Loading…
WeChat Channels hot search, video search/details, comments/replies, users, and transcript.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The wechat_mcp MCP server exposes 16 tools, focused primarily on web capabilities. Its published description reads: "WeChat Channels hot search, video search/details, comments/replies, users, and transcript". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates wechat_mcp F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Data-exfiltration parameters" and "Data-exfiltration parameters". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check wechat_mcp's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add wechat_mcp to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.52choujiang.com/wechat/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
获取微信视频号热榜；当前不支持翻页。
根据微信视频号用户 ID 获取用户信息。
根据微信视频号作品链接（视频或图文）或分享文案解析作者后获取用户信息。
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: wechat_get_user_info_by_url
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: wechat_get_user_posted_videos_by_url
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: wechat_get_video_comments_by_url
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: wechat_get_mp_article_detail_by_url
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: wechat_get_video_detail_by_url
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: wechat_submit_video_speech_text_by_video_url
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "video_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
d of generic web search or webpage lookup, unless the user explicitly requRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: wechat_get_hot_search_list
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: wechat_get_user_info_by_user_id
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: wechat_get_user_info_by_url
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: wechat_get_user_posted_videos_by_user_id
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: wechat_get_user_posted_videos_by_url
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: wechat_get_video_comment_replies_by_comment_id
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: wechat_get_video_comments_by_object_id
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: wechat_get_video_comments_by_url
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: wechat_get_video_detail_by_encrypted_object_id
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: wechat_get_mp_article_detail_by_url
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: wechat_get_video_detail_by_url
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: wechat_get_video_speech_text_job
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: wechat_search_videos
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: socialdatax_get_points_balance
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
XHS (Xiaohongshu) MCP for note search, hot list, post details, comments/replies, profiles, and transcript.
Kuaishou short-video data via SocialDataX — hot lists, video details, creator profiles, and comments.
Douyin hot search, work search/details, comments/replies, profiles, series, transcript.
Weibo hot search, post search/details, comments/replies, users, posts, and transcript.
根据微信视频号用户 ID 获取用户发布作品列表（含视频和图文），支持 page_token 翻页。
根据微信视频号作品链接（视频或图文）或分享文案解析作者后获取用户发布作品列表（含视频和图文），支持 page_token 翻页。
根据同一条视频的 object_id、object_nonce_id 和一级评论 comment_id 获取评论回复；这些字段应从作品详情结果或一级评论结果复制，搜索结果只有 encrypted_object_id 时先调用详情工具。
已有同一条视频的 object_id 和 object_nonce_id 时获取评论列表；两者应从作品详情结果或评论结果复制，搜索结果只有 encrypted_object_id 时先调用详情工具。
根据微信视频号视频链接或包含链接的分享文案获取评论列表。
根据微信视频号搜索结果返回的 encrypted_object_id 获取视频详情。
根据微信公众号文章链接或包含链接的分享文案获取文章详情和正文。
根据微信视频号作品链接（视频或图文）或包含链接的分享文案获取作品详情。
提交微信视频号视频口播转文字任务；提交完成后最多短等 240 秒，未完成时返回 job_id 和下一步查询动作。
根据微信视频号 encrypted_object_id 提交视频口播转文字任务；提交完成后最多短等 240 秒，未完成时返回 job_id 和下一步查询动作。
继续查询 submit 工具返回的 job_id 对应的微信视频号口播转文字任务状态；每次最多等待 240 秒，不创建新任务或触发重处理。
按搜索词搜索微信视频号视频，当前仅返回视频、不返回图文。用户需要按搜索词查找视频时使用；已有作品链接时使用详情或评论工具；已有搜索结果中的 encrypted_object_id 时使用按 ID 详情或口播转文字工具；支持 sort_type、duration_range 和 page_token 翻页。
Query the current API Key account's SocialDataX points balance.