Loading…
Digital signage platform that lets AI agents push HTML, dashboards, and live data to managed displays.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 27 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The agentView MCP MCP server exposes 57 tools, focused primarily on web capabilities. Its published description reads: "Digital signage platform that lets AI agents push HTML, dashboards, and live data to managed displays". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates agentView MCP F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check agentView MCP's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add agentView MCP to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://agentview.de/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Assigns displays to categories. mode 'replace' (default) sets the full category list of each display in display_ids to category_ids; mode 'add' or 'remove' adds/removes one category (category_ids[0])
Lists data slots with optional filtering. Returns metadata only (no jsonContent). Each item includes readUrl. Use readUrl in display HTML fetch() calls. Requires authentication.
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: get_agent_artifact
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
store template: system prompt, Agent Skills SKILL.md or MCP-config snippet. PRecommendationRemove model-directed instructions from tool descriptions.
tool: assign_display_categories
A tool description tries to alter the model’s use of another tool.
scover IDs with list_display_categories; create categories with manage_display_categoryRecommendationDescriptions must describe only their own tool.
tool: assign_display_categories
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: list_data_slots
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
pagination."},"access_token":{"type":"string","description":"Optional beareRecommendationRemove side-channel parameters; constrain tool inputs.
tool: list_data_slots
A tool description tries to alter the model’s use of another tool.
in display HTML fetch() calls. Requires authentication.RecommendationDescriptions must describe only their own tool.
tool: list_data_slots
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: set_display_grant
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ction 'set'."},"access_token":{"type":"string","description":"Optional beareRecommendationRemove side-channel parameters; constrain tool inputs.
tool: set_display_grant
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: authenticate
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
tes a JWT agent token and caches the identity on this MCP session soRecommendationRemove side-channel parameters; constrain tool inputs.
tool: authenticate
A tool description tries to alter the model’s use of another tool.
-based auth via create_auth_session. Not needed after get_auth_session returned 'acRecommendationDescriptions must describe only their own tool.
tool: authenticate
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: create_api_key
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
create_api_key Create API Key Creates a long-lived API key forRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_api_key
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
lots), 'display.read' (list/get displays, read content), 'display.send' (send_html/send_url/broadcast/RecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: create_api_key
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_data_slot
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
sonal slots."},"access_token":{"type":"string","description":"Optional beareRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_data_slot
A tool description tries to alter the model’s use of another tool.
display HTML to fetch. Requires authentication.RecommendationDescriptions must describe only their own tool.
tool: get_data_slot
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_storage_usage
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
Narrowly-scoped API keys get suppressed=true with zeroed numbers. RequirRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_storage_usage
A tool description tries to alter the model’s use of another tool.
(do this before delete_data_slot to know which displays would break). Narrowly-sRecommendationDescriptions must describe only their own tool.
tool: get_storage_usage
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: broadcast_content
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
indefinite."},"access_token":{"type":"string","description":"Optional beareRecommendationRemove side-channel parameters; constrain tool inputs.
tool: broadcast_content
A tool description tries to alter the model’s use of another tool.
gle display use send_html. Requires content scope.RecommendationDescriptions must describe only their own tool.
tool: broadcast_content
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: manage_licenses
A tool description tries to alter the model’s use of another tool.
lity first with get_license_info. Requires admin scope.RecommendationDescriptions must describe only their own tool.
tool: manage_licenses
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_display
A tool description tries to alter the model’s use of another tool.
he display. Use list_displays first to discover IDs. Requires content scope.RecommendationDescriptions must describe only their own tool.
tool: get_display
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: create_auth_session
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
EP 0 in a fresh conversation before any protected tool. Show the loginUrl toRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_auth_session
A tool description tries to alter the model’s use of another tool.
uage, then poll get_auth_session until 'active' and pass session_request_id on eRecommendationDescriptions must describe only their own tool.
tool: create_auth_session
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
sh conversation before any protected tool. Show the loginUrl to the user as a clickable lRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: list_store_categories
A tool description tries to alter the model’s use of another tool.
ow a subsequent search_store_templates call when the user asks for 'templates for a waRecommendationDescriptions must describe only their own tool.
tool: send_store_template_to_display
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ser request."},"access_token":{"type":"string","description":"Optional beareRecommendationRemove side-channel parameters; constrain tool inputs.
tool: send_store_template_to_display
A tool description tries to alter the model’s use of another tool.
n seconds. Call get_store_template_install_options first for valid targets and slots; customize peRecommendationDescriptions must describe only their own tool.
tool: send_store_template_to_display
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: create_display
A tool description tries to alter the model’s use of another tool.
n ALWAYS prefer pair_by_code, which creates and pairs in one step; use creatRecommendationDescriptions must describe only their own tool.
tool: create_display
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: delete_data_slot
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_license_info
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_organization
A tool description tries to alter the model’s use of another tool.
list. Use after list_organizations. Requires content scope and membership.RecommendationDescriptions must describe only their own tool.
tool: get_organization
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: remove_display_from_org
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: set_data_slot
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: submit_feedback
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
t if unsure."},"access_token":{"type":"string","description":"Optional beareRecommendationRemove side-channel parameters; constrain tool inputs.
tool: submit_feedback
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: upload_asset
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
assets with."},"access_token":{"type":"string","description":"Optional beareRecommendationRemove side-channel parameters; constrain tool inputs.
tool: upload_asset
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: configure_display
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: configure_display
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: search_public_apis
A tool description tries to alter the model’s use of another tool.
lts. Returns docs links, CORS status and fetch() hints. No authenticationRecommendationDescriptions must describe only their own tool.
tool: claim_display
A tool description tries to alter the model’s use of another tool.
me setup prefer pair_by_code. Requires admin scope.RecommendationDescriptions must describe only their own tool.
tool: claim_display
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: send_url
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ecommended)."},"access_token":{"type":"string","description":"Optional beareRecommendationRemove side-channel parameters; constrain tool inputs.
tool: send_url
A tool description tries to alter the model’s use of another tool.
HTTP(S). Check get_display (response_format 'detailed') first when unsureRecommendationDescriptions must describe only their own tool.
tool: send_url
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: clear_display
A tool description tries to alter the model’s use of another tool.
ay itself — use delete_display for that. Requires authentication with at leastRecommendationDescriptions must describe only their own tool.
tool: clear_display
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_account
A tool description tries to alter the model’s use of another tool.
g displays (use list_displays). Requires content scope.RecommendationDescriptions must describe only their own tool.
tool: get_account
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: delete_asset
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_store_template_content
A tool description tries to alter the model’s use of another tool.
y directly, use send_store_template_to_display instead. No authentication required.RecommendationDescriptions must describe only their own tool.
tool: get_auth_session
A tool description tries to alter the model’s use of another tool.
sion created by create_auth_session until the user completes the browser login. PolRecommendationDescriptions must describe only their own tool.
tool: send_html
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
e slot only."},"token":{"type":"string","description":"Display-specifRecommendationRemove side-channel parameters; constrain tool inputs.
tool: send_html
A tool description tries to alter the model’s use of another tool.
l web pages use send_url; to edit current content call read_display_htmlRecommendationDescriptions must describe only their own tool.
tool: send_html
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: delete_display
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: search_store_templates
A tool description tries to alter the model’s use of another tool.
ults render as a gallery widget. Filter by category, suite and language; pRecommendationDescriptions must describe only their own tool.
tool: search
A tool description tries to alter the model’s use of another tool.
ets to read via fetch. Unauthenticated searches cover public docs onlRecommendationDescriptions must describe only their own tool.
tool: pair_by_code
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_store_template_details
A tool description tries to alter the model’s use of another tool.
fig). Use after search_store_templates before recommending or installing; when agentArRecommendationDescriptions must describe only their own tool.
tool: list_displays
A tool description tries to alter the model’s use of another tool.
play IDs before get_display, send_html or send_store_template_to_display. PRecommendationDescriptions must describe only their own tool.
tool: list_displays
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: list_assets
A tool description tries to alter the model’s use of another tool.
p. Check before upload_asset to avoid duplicates. response_format 'detailed'RecommendationDescriptions must describe only their own tool.
tool: list_assets
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_agent_artifact
A tool description tries to alter the model’s use of another tool.
scover keys via get_store_template_details (agentArtifacts array). Template mode needs noRecommendationDescriptions must describe only their own tool.
tool: get_agent_artifact
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: configure_organization
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: list_api_keys
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: read_display_html
A tool description tries to alter the model’s use of another tool.
sh it back with send_html. content_type 'idle' reads the default/fallbackRecommendationDescriptions must describe only their own tool.
tool: read_display_html
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: list_organizations
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: revoke_api_key
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_display_preview_url
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
preview widget. ALWAYS call this when the user wants to SEE their display or scrRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: get_display_preview_url
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: delete_organization
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: list_display_categories
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: update_asset
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: create_organization
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_asset
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: fetch
A tool description tries to alter the model’s use of another tool.
1234. Use after search or with a known URI. Public URIs need no auth;RecommendationDescriptions must describe only their own tool.
tool: manage_display_category
A tool description tries to alter the model’s use of another tool.
n displays with assign_display_categories.RecommendationDescriptions must describe only their own tool.
tool: manage_display_category
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: test_display_content
A tool description tries to alter the model’s use of another tool.
re send_html or broadcast_content. No display_id needed; the response carries simRecommendationDescriptions must describe only their own tool.
tool: test_display_content
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_store_template_install_options
A tool description tries to alter the model’s use of another tool.
d). Call before send_store_template_to_display. An empty displays list means the user must firRecommendationDescriptions must describe only their own tool.
tool: get_store_template_install_options
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: manage_org_member
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "access_token"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: (server instructions)
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
st_id from THIS conversation: 1) create_auth_session → 2) show the loginUrlRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
t_auth_session, authenticate. AUTH RECOVERY: error 'invalid_token' (token dRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: assign_display_categories
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: set_display_grant
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: broadcast_content
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: manage_licenses
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: send_store_template_to_display
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_data_slot
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: remove_display_from_org
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: set_data_slot
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: configure_display
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: send_url
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: clear_display
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_asset
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: send_html
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_display
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: pair_by_code
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: pair_by_code
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
r code shown on https://display.agentview.de — the recommended first-time setup: ask the useRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: configure_organization
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: revoke_api_key
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_organization
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: update_asset
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: manage_display_category
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: manage_org_member
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: (server instructions)
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
een: user opens https://display.agentview.de on the TV, reads the 6-char code → pair_by_codeRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
The server exposes one or more ui:// (MCP Apps) resources whose HTML/JS renders inside the host client — a client-side injection / data-exposure surface most scanners ignore. Flagged for review, not damning on its own.
6 ui:// resource(s); e.g. ui://agentview/store-galleryRecommendationReview each ui:// resource’s markup and scripts; treat host-rendered UI as untrusted, sandbox it, and never expose secrets or conversation context to it.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Grants or revokes a member's access to one display inside an organization. action 'set' (default) creates/updates the grant with access_level 'view' (see status) or 'control' (send content); action 'r
Validates a JWT agent token and caches the identity on this MCP session so later calls work without resending it. Use only when your client cannot send an Authorization: Bearer header; prefer session_
Creates a long-lived API key for server-to-server integration without OAuth. The raw key is returned only once — store it securely. The user must explicitly consent to creating the key. Requires admin
Returns the current JSON content and metadata of a data slot by slug. Supply group_id to look up a group slot; omit it for personal slots. The response includes readUrl — the public anonymous URL for
Returns the storage pool snapshot (used, limit and remaining bytes) for the personal scope or a group — data slots and uploaded assets share this quota; check before large set_data_slot or upload_asse
Sends HTML to many displays at once. Target explicit display_ids, all=true for every accessible display, or include_category_ids to reach every display in those categories (include_descendants for sub
Manages premium display licenses: action 'allocate' sets how many license slots an organization gets (licenses, 0 deallocates all), 'assign' binds a free license to a display, 'unassign' releases a di
Returns the server's public readiness status, version string and discovery URLs. Use this before authenticating to verify the server is reachable and to obtain entry-point URLs. No authentication requ
Returns one display's state: status, lock, URLs, settings, language and current content summary. response_format 'detailed' adds browser/runtime facts (screen, viewport, engine), resolved connectivity
Starts a browser login and returns a loginUrl plus sessionRequestId. Use as STEP 0 in a fresh conversation before any protected tool. Show the loginUrl to the user as a clickable link in their languag
Lists all published agentView store categories (e.g. Gastronomie, Wartezimmer, Empfang, Smart Home) with localized titles, descriptions and template counts. Use this to narrow a subsequent search_stor
Installs a published store template onto a display: materializes the HTML, auto-creates required data slots (reusing prior installs) and publishes within seconds. Call get_store_template_install_optio
Pre-provisions a display without hardware, personal or inside an organization (org_id). The new display starts offline. For a physical screen ALWAYS prefer pair_by_code, which creates and pairs in one
Permanently deletes a data slot. Display HTML fetching its readUrl will receive 404 after deletion. Cannot be undone. Supply group_id to delete a group slot; omit for personal slots. Requires authenti
Returns the authenticated user's complete license allocation overview: total premium licenses, personal usage, allocatable licenses, per-organization allocations, and free licenses. Use this to unders
Returns one organization's details: plan, your role, display count, allocated and remaining license slots. response_format 'detailed' adds the full member list (with roles) and display list. Use after
Removes a display from an organization, clearing its group assignment and all display grants. The display becomes unassigned. Requires admin scope and admin or owner role.
Creates or updates a mutable JSON data slot (max 2 MB) that display HTML fetches via its readUrl — the live-data backbone for store templates. The slug is stable; reusing it updates in place. type 'va
Sends the user's feedback, feature request or bug report about agentView itself (not display content) for later review. Confirm the exact wording with the user before sending; optional sentiment. Ther
Upload one or more files (images, fonts, CSS, video, etc.) as assets and receive stable URLs. Use these URLs in your HTML with <img src> or @font-face. Assets are cached on displays. Pass files as bas
Updates display settings: rename (name), lock or unlock content changes (locked), privacy mode for share links (privacy_mode), embed-origin allowlist (origins), hardware permissions (camera, microphon
Searches a curated catalog of 600+ free public APIs (no key, HTTPS) for embedding live data in display HTML via fetch(): weather, news, finance, sports, images, food and 40+ more categories. Use when
Adopts an unclaimed guest or pending display as a managed personal display (permanent ownership transfer, counts against quota). Use only when the user explicitly wants to take over hardware that is a
Shows an external web page on a display via full-page iframe: dashboards, websites or web apps. slot 'live' (default) replaces current content; slot 'idle' stores it as default/fallback content (admin
Removes the current live content from a display and returns it to its idle/default state. Viewers will immediately see the change. Use this when the user wants to blank or reset a display. This does n
Returns the user's account profile: plan and features, personal display limits and remaining quota, accessible display count, organization memberships and points balance. Use for subscription, quota a
Deletes one or more assets. Displays referencing deleted assets will show broken images. Requires authentication with at least content_only scope.
Returns the raw display HTML of a published store template plus its slot definitions and allowed external origins, for editing or embedding the template yourself. {{asset:NAME}} placeholders resolve t
Polls a login session created by create_auth_session until the user completes the browser login. Poll every 2-3 seconds while status is 'pending'. Status 'active' auto-authenticates this MCP session —
Shows HTML content on a display: menus, dashboards, welcome pages, schedules or any custom design. slot 'live' (default) replaces the current content; slot 'idle' stores the default/fallback content s
Permanently deletes a display and all its associated content. This action cannot be undone. Use this only when the user explicitly confirms they want to remove the display. Requires admin scope. Retur
Clears the cached login from this MCP session (does not revoke the underlying token). Use when the user wants to sign out or switch accounts.
Searches the agentView template store for ready-made display designs ('Zahnarzt-Wartezimmer', 'Bistro', 'reception', ...). Use when the user wants a polished pre-built design instead of generated HTML
Searches agentView resources by keyword: documentation, server status, your account, your displays and the API catalog. Returns ranked resource URIs with snippets to read via fetch. Unauthenticated se
Pairs a physical screen with the 6-character code shown on https://display.agentview.de — the recommended first-time setup: ask the user to open that URL on the TV and read the code, then call this (c
Returns full details of one store template: localized title and description, long-form markdown, category, suite, tags, features, preview image and agentArtifacts (bot-onboarding files such as system
Lists all displays the user can access, with id, name, online status, lock state and device class — the starting point to discover display IDs before get_display, send_html or send_store_template_to_d
Lists the user's uploaded assets (images, videos, fonts, documents) with public URLs for use in display HTML. Filter by type, search term or group. Check before upload_asset to avoid duplicates. respo
Returns an agent-onboarding artifact shipped with a store template: system prompt, Agent Skills SKILL.md or MCP-config snippet. Pass slug for the RAW template artifact (before install, {{slot:...}} pl
Updates organization settings: rename (name) and/or network connectivity defaults for all its displays (default_connectivity_mode, global_whitelist). Only provided fields change. Use when an org admin
Lists all API keys for the current user. Returns key metadata (prefix, name, scope, dates) but never the raw key. Requires admin scope.
Reads the raw HTML source currently shown on a display so you can inspect or edit it and push it back with send_html. content_type 'idle' reads the default/fallback content instead. Responses are wind
Returns all organizations the authenticated user belongs to with their role, display count, member count and allocated slots. Use this to answer questions about the user's organizations, how many disp
Permanently revokes an API key. This is irreversible — the key will immediately stop working. Requires admin scope.
Creates a short-lived signed link showing what a display is presenting RIGHT NOW, rendered inline as a preview widget. ALWAYS call this when the user wants to SEE their display or screen content (prev
Permanently deletes an organization, releasing all its displays and removing all members. Only the owner can delete. This cannot be undone. Requires admin scope.
Lists the authenticated user's personal display categories with stable IDs, paths and assignment counts. Use this to discover existing categories before assigning or replacing categories on a display.
Updates the name and/or description of an existing asset. The URL does not change. At least one of name or description must be provided. Requires authentication with at least content_only scope.
Creates a new organization and makes the authenticated user the owner. Use this when the user wants to set up a shared display fleet. Returns orgId, name, slug, type and yourRole. Requires admin scope
Returns metadata for a single asset including its URL. Use this to verify an asset still exists before referencing it in HTML. Requires authentication with at least content_only scope.
Fetches one agentView resource by agentview:// URI, e.g. agentview://public/status, agentview://account/me or agentview://display/ABCD1234. Use after search or with a known URI. Public URIs need no au
Creates or renames a display category (categories group displays for broadcast_content include_category_ids). action 'create' needs name (optional parent_category_id for a subcategory); action 'rename
Dry-run validator for generated HTML: runs agentView's size and description checks WITHOUT touching a real display. Use after composing complex HTML and before send_html or broadcast_content. No displ
Returns the displays the user can install a store template on plus the data slots it needs (key, label, type, required). Call before send_store_template_to_display. An empty displays list means the us
Manages organization membership: action 'invite' adds a member by email with a role, 'set_role' changes a member's role, 'remove' removes the member. Roles for organizations: 'admin' (manage members a