OLAP / columnar analytics engine, Apache-2.0) on a dedicated VM on your private network — its OWN resource, NOT a relational database. Requires a recent plan_
Deletes a managed ClickHouse database and its underlying VM. Pass the numeric id from list_clickhouse_databases. This cannot be undone.
Turns an EXISTING, running single-machine managed Postgres or ClickHouse into a THREE-machine highly available cluster, in place, keeping the data and the same username, password and database name. Us
Provisions a managed Redis instance on a dedicated VM on your private network. Requires a recent plan_managed_datastore. It is PRIVATE — reachable only from another instance on the same private networ
Deletes a managed Redis instance and its underlying VM. Pass the numeric id from list_redis. This cannot be undone.
Deploys an app to a VM and exposes it at a public https://<name>-<id>.redu.cloud URL. The container is built ON the VM. PREREQS — run check_deploy_prerequisites first for network_id + keypair_name, th
Deploys a MULTI-CONTAINER app — a repo that ships docker-compose.yml / compose.yaml — onto ONE VM via podman-compose, and exposes one or more services at redu.cloud URLs. Use this instead of deploy_ap
Stands up a redu VPN gateway (WireGuard tunnelled over wstunnel on WSS/443) on your PRIVATE network, so you (or your team) can reach the private IPs of the VMs you deployed on redu, over a single http
Lists your app deployments. Each row carries status (provisioning/ready/build_failed/error), the current build phase while provisioning (installing/source/building/built/starting), the public access_p
Asks redu to re-probe a deployment's public URL and update its status from what it actually observes. USE THIS AFTER YOU HAVE FIXED A FAILED DEPLOY - a deployment that ended 'error' or 'build_failed'
Deletes a deployment and its underlying app VM. Pass the numeric id from list_deployments. IMPORTANT: if the deployment used database:'managed', the managed Postgres VM is NOT deleted (data safety) —
⭐ CALL THIS INSTEAD OF POLLING. Blocks until the deployment reaches a TERMINAL state (ready, build_failed, error or vm_missing) and returns, in ONE response, everything you would otherwise fetch after
Fetches ONE deployment by its numeric id (from list_deployments). Returns its current status, the public access_point URL, the underlying VM id, AND the build_log - IN FULL when status is 'build_faile
WHAT IS ACTUALLY RUNNING on a deployment's VM: every container's name, image, state, health, restart count, exit code and published ports - including the ones that have CRASHED, which are the ones you
THE APPLICATION'S OWN LOGS - what `docker logs`/`podman logs` would show for each container in a deployment. This is the tool for 'it deployed fine but it does not work': a 500, a crash loop, a failed
HOW MUCH ROOM IS LEFT on a deployment's VM: total/used/available memory, swap, disk free, load average, CPU count, and OOM kills in the last 24h - plus per-container memory and CPU. Use it to answer '
WHICH ENVIRONMENT VARIABLES the deployment was actually given, BY NAME - the keys in the env files on the VM (/opt/app-src/.env and friends), never the values. Most of the time the real question is 'd
Read-only. Fetches EVERY resource on your redu.cloud account (VMs, volumes, private networks, managed databases: Postgres/MySQL/MariaDB/ClickHouse/Redis/Qdrant, load balancers, and DNS access points)
Creates a snapshot of a running instance.
Deletes a snapshot by ID.
Creates a backup, by volumeId or by instanceId (the instance's volume is resolved for you). The backup is held independently of the instance, so it survives the VM. Poll list_backups until the new bac
Restores a backup into an existing volume (volumeId), an instance's volume (instanceId), or a new one (volumeName). Poll list_volumes for the restored volume. DISASTER RECOVERY (the original VM is gon
Deletes a backup by ID.
Turns nightly AUTOMATED (scheduled) backups ON or OFF for a MANAGED data service — the toggle that create_backup (a one-off volume snapshot) is NOT. Once enabled, redu's nightly job backs the service
Creates a block storage volume.
Attaches an EXISTING block volume to a running instance as an extra disk. This is how you finish a RESTORE after a VM is gone: restore_backup (volumeName) rebuilds the data into a new volume, then att
Detaches a block volume from an instance, leaving the volume (and its data) intact and 'available' to attach elsewhere. Unmount it INSIDE the guest first (`umount /mnt/...`) or you risk a dirty filesy
Permanently deletes a block storage volume and the data on it. This cannot be undone. The volume must be 'available' (detached) — detach_volume it first, and note you cannot detach a running instance'
Returns the DNS TXT record to add for custom domain ownership verification. Add the record to your DNS provider, then call verify_domain.
Checks the DNS TXT ownership record for a custom domain and marks it verified when the record is present. Call get_domain_verification first, add the TXT record at your DNS provider, then call this un
Checks if your account has everything needed to run autonomous coding agents. Returns a checklist: API key validity, private network, SSH keypair, and billing. Safe to call anytime — read-only. Call t
Creates a self-configuring controller VM on redu.cloud. Auto-discovers your network, Ubuntu image, and flavor. Generates and uploads an SSH keypair if you don't have one. The VM bootstraps itself — no
Starts the autonomous agent batch on your controller VM. Agents read agent-ready tasks from your ROADMAP.md, implement them in parallel, and open PRs. No VPN needed — runs over HTTPS; the controller s
Returns the current status of your controller VM. On a freshly set-up VM also returns the trigger token needed to authorize the fleet and to call trigger_agent_batch. Call this after setup_agent_fleet
One-shot tool that guides you through the complete agent setup: checks prerequisites, creates the controller VM, and returns next steps. Ideal for first-time setup. Call this when a user says 'set up
Complete one-shot setup: validates prerequisites, creates a controller VM + worker VMs, auto-creates a public HTTPS URL on port 7070, seeds a starter ROADMAP.md into the repo if absent, and returns th
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: delete_deployment
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
st_deployments. IMPORTANT: if the deployment used database:'managed', theRecommendationRemove model-directed instructions from tool descriptions.
tool: (server instructions)
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
ne only today - do not tell a user their MySQL is highly available. AN EXISRecommendationRemove model-directed instructions from tool descriptions.
tool: check_deploy_prerequisites
A tool description tries to alter the model’s use of another tool.
al ssh-keygen → import_keypair → write SSH_KEY_LOCATION-to-.env steps — run thRecommendationDescriptions must describe only their own tool.
tool: integrate_overview
A tool description tries to alter the model’s use of another tool.
's approval via create_api_key), inject it into the app, and call the redu APIRecommendationDescriptions must describe only their own tool.
tool: prepare_upload
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
d from your MCP credential — NO API key needed in the command and nothingRecommendationRemove side-channel parameters; constrain tool inputs.
tool: prepare_upload
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
turns the LOCAL shell commands to package your working directory andRecommendationAnnotate destructive tools and require human approval.
tool: prepare_upload
A tool description tries to alter the model’s use of another tool.
onse, then call deploy_app with that source_token (omit repo). The uploadRecommendationDescriptions must describe only their own tool.
tool: scaffold_local
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
n-compose.yml + .env so the user can run the app (and a throwaway loRecommendationRemove side-channel parameters; constrain tool inputs.
tool: scaffold_local
A tool description tries to alter the model’s use of another tool.
go straight to deploy_app any time. Honest caveat: the local Postgres isRecommendationDescriptions must describe only their own tool.
tool: plan_instance
A tool description tries to alter the model’s use of another tool.
ng. Happy path: import_keypair → plan_instance → create_instance → get_ssh_comRecommendationDescriptions must describe only their own tool.
tool: plan_managed_datastore
A tool description tries to alter the model’s use of another tool.
loss of a machine without manual failover, at roughly 3x the hourly rate.RecommendationDescriptions must describe only their own tool.
tool: select_surface
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
by its EXPOSE + CMD — never by directory name) and pass them in; reRecommendationAnnotate destructive tools and require human approval.
tool: select_surface
A tool description tries to alter the model’s use of another tool.
all this BEFORE plan_deploy. You enumerate the candidate surfaces (find eveRecommendationDescriptions must describe only their own tool.
tool: plan_deploy
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
, then pass the token here. The upload is NOT consumed by this: it stRecommendationRemove side-channel parameters; constrain tool inputs.
tool: plan_deploy
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
le / Dockerfile CMD)."},"has_container":{"type":"boolean","default"RecommendationAnnotate destructive tools and require human approval.
tool: plan_deploy
A tool description tries to alter the model’s use of another tool.
VM plan. Set heavy_build:true for resource-heavy builds (compiled-from-soRecommendationDescriptions must describe only their own tool.
tool: list_keypairs
A tool description tries to alter the model’s use of another tool.
If empty, call import_keypair first before creating instances.RecommendationDescriptions must describe only their own tool.
tool: list_media_spaces
A tool description tries to alter the model’s use of another tool.
ploads, or pass create_media_space:true to deploy_app/deploy_compose/upgrade_to_clRecommendationDescriptions must describe only their own tool.
tool: create_media_space
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
tion":"Existing SSH keypair name."},"security_group_names":{"type":RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_media_space
A tool description tries to alter the model’s use of another tool.
pace:true after plan_deploy approval; use this tool when manually preparingRecommendationDescriptions must describe only their own tool.
tool: upgrade_to_cluster
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"description":"SSH keypair name — from list_keypairs."},"port":{"tRecommendationRemove side-channel parameters; constrain tool inputs.
tool: upgrade_to_cluster
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n":"Single-line shell command to (re)start the app on each fresh membRecommendationAnnotate destructive tools and require human approval.
tool: upgrade_to_cluster
A tool description tries to alter the model’s use of another tool.
for a single_vm Postgres it fully-automatically provisions a managed DB +RecommendationDescriptions must describe only their own tool.
tool: upgrade_to_cluster
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
e-VM URL to the load-balancer URL across app config. It REFUSES a STATEFUL VM witRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: update_cluster
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
e/master VM you SSH into and change — it is also the always-on baseRecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_cluster
A tool description tries to alter the model’s use of another tool.
arge disk; poll list_clusters until the stack status is UPDATE_COMPLETE.RecommendationDescriptions must describe only their own tool.
tool: set_cluster_domain
A tool description tries to alter the model’s use of another tool.
t is what this tool is for: a real product on a real brand. The cluster itRecommendationDescriptions must describe only their own tool.
tool: delete_cluster
A tool description tries to alter the model’s use of another tool.
+ stack_id from list_clusters. Deleting extra members individually does NOT wRecommendationDescriptions must describe only their own tool.
tool: get_ssh_command
A tool description tries to alter the model’s use of another tool.
ity (without it, SSH to a deploy VM usually fails). The tool also best-effRecommendationDescriptions must describe only their own tool.
tool: get_instance_logs
A tool description tries to alter the model’s use of another tool.
onnection - use get_container_logs, which returns what the containers actually priRecommendationDescriptions must describe only their own tool.
tool: create_instance
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
.xlarge (16GB). SSH keypair must exist. For a public web app on a rRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_instance
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: create_database
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
,"description":"SSH keypair name — from list_keypairs (for operatinRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_database
A tool description tries to alter the model’s use of another tool.
the database survives losing a machine, and nobody has to fail it over byRecommendationDescriptions must describe only their own tool.
tool: create_database
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "db_password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: delete_database
A tool description tries to alter the model’s use of another tool.
atabase id from list_databases. This cannot be undone.RecommendationDescriptions must describe only their own tool.
tool: create_relational_database
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
th mysql_native_password auth so older clients/apps connect cleanly. (ClRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_relational_database
A tool description tries to alter the model’s use of another tool.
needs MySQL/MariaDB, e.g. WordPress, NextCloud, Matomo, many PHP/LAMP appsRecommendationDescriptions must describe only their own tool.
tool: create_relational_database
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "db_password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: delete_relational_database
A tool description tries to alter the model’s use of another tool.
numeric id from list_relational_databases. This cannot be undone.RecommendationDescriptions must describe only their own tool.
tool: create_clickhouse
A tool description tries to alter the model’s use of another tool.
ke reads and writes, so losing a machine costs no failover and no write paRecommendationDescriptions must describe only their own tool.
tool: create_clickhouse
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "db_password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: delete_clickhouse
A tool description tries to alter the model’s use of another tool.
numeric id from list_clickhouse_databases. This cannot be undone.RecommendationDescriptions must describe only their own tool.
tool: upgrade_to_ha
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
same username, password and database name. Use this when the user has aRecommendationRemove side-channel parameters; constrain tool inputs.
tool: upgrade_to_ha
A tool description tries to alter the model’s use of another tool.
rate, and the old single machine keeps billing until they delete it; (2) WRecommendationDescriptions must describe only their own tool.
tool: create_redis
A tool description tries to alter the model’s use of another tool.
te_networks (or check_deploy_prerequisites), list_keypairs — use the SAME network_id as thRecommendationDescriptions must describe only their own tool.
tool: create_redis
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: delete_redis
A tool description tries to alter the model’s use of another tool.
numeric id from list_redis. This cannot be undone.RecommendationDescriptions must describe only their own tool.
tool: deploy_app
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
":"UPLOAD MODE: token from prepare_upload's curl step — deploys an upRecommendationRemove side-channel parameters; constrain tool inputs.
tool: deploy_app
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
repare_upload's curl step — deploys an uploaded tarball of your LOCARecommendationAnnotate destructive tools and require human approval.
tool: deploy_app
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: deploy_app
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
-generate (then read the real URL from get_deployment)."},"env":{"type":"object",RecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: deploy_app
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "redis_password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: deploy_compose
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
":"UPLOAD MODE: token from prepare_upload — deploys an uploaded tarbaRecommendationRemove side-channel parameters; constrain tool inputs.
tool: deploy_compose
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
rvice|service> <cmd>` (Rails `bundle exec rails db:prepare`, DjangoRecommendationAnnotate destructive tools and require human approval.
tool: deploy_compose
A tool description tries to alter the model’s use of another tool.
k. Same prereqs + source modes as deploy_app; always run plan_deploy firstRecommendationDescriptions must describe only their own tool.
tool: deploy_compose
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
-generate (then read the real URL from get_deployment)."},"expose":{"type":"arrayRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: deploy_compose
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
as deploy_app; always run plan_deploy first. PORT is the HOST port for the exposed service.RecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: deploy_compose
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "redis_password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: verify_deployment
A tool description tries to alter the model’s use of another tool.
d this way; use get_containers for its container state instead.RecommendationDescriptions must describe only their own tool.
tool: delete_deployment
A tool description tries to alter the model’s use of another tool.
s id so you can delete_database it when you're done with the data. Cannot be unRecommendationDescriptions must describe only their own tool.
tool: wait_for_deployment
A tool description tries to alter the model’s use of another tool.
(ready, build_failed, error or vm_missing) and returns, in ONE response,RecommendationDescriptions must describe only their own tool.
tool: get_deployment
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
s not worth the tokens and used to make this response exceed the calleRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_deployment
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
e is nothing to overwrite the file with - in that case follow `next` and hand-editRecommendationAnnotate destructive tools and require human approval.
tool: get_deployment
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_containers
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
e you reach for SSH. get_deployment returns the deployment ROW (staRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_containers
A tool description tries to alter the model’s use of another tool.
silent, so use list_clusters for member-level state.RecommendationDescriptions must describe only their own tool.
tool: get_container_logs
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
kes up to ~15s. Secret-shaped values (PASSWORD=, TOKEN=, API_KEY=) areRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_container_logs
A tool description tries to alter the model’s use of another tool.
e. ⛔ DO NOT use get_instance_logs for this. That returns the VM's SERIAL CONSOLERecommendationDescriptions must describe only their own tool.
tool: get_resource_usage
A tool description tries to alter the model’s use of another tool.
er that keeps dying (an OOM kill leaves no application log at all - the prRecommendationDescriptions must describe only their own tool.
tool: get_env_keys
A tool description tries to alter the model’s use of another tool.
y), SSH in with get_ssh_command and read that single key: `sudo grep '^KEY=' /oRecommendationDescriptions must describe only their own tool.
tool: create_backup
A tool description tries to alter the model’s use of another tool.
es the VM. Poll list_backups until the new backup is available.RecommendationDescriptions must describe only their own tool.
tool: restore_backup
A tool description tries to alter the model’s use of another tool.
lumeName). Poll list_volumes for the restored volume. DISASTER RECOVERY (theRecommendationDescriptions must describe only their own tool.
tool: set_managed_backups
A tool description tries to alter the model’s use of another tool.
; see them with list_backups and recover with the service's restore. Works fRecommendationDescriptions must describe only their own tool.
tool: attach_volume
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
instance — then SSH in (get_ssh_command) and mount it (`lsblk` to fRecommendationRemove side-channel parameters; constrain tool inputs.
tool: attach_volume
A tool description tries to alter the model’s use of another tool.
ck device. Poll list_volumes until status is 'in-use'.RecommendationDescriptions must describe only their own tool.
tool: detach_volume
A tool description tries to alter the model’s use of another tool.
s into it. Poll list_volumes until status is 'available'.RecommendationDescriptions must describe only their own tool.
tool: delete_volume
A tool description tries to alter the model’s use of another tool.
e' (detached) — detach_volume it first, and note you cannot detach a runningRecommendationDescriptions must describe only their own tool.
tool: get_domain_verification
A tool description tries to alter the model’s use of another tool.
ider, then call verify_domain.RecommendationDescriptions must describe only their own tool.
tool: verify_domain
A tool description tries to alter the model’s use of another tool.
s present. Call get_domain_verification first, add the TXT record at your DNS provider,RecommendationDescriptions must describe only their own tool.
tool: check_agent_prerequisites
A tool description tries to alter the model’s use of another tool.
is first before create_controller.RecommendationDescriptions must describe only their own tool.
tool: create_controller
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
and uploads an SSH keypair if you don't have one. The VM bootstrapRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_controller
A tool description tries to alter the model’s use of another tool.
urns) then call trigger_agent_batch.RecommendationDescriptions must describe only their own tool.
tool: trigger_agent_batch
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "controller_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_agent_status
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "controller_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_agent_status
A tool description tries to alter the model’s use of another tool.
eet and to call trigger_agent_batch. Call this after setup_agent_fleet to confirm tRecommendationDescriptions must describe only their own tool.
tool: setup_agent_fleet
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
key. This is a shell command the USER runs in their own terminal; doRecommendationAnnotate destructive tools and require human approval.
tool: setup_agent_fleet
A tool description tries to alter the model’s use of another tool.
AP.md; (3) call trigger_agent_batch.RecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
to confirm your credential actually works (real round-trip). DEPLOY AN APRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
ssify by EXPOSE+CMD) and call select_surface — it ranks them by fixRecommendationAnnotate destructive tools and require human approval.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
d of one, so it costs roughly 3x the hourly rate: say that number to the uRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: whoami
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: check_deploy_prerequisites
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: deploy_overview
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_api_key
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: integrate_overview
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: prepare_upload
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: scaffold_local
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: plan_instance
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: plan_managed_datastore
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: select_surface
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: plan_deploy
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: plan_deploy
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
h a token, redu reads this file out of your upload and pasting it wastes 20-29RecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: list_instances
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_flavors
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_images
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_keypairs
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_security_groups
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_private_networks
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_volumes
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_snapshots
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_backups
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_clusters
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_dns_entries
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_domains
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_regions
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_databases
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_relational_databases
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_media_spaces
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_clickhouse_databases
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_redis
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_media_space
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: upgrade_to_cluster
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: update_cluster
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: set_cluster_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: delete_cluster
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: import_keypair
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: delete_keypair
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: get_ssh_command
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_instance_logs
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: instance_action
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_instance
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: delete_instance
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: create_database
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: delete_database
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: create_relational_database
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: delete_relational_database
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: create_clickhouse
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_clickhouse
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
ASSWORD/DB env, http://host:8123). Get the ids from plan_managed_datastore/list_RecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: delete_clickhouse
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: upgrade_to_ha
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: create_redis
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: delete_redis
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: deploy_app
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: deploy_compose
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: deploy_compose
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
pace:true. Redu writes an override file that points the WordPress service at managed DBRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: deploy_compose
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "compose_file"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: deploy_vpn
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_deployments
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: verify_deployment
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: delete_deployment
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: wait_for_deployment
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_deployment
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_deployment
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
`next` and hand-edit the existing file instead of replacing it."}},"required":["id"],"RecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: get_containers
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_container_logs
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_resource_usage
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_env_keys
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: architecture_diagram
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_snapshot
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: delete_snapshot
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: create_backup
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: restore_backup
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: delete_backup
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: set_managed_backups
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_volume
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: attach_volume
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: detach_volume
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: delete_volume
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: get_domain_verification
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: verify_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: check_agent_prerequisites
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_controller
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: trigger_agent_batch
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_agent_status
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: setup_agent_session
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: setup_agent_fleet
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: plan_deploy
An unusually long description is a common injection-padding tactic.
description length 3935 charsRecommendationKeep descriptions concise.
tool: upgrade_to_cluster
An unusually long description is a common injection-padding tactic.
description length 4968 charsRecommendationKeep descriptions concise.
tool: upgrade_to_ha
An unusually long description is a common injection-padding tactic.
description length 2147 charsRecommendationKeep descriptions concise.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.