Loading…
Domain registration and DNS management for AI agents via Stripe and crypto payments.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 28 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The instadomain MCP server exposes 12 tools, focused primarily on general-purpose capabilities. Its published description reads: "Domain registration and DNS management for AI agents via Stripe and crypto payments". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates instadomain F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Hidden instructions in a tool description". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check instadomain's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add instadomain to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://instadomain.fly.dev/mcp/Streamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Check if a domain is available for purchase and get its price. Always call this before buying. After showing the price, ask the user two things before proceeding: 1. Confirm they want to purchase at t
Check availability of up to 50 domain names in one call. Uses fast RDAP lookups (no pricing). Returns a summary with total/available/taken counts plus per-domain details. Args: domains: List of domain
Generate domain name ideas from a keyword and check their availability. Args: keyword: A keyword or short business name (e.g. "taskflow").
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: buy_domain
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
ling this tool, you MUST first call check_domain to get the price, then clearlRecommendationRemove model-directed instructions from tool descriptions.
tool: buy_domain_crypto
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
ling this tool, you MUST first call check_domain to get the price and confirmRecommendationRemove model-directed instructions from tool descriptions.
tool: check_domain
A tool description tries to alter the model’s use of another tool.
"Stripe" → call buy_domain (opens Stripe checkout in browser) - "cryptoRecommendationDescriptions must describe only their own tool.
tool: check_domain
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
get its price. Always call this before buying. After showing the price, ask the user tRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: get_domain_status
A tool description tries to alter the model’s use of another tool.
D returned from buy_domain (e.g. "ord_abc123").RecommendationDescriptions must describe only their own tool.
tool: request_transfer_code
A tool description tries to alter the model’s use of another tool.
code, then call verify_transfer_code to get a transfer_token. Args: order_id: TRecommendationDescriptions must describe only their own tool.
tool: request_transfer_code
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
trant's email. Always call this before get_transfer_code or unlock_domain. Then ask thRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: verify_transfer_code
A tool description tries to alter the model’s use of another tool.
Call this after request_transfer_code and the user provides their code. Pass the retuRecommendationDescriptions must describe only their own tool.
tool: get_transfer_code
A tool description tries to alter the model’s use of another tool.
sfer_token from verify_transfer_code. Args: order_id: The order ID of a completRecommendationDescriptions must describe only their own tool.
tool: unlock_domain
A tool description tries to alter the model’s use of another tool.
sfer_token from verify_transfer_code. Args: order_id: The order ID of a completRecommendationDescriptions must describe only their own tool.
tool: buy_domain
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
by running the shell command `open "<checkout_url>"` (macOS/Linux) sRecommendationAnnotate destructive tools and require human approval.
tool: buy_domain
A tool description tries to alter the model’s use of another tool.
MUST first call check_domain to get the price, then clearly show the user thRecommendationDescriptions must describe only their own tool.
tool: buy_domain
An exec/shell/run-code tool exposes a command/code/args parameter that is a free-form string with no enum/pattern guard — a direct command-injection / RCE surface. A tool constraining the command to an `enum` of allowed operations does not fire.
unconstrained command parameter "postal_code"RecommendationReplace the free-form command with a fixed `enum` of allowed operations (or structured, escaped arguments) and require explicit human approval.
tool: buy_domain_crypto
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
Otherwise: run `curl -L <pay_url>` — your x402-enabled HTTP client wRecommendationAnnotate destructive tools and require human approval.
tool: buy_domain_crypto
A tool description tries to alter the model’s use of another tool.
MUST first call check_domain to get the price and confirm it with the user.RecommendationDescriptions must describe only their own tool.
tool: buy_domain_mpp
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
ay_url. Step 2: Make an HTTP GET request to the pay_url with an MPP-enabled HTTP client.RecommendationAnnotate destructive tools and require human approval.
tool: buy_domain_mpp
A tool description tries to alter the model’s use of another tool.
r payment, call get_domain_status(order_id) to poll until complete. Requires: AnRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: unlock_domain
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "unlock_domain"RecommendationScope tools to the minimum needed.
tool: renew_domain
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "renew_domain"RecommendationScope tools to the minimum needed.
tool: buy_domain
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "buy_domain"RecommendationScope tools to the minimum needed.
tool: buy_domain_mpp
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "buy_domain_mpp"RecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Get the status of a domain purchase order. Polls the backend every 3 seconds (up to 120 seconds) until the order reaches a terminal state (complete or failed). Args: order_id: The order ID returned fr
Start the transfer verification flow by sending a code to the registrant's email. Always call this before get_transfer_code or unlock_domain. Then ask the user to check their email and provide the 6-d
Verify the email code and get a transfer token valid for 15 minutes. Call this after request_transfer_code and the user provides their code. Pass the returned transfer_token to get_transfer_code or un
Get the EPP/transfer authorization code for a completed domain purchase. Requires a transfer_token from verify_transfer_code. Args: order_id: The order ID of a completed domain purchase. transfer_toke
Remove the registrar transfer lock. Requires a transfer_token from verify_transfer_code. Args: order_id: The order ID of a completed domain purchase. transfer_token: Token returned by verify_transfer_
Renew a domain for 1 additional year. Creates a Stripe checkout session for the renewal payment. Args: order_id: The order ID of a completed domain purchase (e.g. "ord_abc123").
Start the purchase flow for an available domain via Stripe checkout. IMPORTANT: Before calling this tool, you MUST first call check_domain to get the price, then clearly show the user the price and ge
Start the purchase flow for a domain using USDC crypto payment (x402 protocol). Autonomous two-step payment flow — no browser required: Step 1: Call this tool to reserve the domain and get a pay_url.
Start the purchase flow for a domain via Stripe's Machine Payments Protocol (MPP). MPP lets autonomous agents pay with fiat (cards, Link) or stablecoins via Shared Payment Tokens, with no browser chec