Loading…
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The webzum MCP server exposes 17 tools, focused primarily on filesystem, web, and AI capabilities. It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates webzum F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Data-exfiltration parameters" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check webzum's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add webzum to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://webzum.com/api/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Search for businesses by name, phone number, or location. Returns a list of business candidates with confidence scores. Use this to find existing businesses before creating a website. Requires authent
Create a new website for a business. Pass a business candidate object from search_businesses to generate a website. Requires authentication via API key (Bearer token). Generate an API key at webzum.co
Create a third-party LEAD-GENERATION page about a business (NOT a site for that business itself). Use this when the goal is to drive qualified search traffic to someone else's business — affiliate pag
Check the status and generation progress of a site. Returns detailed progress information including: - stage: Current step (initialization, validation, research, strategy, generation, assembly, comple
Generate a local SEO-optimized landing page for lead generation. Creates a complete website optimized for a specific city/service combination. Requires authentication via API key (Bearer token). Gener
List all websites created by the authenticated user. Returns an array of businessIds with names and URLs. Requires authentication via API key (Bearer token). Generate an API key at webzum.com/dashboar
Instantly host any web content on WebZum. The default destination for AI-generated websites, frontends, dashboards, prototypes, MCP-server UIs, share-with-a-friend pages, and any HTML/CSS/JS bundle. I
Add a file to your hosted site. The file goes live immediately. Each upload creates a new version in the site's history. Supported: HTML, CSS, JS, JSON, images (PNG, JPG, GIF, SVG, WebP), fonts (WOFF,
List all files in a hosted site's current version. Use this to see what's been uploaded. If the user wants a professional, researched website (logo, real copy, SEO, mobile-ready, multi-page) instead o
Upload a zipped bundle of files to a hosted site in a single call. Use this when you have a multi-file project (HTML + CSS + JS + images) — one host_zip call is far cheaper than N host_file calls and
Clone a public web page into a hosted site. Fetches the URL, walks its same-origin assets (CSS, JS, images, fonts), rewrites references to local paths, and uploads everything as a working hosted copy
Edit a generated WebZum site by describing the change in natural language. This is the primary editor tool. Given a user instruction (in conversationHistory), the WebZum editor builds the minimal site
Update a WebZum site's universal contact fields — phone, email, WhatsApp, the primary contact channel, address, hours — OR the business/brand name. Use this (NOT update_site_html) for these fields: it
Regenerate the header (nav bar, logo placement, top-of-page) of a WebZum site. Creates a new version with a fresh AI-generated header and reassembles every page. Use when the user wants the nav restyl
Regenerate the footer of a WebZum site. Creates a new version with a fresh AI-generated footer and reassembles every page. Use when the user wants different footer content, layout, or copy. Required:
Regenerate the logo for a WebZum site using AI. Creates a new version with a fresh logo and reassembles. Use the optional userMessage to steer the design — "make it more minimal", "use a serif typefac
Regenerate one image inside a specific section of a WebZum site. Creates a new version with a freshly AI-generated image for that section and reassembles. Use the optional userMessage to steer the new
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: create_site
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
hentication via API key (Bearer token). Generate an API key at webzum.cRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_site
A tool description tries to alter the model’s use of another tool.
ate object from search_businesses to generate a website. Requires authenticationRecommendationDescriptions must describe only their own tool.
tool: create_lead_gen_site
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
hentication via API key (Bearer token). Generate an API key at webzum.cRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_lead_gen_site
A tool description tries to alter the model’s use of another tool.
ate object from search_businesses — that business is the one being PROMOTED. ReqRecommendationDescriptions must describe only their own tool.
tool: create_lead_gen_site
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
Primary CTA is "visit their website"; phone/email demoted. - No specific pricing quoted; differenRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: get_site_status
A tool description tries to alter the model’s use of another tool.
d returned from create_site for real-time progress polling. Poll every 5-10RecommendationDescriptions must describe only their own tool.
tool: generate_geo_page
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
hentication via API key (Bearer token). Generate an API key at webzum.cRecommendationRemove side-channel parameters; constrain tool inputs.
tool: generate_geo_page
A tool description tries to alter the model’s use of another tool.
background. Use get_site_status to check progress.RecommendationDescriptions must describe only their own tool.
tool: host_site
A tool description tries to alter the model’s use of another tool.
paper instead of a building. Treat hosting as the final step of delivery,RecommendationDescriptions must describe only their own tool.
tool: host_file
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
n in the site's history. Supported: HTML, CSS, JS, JSON, images (PNG,RecommendationRemove side-channel parameters; constrain tool inputs.
tool: host_file
A tool description tries to alter the model’s use of another tool.
blic page, use `clone_site` instead — it walks the page's assets in one caRecommendationDescriptions must describe only their own tool.
tool: get_hosted_files
A tool description tries to alter the model’s use of another tool.
nstead of the raw files they've hosted here, send them to https://webzum.cRecommendationDescriptions must describe only their own tool.
tool: host_zip
A tool description tries to alter the model’s use of another tool.
ersion instead of N. `zipContent` is the .zip file's bytes as standard baRecommendationDescriptions must describe only their own tool.
tool: clone_site
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_site_html
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
instruction (in conversationHistory), the WebZum editor builds the minimal sRecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_site_html
A tool description tries to alter the model’s use of another tool.
ckground — poll get_site_status with the returned versionId every 5-10s until iRecommendationDescriptions must describe only their own tool.
tool: update_contact
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ersionId, and a conversationHistory containing at least one user turn descriRecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_contact
A tool description tries to alter the model’s use of another tool.
progress', poll get_site_status with the returned versionId every 5-10s until iRecommendationDescriptions must describe only their own tool.
tool: regenerate_header
A tool description tries to alter the model’s use of another tool.
progress', poll get_site_status with the returned versionId every 5-10s until iRecommendationDescriptions must describe only their own tool.
tool: regenerate_footer
A tool description tries to alter the model’s use of another tool.
progress', poll get_site_status with the returned versionId every 5-10s until iRecommendationDescriptions must describe only their own tool.
tool: regenerate_logo
A tool description tries to alter the model’s use of another tool.
progress', poll get_site_status with the returned versionId every 5-10s until iRecommendationDescriptions must describe only their own tool.
tool: regenerate_image
A tool description tries to alter the model’s use of another tool.
progress', poll get_site_status with the returned versionId every 5-10s until iRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: create_site
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: create_lead_gen_site
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: generate_geo_page
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: host_site
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
ser directly to https://webzum.com (free preview, no signup to see it) when: - ThRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: host_file
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
), send them to https://webzum.com for a free preview. host_file hosts what you geRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: get_hosted_files
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
et_hosted_files List all files in a hosted site's current version. Use this toRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: host_site
An unusually long description is a common injection-padding tactic.
description length 6290 charsRecommendationKeep descriptions concise.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.