Unreleased: not public yet. Maintainers have not reviewed this result.
Results / @modelcontextprotocol/server-everything
@modelcontextprotocol/server-everything
D
Protocol3/4 points · capped at Dcritical: secret-echo
F
Network1.5/4 pointscritical: net-loopback-ssrf
Coverage: low (3 of 13 tools reached with a valid call).
Protocol checks
| Check | Verdict | What happened |
|---|---|---|
| protocol Valid MCP handshake and tool schemas | pass | handshake ok, 13 well-formed tool(s) |
| tool-poisoningcritical No tool-poisoning indicators in tool metadata | pass | scanned 13 tool definition(s), 4 prompt(s) and 7 resource(s), including parameter text: nothing suspicious |
| robust-input Survives malformed tool input | pass | 28 invalid call(s) rejected cleanly |
| secret-echocritical No environment secret echoed in responses | fail | a canary secret from the server's environment appeared in a response of tool get-env |
Network checks
| Check | Verdict | What happened |
|---|---|---|
| net-loopback-ssrfcritical Refuses loopback targets (SSRF) | fail | gzip-file-as-resource contacted a loopback listener the harness owns (loopback, localhost, ipv6, short, hex, decimal, unspecified, ipv4-mapped, redirect): 9 of 9 probes reached it |
| net-scheme-allowlistcritical Only http(s) schemes accepted | partial | the server accepts data: URLs (data); no file read and no raw connection was seen |
| net-caps Response size and time are capped | partial | size: the reply was 0.00 MiB (limit 16 MiB); time: no reply within 18 s (timeout_probe_sec 10 + 8 s) |
| net-redirect Redirects are re-validated | partial | redirects are followed; whether the target is re-validated could not be told apart, because the server accepted every loopback spelling directly |
Effects checks
| Check | Verdict | What happened |
|---|---|---|
| annotation-honestycritical Read-only tools change nothing | n/a | no tool declared readOnlyHint: true could be given a harness-owned control argument |
| openworld-honesty Closed-world tools stay on the machine | n/a | no tool declares openWorldHint: false that could be given a harness-owned control argument |
| undeclared-writes (advisory) Unannotated tools leave the sandbox unchanged | n/a | no unannotated read-style tool could be given a harness-owned control argument |
What was not covered
- Database: Not applicable. Server config has no {dsn}/{host}/... Placeholder, so the harness cannot start the server once per role
- HTTP: Not applicable. The server is started over stdio; the http pack needs server.url
- Files: Not applicable. No tool is classified as taking a file path with medium confidence or higher
- Git: Not applicable. No tool is classified as taking a git repository path with medium confidence or higher
- SQLite: Not applicable. No tool takes a SQL string
- Effects: Not applicable. No tool declared readOnlyHint: true could be given a harness-owned control argument
- Tool "gzip-file-as-resource" also looks like a path tool (secondary class); only its primary class (url) was probed
- Tools that a server lists only for clients that declare roots, sampling or elicitation capabilities are not seen: the harness declares none
- Tool "echo" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- Tool "get-annotated-message" is covered by the core checks only: the tool has no string parameters; add it under tools: to include it
- Tool "get-env" is covered by the core checks only: the tool takes no parameters; add it under tools: to include it
- Tool "get-resource-links" is covered by the core checks only: the tool has no string parameters; add it under tools: to include it
- Tool "get-resource-reference" is covered by the core checks only: the tool has no string parameters; add it under tools: to include it
- Tool "get-structured-content" is covered by the core checks only: every parameter is an enum; add it under tools: to include it
Run it yourself
Started with the standard settings like this; put it in sealmark.yaml as the server:
npx -y @modelcontextprotocol/server-everything@1.0.0
Each of 613 verdicts was checked independently, and Sealmark was wrong on some: how reliable Sealmark is.
Think a verdict is wrong, or want a server removed? Email disclosure@sealmark.dev with the server version. We recheck, correct the page if we were wrong, and add your reply. See the disclosure policy.