Loading…
Access Japan's finest Michelin-starred restaurants
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The TableAll MCP Server MCP server exposes 10 tools, focused primarily on web capabilities. Its published description reads: "Access Japan's finest Michelin-starred restaurants". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates TableAll MCP Server F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check TableAll MCP Server's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add TableAll MCP Server to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.tableall.com/sseStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Browse restaurants by region, cuisine, or area. Returns a directory-style list with name, location, Michelin stars, and starting price. Does not include real-time availability — for date-based searche
Get the full profile of one specific restaurant: untrimmed description, booking_rules, booking_tips, address, operating_hours, seating, and starting price. Use when the user names a specific restauran
Get the menu for a specific restaurant: an array of course names and their prices. Use when the user asks about a specific restaurant's menu, courses, or course pricing. This tool returns course names
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: search_restaurants
A tool description tries to alter the model’s use of another tool.
t_id, then call get_restaurant_details for the full profile and get_restaurant_menu foRecommendationDescriptions must describe only their own tool.
tool: get_restaurant_details
A tool description tries to alter the model’s use of another tool.
eed fields that search_restaurants does not return. Does not return menu or coursRecommendationDescriptions must describe only their own tool.
tool: check_availability
A tool description tries to alter the model’s use of another tool.
or cuisine, use search_available_restaurants instead. Use the exact parameter names start_dRecommendationDescriptions must describe only their own tool.
tool: search_available_restaurants
A tool description tries to alter the model’s use of another tool.
restaurant, use check_availability instead. Date handling: if the user gives onlyRecommendationDescriptions must describe only their own tool.
tool: get_cancellation_policies
A tool description tries to alter the model’s use of another tool.
ation_request. get_restaurant_details returns booking_rules and booking_tips, which dRecommendationDescriptions must describe only their own tool.
tool: create_reservation
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
nse: store data.access_token (required by get_reservation_status). If user.iRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_reservation
A tool description tries to alter the model’s use of another tool.
ed). Use after check_availability has returned an opening and the user has chosenRecommendationDescriptions must describe only their own tool.
tool: get_reservation_status
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
. Requires the access_token that was returned in the create_reservation resRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_reservation_status
A tool description tries to alter the model’s use of another tool.
returned in the create_reservation response. You MUST have stored the access_tokenRecommendationDescriptions must describe only their own tool.
tool: get_reservation_status
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: create_reservation_request
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
nse: store data.access_token (required by get_reservation_request_status). IRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_reservation_request
A tool description tries to alter the model’s use of another tool.
size. Use after check_availability or search_available_restaurants has been run anRecommendationDescriptions must describe only their own tool.
tool: get_reservation_request_status
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
. Requires the access_token that was returned in the create_reservation_reqRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_reservation_request_status
A tool description tries to alter the model’s use of another tool.
returned in the create_reservation_request response. You MUST have stored the access_tokenRecommendationDescriptions must describe only their own tool.
tool: get_reservation_request_status
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Check real-time availability for one specific restaurant within a date range. Returns all openings for that restaurant; it does not filter by time of day. Use when you already know which restaurant th
Search across multiple restaurants for availability within a date range. Returns restaurants that have openings, filterable by prefecture, area, genre, and party size. Use when the user does not yet h
Read-only: retrieve a restaurant's cancellation policy. This tool only reads policy data; it does not cancel or modify any reservation. Safe to call repeatedly. Use when the user asks about the cancel
Create a direct reservation for a specific available opening (opening_id required). Use after check_availability has returned an opening and the user has chosen which opening_id to book. If check_avai
Check the status of a reservation by session ID. Requires the access_token that was returned in the create_reservation response. You MUST have stored the access_token from the create response to use t
Submit a reservation request for a selected restaurant, dates, time range, and party size. Use after check_availability or search_available_restaurants has been run and the user confirms they want to
Check the status of a reservation request by session ID. Requires the access_token that was returned in the create_reservation_request response. You MUST have stored the access_token from the create r