Loading…
Secure file transfer MCP server that relays files between AI agents and downstream services using bearer-token authentication.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 25 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The stagenth-file-relay MCP server exposes 25 tools, focused primarily on filesystem and web capabilities. Its published description reads: "Secure file transfer MCP server that relays files between AI agents and downstream services using bearer-token authentication". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates stagenth-file-relay F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check stagenth-file-relay's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add stagenth-file-relay to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://stagenth.com/mcp/file-relay/Streamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
查看当前用户的存储配额使用情况。
列出当前用户的文件 (默认递归遍历整个文件夹层级). 返回值同时附带 ``subfolders``(直接子文件夹列表) 与 ``has_subfolders`` 提示, 帮助 AI 感知层级结构。若用户问“目录结构 / 树”, 直接调 ``get_folder_tree`` 拿到 ASCII 树状图更直观。 每个 item 都有 ``folder_path`` 字段标注它的实际归属, 同名文件不会
在当前用户的所有文件中搜索。
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: list_files
A tool description tries to alter the model’s use of another tool.
, 直接调 ``get_folder_tree`` 拿到 ASCII 树状图更直观。 每个 item 都有 ``folderRecommendationDescriptions must describe only their own tool.
tool: upload_init
A tool description tries to alter the model’s use of another tool.
逐片调 upload_chunk, 最后调 upload_complete。RecommendationDescriptions must describe only their own tool.
tool: download_file
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
AI 用 bash curl 拉字节, 或提示用户点链接在浏览器下载) 【限速】所有分支都遵守会RecommendationAnnotate destructive tools and require human approval.
tool: create_share_link
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: download_shared_file
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: import_shared_file
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: list_folders
A tool description tries to alter the model’s use of another tool.
not_found。要列文件用 list_files。RecommendationDescriptions must describe only their own tool.
tool: delete_folders
A tool description tries to alter the model’s use of another tool.
批量删除文件夹 (delete_folder 的批量版)。 逐个删除, 单个失败不影响其余; 返回每个路径的结果。RecommendationDescriptions must describe only their own tool.
tool: scrape_url
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: file_read
A tool description tries to alter the model’s use of another tool.
压缩包/Office 等）请用 download_file；超长文本按 max_bytes 截断并标记。RecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: upload_file
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
","title":"Auto Create Folders","type":"boolean"}},"required":["filename","conRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Scrapes web pages to clean Markdown with JS rendering, multi-page crawl, structured extraction, and sitemap support.
14 PDF tools: merge, split, compress, watermark, encrypt, organize, metadata, and page extraction.
QR and barcode toolkit: generate, decode, vector SVG, logo QR, WiFi and vCard QR codes.
Turn Excel or CSV data into charts (bar, line, pie, scatter, radar) and get a download URL.
Image toolkit: resize, compress, crop, watermark, convert, rotate, and EXIF read/strip.
Hosted persistent memory with semantic search, importance scoring, and TTL for AI agents.
查询单个文件详情。file_id 与 file_uuid 提供其一即可。
删除一个文件。
批量删除文件（移入回收站，30 天内可在网页端恢复）。 逐个删除，单个失败不影响其余；返回每个 ID 的结果。
上传一个文件（base64 形式）到用户的文件中转站。 仅在用户明确要求把某个文件存入中转站 / 传输到其他设备 / 分享给他人时调用。 上传会占用用户的付费存储配额并按传输量扣 credit —— 不要主动上传 中间结果、日志、临时文件或用户没有要求保存的命令输出。 用 init + 单次分片 + complete 的方式复用现有服务。 适合中小文件（< 20MB）。超大文件请使用 Web 端分
发起分片上传会话 (第 1 步 / 共 3 步)。 返回: - instant=true 时, file 字段是已秒传的文件元数据, 直接用即可 - instant=false 时, 用 session_uuid + 服务端给的 chunk_size/total_chunks 逐片调 upload_chunk, 最后调 upload_complete。
上传单个分片 (第 2 步 / 共 3 步)。 可并发调用, 后端内部会记录已上传索引。网络抖动重试同一 chunk_index 安全 (服务端幂等写临时块)。
合并所有分片 (第 3 步 / 共 3 步)。 两种路径: - 直传 (推荐, shim 走这条): parts 带齐所有 (part_number, etag), 后端调 OSS CompleteMultipartUpload 服务端合并, 不耗 ECS 内存/带宽。 - 中转 (兼容老 shim / 网页端): 不传 parts, 从临时分片合并。 返回最终 file 元数据 (id, uui
下载一个文件, 按 MCP spec 2025-06-18 的原生 content 类型返回。 根据文件 category 自动选择最合适的 MCP content block 类型: - image (jpg/png/webp/...) → content[0].type = "image" (base64 + mimeType; AI 客户端原生显示图片, 多模态 LLM 可直接看图) - a
为文件生成一个分享链接。
通过分享链接下载文件（无需是文件拥有者）。 适合别人发给你一个 /s/<uuid> 链接,你想让 AI 直接读取其内容的场景。 不会占用你的存储配额。下载计入分享者的月流量。
把别人分享的文件导入到当前登录用户的文件列表。 等价于「下载后再上传」,但服务端直接从源文件拷贝字节流、仍走配额/白名单/秒传检查, 所以比本地往返更快、也不消耗带宽。 下载量计入分享者的月流量;存储占用计入当前用户的配额。
列出文件夹 (类似 ``ls -d`` 只看目录)。 路径不存在抛 folder_not_found。要列文件用 list_files。
创建文件夹 (类似 ``mkdir -p``)。 幂等: 如果路径已经存在, 直接返回该文件夹元数据, 不抛错。
把文件挪到指定文件夹 (类似 ``mv file /target/dir/``)。 OSS 字节不动, 只改逻辑路径, 操作几毫秒完成。
移动整个文件夹 (类似 ``mv /工作/项目A /归档/``)。 会递归更新所有后代的逻辑路径。OSS 字节不动。
改名 (不动 parent)。
删除文件夹 (类似 ``rmdir`` 或 ``rm -r``)。 内部 ready/locked 文件按"软删进回收站"处理, 30 天后才物删 OSS 字节; 用户可在该窗口期内通过回收站恢复。
批量删除文件夹 (delete_folder 的批量版)。 逐个删除, 单个失败不影响其余; 返回每个路径的结果。 文件按软删进回收站处理, 30 天内可在网页端恢复。
以 ASCII 树状图返回用户的文件夹/文件层级 (推荐: 用户问“目录结构”时用这个). 返回: { "root_path": "/", "tree": "ASCII 字符串", "stats": {"folders": N, "files": M, "truncated": bool} }
抓取一个公开网页，返回干净的 Markdown（供 AI 阅读/总结/提取）。 只抓公开网页，禁止内网/保留地址；不生成任何内容，只做抓取与格式转换。
直接返回文本类文件的内容（txt/md/csv/json/日志/代码等），AI 免下载即读。 二进制文件（图片/压缩包/Office 等）请用 download_file；超长文本按 max_bytes 截断并标记。
把多个文件打包成一个 ZIP，存入文件中转站并返 15 分钟下载 URL。 单包上限 50 个文件 / 200MB 原始体积；同名文件自动加序号。