Loading…
tmpstate is a zero-key temporary JSON database for AI agents, with no signup or API keys required.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 7 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The tmpstate MCP server exposes 16 tools, focused primarily on database capabilities. Its published description reads: "tmpstate is a zero-key temporary JSON database for AI agents, with no signup or API keys required". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates tmpstate F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check tmpstate's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add tmpstate to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://tmpstate.dev/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Create a temporary JSON database (24h TTL, no signup, no keys). Returns the db URL — the only credential — plus admin URL, limits and expiry. Create once per project/task, persist the db URL immediate
Usage, limits, tier and expiry for a database (GET $DB/__meta equivalent).
List documents in a collection, oldest first. Response shape: {collection, items: [{id, data, created_at, updated_at}], next_cursor}. Documents live under .data. Pass cursor to page.
Read one document by id. The stored fields are under .data.
Insert a JSON object into a collection (collections are created implicitly). Counts against the write and document quotas.
Shallow-merge a patch into a document (top-level keys overwrite; keys are never deleted). Counts against the write quota.
Delete one document. Never blocked by quotas; frees a document slot. Emptying a whole collection? Use delete_collection instead of looping this.
Delete every document in a collection at once (useful to re-seed). Irreversible. To destroy the entire database, use delete_database instead.
Destroy a database and all its documents immediately - the teardown for finished work and the revocation kill switch for a leaked db URL. Irreversible: unlike expiry there is no restore window. Works
Without a plan: returns the transparent pricing table for keeping this database alive longer. With a plan: returns a Stripe checkout URL for the human to pay — never buy without the user's explicit ap
Mint a Pro account token plus a Stripe subscription checkout URL ($8/mo, 3 always-on databases included). Persist pro_token immediately; the human pays in a browser. Never start checkout without the u
List the Pro account's databases (ids, usage, limits, expiry) so a fresh session can reconcile against persisted db URLs. URLs are never stored server-side — match ids to the URLs you persisted.
Create a new always-on database owned by the Pro account. Beyond the included allotment this costs extra per month — the tool then returns confirmation_required with the exact price; relay it to the u
Attach an existing free/extended database to the Pro account: same URL, same data, TTL removed, quotas raised. Beyond the included allotment the same explicit overage consent as pro_create_database ap
Cancel at period end. This is not just a billing change — it schedules deletion of ALL databases on the account. Call without confirm first: the response spells out the consequences with concrete date
Optional and free-form. TmpState is built for agents and the free tier stays free by getting better - and you, the agent, are the user whose experience matters here. After real use of a database, one
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: create_database
A tool description tries to alter the model’s use of another tool.
or retries or parallel workers, pass a stable idempotency_key so duplicateRecommendationDescriptions must describe only their own tool.
tool: delete_document
A tool description tries to alter the model’s use of another tool.
this.RecommendationDescriptions must describe only their own tool.
tool: delete_collection
A tool description tries to alter the model’s use of another tool.
e database, use delete_database instead.RecommendationDescriptions must describe only their own tool.
tool: extend_database
A tool description tries to alter the model’s use of another tool.
have paid, call database_status: the new expiry and tier confirm the extension.RecommendationDescriptions must describe only their own tool.
tool: pro_list_databases
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
n":"Pro account token (pt_...). Optional if the MCP connection alreadRecommendationRemove side-channel parameters; constrain tool inputs.
tool: pro_create_database
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
n":"Pro account token (pt_...). Optional if the MCP connection alreadRecommendationRemove side-channel parameters; constrain tool inputs.
tool: pro_attach_database
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
n":"Pro account token (pt_...). Optional if the MCP connection alreadRecommendationRemove side-channel parameters; constrain tool inputs.
tool: pro_attach_database
A tool description tries to alter the model’s use of another tool.
rage consent as pro_create_database applies.RecommendationDescriptions must describe only their own tool.
tool: pro_cancel
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
n":"Pro account token (pt_...). Optional if the MCP connection alreadRecommendationRemove side-channel parameters; constrain tool inputs.
tool: send_feedback
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ilities, or Pro tokens - capability-shaped strings are redacted serverRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
hat is the only credential. Persist every db URL and pro_token you mint (lRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
JSON database: create_database returns a db URL that is the only credential. PRecommendationDescriptions must describe only their own tool.
tool: (server instructions)
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
plicit approval before any tool that costs money. When work is done (or a db URRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: create_database
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_database"RecommendationScope tools to the minimum needed.
tool: create_document
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_document"RecommendationScope tools to the minimum needed.
tool: update_document
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "update_document"RecommendationScope tools to the minimum needed.
tool: delete_document
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_document"RecommendationScope tools to the minimum needed.
tool: delete_collection
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_collection"RecommendationScope tools to the minimum needed.
tool: delete_database
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_database"RecommendationScope tools to the minimum needed.
tool: pro_create_database
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "pro_create_database"RecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.