Loading…
SIP/VoIP telecom grounding for AI agents with vendor docs, RFCs, and 21 diagnostic utilities.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The sipflow MCP server exposes 22 tools, focused primarily on communication, web, and network capabilities. Its published description reads: "SIP/VoIP telecom grounding for AI agents with vendor docs, RFCs, and 21 diagnostic utilities". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates sipflow F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check sipflow's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add sipflow to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.sipflow.dev/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
[cost: rag (one embed + one vector search) | read-only, network: outbound to embed model only] Vector search over Sipflow's curated VoIP knowledge base: vendor docs (Asterisk, FreeSWITCH, Kamailio, Op
[cost: free (pure CPU, no network) | read-only] Instant static lookup of a SIP response code (100-699). Returns name, RFC anchor, category, description, common operator-flavored causes, and known vend
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: search_sip_docs
A tool description tries to alter the model’s use of another tool.
ndor:` filter; `lookup_response_code` / `lookup_sip_header` to short-circuit beforeRecommendationDescriptions must describe only their own tool.
tool: lookup_response_code
A tool description tries to alter the model’s use of another tool.
static entry; `lint_sip_request` when the code is 4xx and the user has the offeRecommendationDescriptions must describe only their own tool.
tool: lookup_sip_header
A tool description tries to alter the model’s use of another tool.
t these rules; `search_sip_docs` for vendor-specific or 3GPP P-headers not in tRecommendationDescriptions must describe only their own tool.
tool: detect_sip_stack
A tool description tries to alter the model’s use of another tool.
dor` filter on `search_sip_docs`, so you can pipe the output of this tool direcRecommendationDescriptions must describe only their own tool.
tool: detect_sip_vendor_from_config
A tool description tries to alter the model’s use of another tool.
+ risk flags; `search_sip_docs(vendor=<slug>, ...)` to ground each directive.RecommendationDescriptions must describe only their own tool.
tool: minimize_sip_trace
A tool description tries to alter the model’s use of another tool.
e vendor, then `search_sip_docs(vendor=...)` for vendor-grounded analysis; `renRecommendationDescriptions must describe only their own tool.
tool: render_sip_ladder
A tool description tries to alter the model’s use of another tool.
`. Pair with: `minimize_sip_trace` first to compact a noisy trace; `diff_sip_messRecommendationDescriptions must describe only their own tool.
tool: sip_ladder_example
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: lint_sip_request
A tool description tries to alter the model’s use of another tool.
ntity headers; `search_sip_docs({ sourceType: 'stir-shaken', ... })` to groundRecommendationDescriptions must describe only their own tool.
tool: parse_sip_message
A tool description tries to alter the model’s use of another tool.
y. Pair with: `lint_sip_request` for the full RFC compliance suite (request onlRecommendationDescriptions must describe only their own tool.
tool: diff_sip_messages
A tool description tries to alter the model’s use of another tool.
ame malformed; `search_sip_docs(vendor=<intermediate>)` once you know which hopRecommendationDescriptions must describe only their own tool.
tool: review_sip_config
A tool description tries to alter the model’s use of another tool.
tc_sip_checklist` when the config is a WebRTC ↔ SIP bridge.RecommendationDescriptions must describe only their own tool.
tool: webrtc_sip_checklist
A tool description tries to alter the model’s use of another tool.
tured outline; `search_sip_docs(vendor=...)` to ground each unchecked item in vRecommendationDescriptions must describe only their own tool.
tool: parse_sdp
A tool description tries to alter the model’s use of another tool.
38 reinvites); `webrtc_sip_checklist` for the bridge-config angle.RecommendationDescriptions must describe only their own tool.
tool: compare_sdp_offer_answer
A tool description tries to alter the model’s use of another tool.
in isolation; `search_sip_docs(vendor=...)` to ground vendor-specific fixes (FRecommendationDescriptions must describe only their own tool.
tool: validate_stir_shaken_identity
A tool description tries to alter the model’s use of another tool.
nterpretation; `lookup_response_code(438)` for the SIP-side context; `lint_sip_requeRecommendationDescriptions must describe only their own tool.
tool: stir_attestation_explainer
A tool description tries to alter the model’s use of another tool.
aphic verdict; `search_sip_docs({ sourceType: 'stir-shaken', ... })` for ATIS /RecommendationDescriptions must describe only their own tool.
tool: validate_e164_number
A tool description tries to alter the model’s use of another tool.
t. Pair with: `lint_sip_request` to validate that PASSporT `orig.tn` matches thRecommendationDescriptions must describe only their own tool.
tool: troubleshoot_response_code
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: troubleshoot_response_code
A tool description tries to alter the model’s use of another tool.
per IP] Like `lookup_response_code` but augmented: returns the static RFC entry PLRecommendationDescriptions must describe only their own tool.
tool: dns_diagnose_sip_target
A tool description tries to alter the model’s use of another tool.
P SIP OPTIONS surfaces nodes that resolve and accept the transport but nevRecommendationDescriptions must describe only their own tool.
tool: fetch_sipflow_share
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
e link into the conversation [cost: external_io (Mongo + S3 fetch on the SipRecommendationRemove side-channel parameters; constrain tool inputs.
tool: fetch_sipflow_share
A tool description tries to alter the model’s use of another tool.
e` - pair with `minimize_sip_trace` to compact further before passing to your ownRecommendationDescriptions must describe only their own tool.
tool: submit_sipflow_feedback
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
s, or any other PII. Summarize in your own words instead. The serveRecommendationRemove side-channel parameters; constrain tool inputs.
tool: submit_sipflow_feedback
A tool description tries to alter the model’s use of another tool.
: - docs_gap: search_sip_docs returned nothing useful, vendor missing, coveraRecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
flow.dev/share/<token> URL, call this first to load the trace + AI anRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
d of paraphrasing. Binary input (pcap / pcapng): Sipflow trace tools acceRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: search_sip_docs
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: validate_stir_shaken_identity
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: troubleshoot_response_code
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: dns_diagnose_sip_target
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: dns_diagnose_sip_target
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
ndwidth, …; see https://www.twilio.com/docs/sip-trunking/api/ipaccesscontrollist-resource) and is dropping our probe be…RecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: fetch_sipflow_share
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: fetch_sipflow_share
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
flow share URL (https://sipflow.dev/share/<token>, or any sipflow.dev subdomain that serveRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: submit_sipflow_feedback
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: search_sip_docs
An unusually long description is a common injection-padding tactic.
description length 2290 charsRecommendationKeep descriptions concise.
tool: dns_diagnose_sip_target
An unusually long description is a common injection-padding tactic.
description length 3696 charsRecommendationKeep descriptions concise.
tool: fetch_sipflow_share
An unusually long description is a common injection-padding tactic.
description length 2549 charsRecommendationKeep descriptions concise.
tool: submit_sipflow_feedback
An unusually long description is a common injection-padding tactic.
description length 2085 charsRecommendationKeep descriptions concise.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
[cost: free (pure CPU, no network) | read-only] Instant lookup of a SIP header by canonical or compact form (e.g. "Via" / "v", "Diversion", "P-Asserted-Identity", "Identity", "Session-Expires"). Retur
[cost: free (pure CPU, no network) | read-only] Identify the SIP product behind a piece of input. Works on both: - a SIP trace (User-Agent / Server headers from PCAP/sngrep/syslog), and - a vendor con
[cost: free (pure CPU, no network) | read-only] Heuristic-only sibling of `detect_sip_stack`, scoped to vendor configs. Returns the matched vendor slug, a confidence level, and the structural signals
[cost: free (pure CPU, no network) | read-only, no persistence] Reduce a raw SIP trace to a compact form suitable for sending to an LLM. Preserves SDP bodies and routing/auth/dialog headers; prunes we
[cost: free (pure CPU, no network) | read-only] Parse a raw SIP trace (PCAP-decoded text, sngrep export, syslog, or pasted INVITE/200 dialog) and emit a Mermaid `sequenceDiagram` block visualizing the
[cost: free (pure CPU, no network) | read-only] Return a hand-curated SIP scenario as a Mermaid `sequenceDiagram` plus a bullet list of step-by-step explanations with RFC references. Use this when the
[cost: free (pure CPU, no network) | read-only, no persistence] Run RFC 3261 / RFC 3325 / RFC 8224 / RFC 8225 / CTIA BCID compliance checks on a single raw SIP request (typically an INVITE) and return
[cost: free (pure CPU, no network) | read-only, no persistence] Parse a single raw SIP message (request OR response) and return a structured view: start line (method/status), every header in order wit
[cost: free (pure CPU, no network) | read-only, no persistence] Take two SIP messages (typically the same request observed at two adjacent hops - e.g. the INVITE leaving FreeSWITCH and the INVITE arri
[cost: free (pure CPU, no network) | read-only] Use this when the user asks 'review my config' or attaches a kamailio.cfg, sip.conf, pjsip.conf, FreeSWITCH XML profile, opensips.cfg, `res_fax.conf` /
[cost: free (pure CPU, no network) | read-only] Return a curated checklist of WebRTC ↔ SIP requirements (WSS transport, ICE gathering, DTLS-SRTP fingerprint, rtcp-mux + BUNDLE, media relay / rtpengine
[cost: free (pure CPU, no network) | read-only] Parse a Session Description Protocol body and return a structured view: origin, session, timing, per-media codecs (rtpmap + fmtp), direction, DTLS setup
[cost: free (pure CPU, no network) | read-only] Diff a SIP/SDP offer and answer and surface the issues that actually break calls in practice: codec intersection per m-line, direction compatibility (se
[cost: external_io (HTTPS fetch of the x5u cert) | read-only] Verify a SIP `Identity:` JWS (RFC 8224 / SHAKEN). Fetches the x5u certificate, parses it, verifies the ES256 signature against the cert's
[cost: free (pure CPU, no network) | read-only] Static explainer for STIR/SHAKEN: maps attestation levels (A / B / C per RFC 8588) to plain-English requirements + common scenarios, and SIP codes commo
[cost: free (pure CPU, no network) | read-only] Parse a phone number, normalize to E.164, and classify it. International coverage is via libphonenumber-js (every country, line type when known). NANP n
[cost: rag (one embed + one vector search) | read-only, network: outbound to embed model only | rate-limited per IP] Like `lookup_response_code` but augmented: returns the static RFC entry PLUS the to
[cost: external_io (DNS via Cloudflare + Google; TLS handshake + a SIP OPTIONS keepalive to public targets when applicable) | read-only | rate-limited per IP: 10/min, 200/day] Walk DNS the same way a
[cost: external_io (Mongo + S3 fetch on the Sipflow backend) | read-only, no persistence | rate limit: shared with the public share endpoint] Given a Sipflow share URL (https://sipflow.dev/share/<toke
[cost: write (single MongoDB row) | rate-limited per IP: 3/min, 20/day] Send the Sipflow team feedback when something doesn't work, a vendor or RFC isn't covered, or a tool produced a wrong/incomplete