{
  "query": "",
  "kind": "mcp",
  "page": 1,
  "pages": 3,
  "pageSize": 24,
  "total": 66,
  "results": [
    {
      "kind": "mcp",
      "slug": "blender-mcp",
      "name": "Blender MCP",
      "vendor": "Blender community",
      "description": "An MCP server that connects an agent to Blender's Python API, letting a model create and modify 3D scenes, run geometry operations, and render — driving a desktop application through scripted commands.\n\nThe capability that matters is that Blender's Python API is general-purpose Python. A server exposing it is effectively exposing code execution on the host, which is why this entry declares shell execution alongside filesystem access and outbound network — a combination Anomity flags as full control. That is not a criticism of the project, it is the honest shape of scripting-API bridges generally. Run it in a sandbox or a container, not on the workstation holding your signing keys.",
      "website": "https://github.com/ahujasid/blender-mcp",
      "repository": "https://github.com/ahujasid/blender-mcp",
      "documentationUrl": null,
      "license": null,
      "version": null,
      "trustLevel": "community",
      "capabilities": [
        "shell:execute",
        "filesystem:read",
        "filesystem:write",
        "network:outbound"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 100,
        "band": "critical",
        "signals": [
          {
            "id": "trust-community",
            "kind": "trust",
            "label": "Established community project",
            "contribution": -10
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "2 high-risk capabilities: shell:execute, filesystem:write",
            "contribution": 20
          },
          {
            "id": "exfiltration-risk",
            "kind": "combination",
            "label": "Data exfiltration risk (high)",
            "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.",
            "contribution": 15
          },
          {
            "id": "filesystem-write-shell-risk",
            "kind": "combination",
            "label": "Persistence + execution risk (medium)",
            "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).",
            "contribution": 5
          },
          {
            "id": "full-control-risk",
            "kind": "combination",
            "label": "Full-control risk (critical)",
            "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.",
            "contribution": 25
          }
        ],
        "dangerousCombos": [
          {
            "id": "exfiltration-risk",
            "name": "Data exfiltration risk",
            "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.",
            "capabilities": [
              "shell:execute",
              "network:outbound"
            ],
            "severity": "high"
          },
          {
            "id": "filesystem-write-shell-risk",
            "name": "Persistence + execution risk",
            "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).",
            "capabilities": [
              "shell:execute",
              "filesystem:write"
            ],
            "severity": "medium"
          },
          {
            "id": "full-control-risk",
            "name": "Full-control risk",
            "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.",
            "capabilities": [
              "shell:execute",
              "filesystem:write",
              "network:outbound"
            ],
            "severity": "critical"
          }
        ]
      },
      "dangerousCombos": [
        {
          "id": "exfiltration-risk",
          "name": "Data exfiltration risk",
          "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.",
          "capabilities": [
            "shell:execute",
            "network:outbound"
          ],
          "severity": "high"
        },
        {
          "id": "filesystem-write-shell-risk",
          "name": "Persistence + execution risk",
          "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).",
          "capabilities": [
            "shell:execute",
            "filesystem:write"
          ],
          "severity": "medium"
        },
        {
          "id": "full-control-risk",
          "name": "Full-control risk",
          "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.",
          "capabilities": [
            "shell:execute",
            "filesystem:write",
            "network:outbound"
          ],
          "severity": "critical"
        }
      ]
    },
    {
      "kind": "mcp",
      "slug": "airtable-mcp-server",
      "name": "Airtable MCP Server",
      "vendor": "Airtable",
      "description": "Airtable's official server exposes bases, tables, and records so an agent can query structured operational data and create or update rows.\n\nDeclared capabilities are outbound network access, credential access, and database reads and writes over the base contents. Airtable's role in most organisations — the place a team put the thing that was too important for a spreadsheet and too small for a database — means bases often hold operational data with no schema review and no access review behind them. Scope a token to a single base, and prefer read access unless a workflow genuinely needs to write.",
      "website": "https://airtable.com/developers/web/api/introduction",
      "repository": null,
      "documentationUrl": "https://airtable.com/developers/web/api/introduction",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access",
        "database:read",
        "database:write"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 45,
        "band": "medium",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "2 high-risk capabilities: credentials:access, database:write",
            "contribution": 20
          },
          {
            "id": "database-exfiltration-risk",
            "kind": "combination",
            "label": "Database exfiltration risk (high)",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "contribution": 15
          }
        ],
        "dangerousCombos": [
          {
            "id": "database-exfiltration-risk",
            "name": "Database exfiltration risk",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "capabilities": [
              "database:read",
              "network:outbound"
            ],
            "severity": "high"
          }
        ]
      },
      "dangerousCombos": [
        {
          "id": "database-exfiltration-risk",
          "name": "Database exfiltration risk",
          "description": "Database read combined with outbound network can exfiltrate production data.",
          "capabilities": [
            "database:read",
            "network:outbound"
          ],
          "severity": "high"
        }
      ]
    },
    {
      "kind": "mcp",
      "slug": "cloudflare-mcp-server",
      "name": "Cloudflare MCP Server",
      "vendor": "Cloudflare",
      "description": "Cloudflare ships a family of remote MCP servers covering Workers, KV, R2, D1, DNS, Workers Logs, and account APIs. An agent can read observability data, query a D1 database, inspect DNS records, or deploy a Worker, depending on which server and scopes are connected.\n\nThis is infrastructure control, so the risk is proportional to the API token behind it rather than to the protocol. The declared capabilities are outbound network access, credential access, and database reads and writes for the D1 surface. A token that can edit DNS or deploy Workers can redirect or intercept production traffic — treat connecting this server as granting an agent a seat on your infrastructure, and prefer read-scoped tokens for anything an assistant uses interactively.",
      "website": "https://developers.cloudflare.com/agents/model-context-protocol/",
      "repository": null,
      "documentationUrl": "https://developers.cloudflare.com/agents/model-context-protocol/",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access",
        "database:read",
        "database:write"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 45,
        "band": "medium",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "2 high-risk capabilities: credentials:access, database:write",
            "contribution": 20
          },
          {
            "id": "database-exfiltration-risk",
            "kind": "combination",
            "label": "Database exfiltration risk (high)",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "contribution": 15
          }
        ],
        "dangerousCombos": [
          {
            "id": "database-exfiltration-risk",
            "name": "Database exfiltration risk",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "capabilities": [
              "database:read",
              "network:outbound"
            ],
            "severity": "high"
          }
        ]
      },
      "dangerousCombos": [
        {
          "id": "database-exfiltration-risk",
          "name": "Database exfiltration risk",
          "description": "Database read combined with outbound network can exfiltrate production data.",
          "capabilities": [
            "database:read",
            "network:outbound"
          ],
          "severity": "high"
        }
      ]
    },
    {
      "kind": "mcp",
      "slug": "elevenlabs-mcp-server",
      "name": "ElevenLabs MCP Server",
      "vendor": "ElevenLabs",
      "description": "ElevenLabs' official server exposes text-to-speech, voice cloning, and audio processing to agents, letting an assistant generate narration or transform audio as part of a larger workflow.\n\nDeclared capabilities are outbound network access, credential access for the API key, and filesystem writes for the audio files it produces. The distinctive risk is not technical but content-shaped: voice cloning under agent control means a model can be asked to synthesise a specific person's voice as a side effect of some larger task. Whatever policy your organisation has about synthetic voice should be enforced at the key, because the agent will not apply it on its own.",
      "website": "https://elevenlabs.io/docs/api-reference/mcp",
      "repository": null,
      "documentationUrl": "https://elevenlabs.io/docs/api-reference/mcp",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access",
        "filesystem:write"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 45,
        "band": "medium",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "2 high-risk capabilities: credentials:access, filesystem:write",
            "contribution": 20
          },
          {
            "id": "credential-theft-risk",
            "kind": "combination",
            "label": "Credential theft risk (high)",
            "description": "Filesystem write combined with credentials access can plant persistent credential stealers.",
            "contribution": 15
          }
        ],
        "dangerousCombos": [
          {
            "id": "credential-theft-risk",
            "name": "Credential theft risk",
            "description": "Filesystem write combined with credentials access can plant persistent credential stealers.",
            "capabilities": [
              "filesystem:write",
              "credentials:access"
            ],
            "severity": "high"
          }
        ]
      },
      "dangerousCombos": [
        {
          "id": "credential-theft-risk",
          "name": "Credential theft risk",
          "description": "Filesystem write combined with credentials access can plant persistent credential stealers.",
          "capabilities": [
            "filesystem:write",
            "credentials:access"
          ],
          "severity": "high"
        }
      ]
    },
    {
      "kind": "mcp",
      "slug": "minimax-mcp-server",
      "name": "MiniMax MCP Server",
      "vendor": "MiniMax",
      "description": "MiniMax's official server exposes text-to-speech, image generation, and video generation to agents, so a model can produce media assets as part of a workflow rather than describing them.\n\nCapabilities are outbound network access, credential access, and filesystem writes for generated files. The considerations are generation-shaped rather than access-shaped: an agent that can produce synthetic video and audio autonomously is a capability worth governing by policy, and generated files landing on disk should go somewhere predictable rather than wherever the agent chose.",
      "website": "https://www.minimax.io",
      "repository": null,
      "documentationUrl": null,
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access",
        "filesystem:write"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 45,
        "band": "medium",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "2 high-risk capabilities: credentials:access, filesystem:write",
            "contribution": 20
          },
          {
            "id": "credential-theft-risk",
            "kind": "combination",
            "label": "Credential theft risk (high)",
            "description": "Filesystem write combined with credentials access can plant persistent credential stealers.",
            "contribution": 15
          }
        ],
        "dangerousCombos": [
          {
            "id": "credential-theft-risk",
            "name": "Credential theft risk",
            "description": "Filesystem write combined with credentials access can plant persistent credential stealers.",
            "capabilities": [
              "filesystem:write",
              "credentials:access"
            ],
            "severity": "high"
          }
        ]
      },
      "dangerousCombos": [
        {
          "id": "credential-theft-risk",
          "name": "Credential theft risk",
          "description": "Filesystem write combined with credentials access can plant persistent credential stealers.",
          "capabilities": [
            "filesystem:write",
            "credentials:access"
          ],
          "severity": "high"
        }
      ]
    },
    {
      "kind": "mcp",
      "slug": "mongodb-mcp-server",
      "name": "MongoDB MCP Server",
      "vendor": "MongoDB",
      "description": "MongoDB's official server gives agents access to clusters, collections, and documents — running queries and aggregations, inspecting schemas, and managing Atlas resources.\n\nCapabilities are database read and write, outbound network access, and credential access, which includes the database-exfiltration combination. Document databases raise a specific version of the problem: with no fixed schema, an agent exploring collections discovers whatever is stored there, and application databases accumulate fields nobody documented. Use a read-only user scoped to specific collections for assistant work, and keep write access for deliberate, reviewed operations.",
      "website": "https://www.mongodb.com/docs/mcp-server/",
      "repository": null,
      "documentationUrl": "https://www.mongodb.com/docs/mcp-server/",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "database:read",
        "database:write",
        "network:outbound",
        "credentials:access"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 45,
        "band": "medium",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "2 high-risk capabilities: database:write, credentials:access",
            "contribution": 20
          },
          {
            "id": "database-exfiltration-risk",
            "kind": "combination",
            "label": "Database exfiltration risk (high)",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "contribution": 15
          }
        ],
        "dangerousCombos": [
          {
            "id": "database-exfiltration-risk",
            "name": "Database exfiltration risk",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "capabilities": [
              "database:read",
              "network:outbound"
            ],
            "severity": "high"
          }
        ]
      },
      "dangerousCombos": [
        {
          "id": "database-exfiltration-risk",
          "name": "Database exfiltration risk",
          "description": "Database read combined with outbound network can exfiltrate production data.",
          "capabilities": [
            "database:read",
            "network:outbound"
          ],
          "severity": "high"
        }
      ]
    },
    {
      "kind": "mcp",
      "slug": "neon-mcp-server",
      "name": "Neon MCP Server",
      "vendor": "Neon",
      "description": "Neon's official server lets an agent manage serverless Postgres projects — creating branches, running SQL, inspecting schemas, and reading documentation. Database branching makes it unusually well suited to agent work, because an assistant can be given a throwaway branch instead of production.\n\nCapabilities are database read and write, outbound network access, and credential access. That set includes the database-exfiltration combination, so the branching feature is not just convenience, it is the control: give the agent a branch, let it break things, discard it. An assistant connected directly to a production branch has both read access to your data and a network path off the machine.",
      "website": "https://neon.com/docs/ai/neon-mcp-server",
      "repository": null,
      "documentationUrl": "https://neon.com/docs/ai/neon-mcp-server",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "database:read",
        "database:write",
        "network:outbound",
        "credentials:access"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 45,
        "band": "medium",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "2 high-risk capabilities: database:write, credentials:access",
            "contribution": 20
          },
          {
            "id": "database-exfiltration-risk",
            "kind": "combination",
            "label": "Database exfiltration risk (high)",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "contribution": 15
          }
        ],
        "dangerousCombos": [
          {
            "id": "database-exfiltration-risk",
            "name": "Database exfiltration risk",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "capabilities": [
              "database:read",
              "network:outbound"
            ],
            "severity": "high"
          }
        ]
      },
      "dangerousCombos": [
        {
          "id": "database-exfiltration-risk",
          "name": "Database exfiltration risk",
          "description": "Database read combined with outbound network can exfiltrate production data.",
          "capabilities": [
            "database:read",
            "network:outbound"
          ],
          "severity": "high"
        }
      ]
    },
    {
      "kind": "mcp",
      "slug": "postgres",
      "name": "PostgreSQL",
      "vendor": "Anthropic",
      "description": "",
      "website": null,
      "repository": null,
      "documentationUrl": null,
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "database:read",
        "database:write",
        "network:outbound",
        "credentials:access"
      ],
      "packaging": {
        "manager": "npm",
        "packageName": "@modelcontextprotocol/server-postgres",
        "command": "npx"
      },
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02T18:21:41.256Z",
      "risk": {
        "score": 45,
        "band": "medium",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "2 high-risk capabilities: database:write, credentials:access",
            "contribution": 20
          },
          {
            "id": "database-exfiltration-risk",
            "kind": "combination",
            "label": "Database exfiltration risk (high)",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "contribution": 15
          }
        ],
        "dangerousCombos": [
          {
            "id": "database-exfiltration-risk",
            "name": "Database exfiltration risk",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "capabilities": [
              "database:read",
              "network:outbound"
            ],
            "severity": "high"
          }
        ]
      },
      "dangerousCombos": [
        {
          "id": "database-exfiltration-risk",
          "name": "Database exfiltration risk",
          "description": "Database read combined with outbound network can exfiltrate production data.",
          "capabilities": [
            "database:read",
            "network:outbound"
          ],
          "severity": "high"
        }
      ]
    },
    {
      "kind": "mcp",
      "slug": "supabase-mcp-server",
      "name": "Supabase MCP Server",
      "vendor": "Supabase",
      "description": "Supabase's official server, giving an agent access to a project's Postgres database, auth configuration, storage, edge functions, and documentation. It is commonly used to let an assistant write and run queries against a real schema rather than guessing at table names.\n\nDatabase read and write, credential access, and outbound network access is a combination that includes Anomity's database-exfiltration pattern: an agent that can query your tables and also reach the network can move data out in one step, whether deliberately or because a prompt injection told it to. Point it at a development branch by default. If it must touch production, use a role restricted to the tables the assistant genuinely needs and treat every query it writes as code to be reviewed.",
      "website": "https://supabase.com/docs/guides/getting-started/mcp",
      "repository": null,
      "documentationUrl": "https://supabase.com/docs/guides/getting-started/mcp",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "database:read",
        "database:write",
        "network:outbound",
        "credentials:access"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 45,
        "band": "medium",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "2 high-risk capabilities: database:write, credentials:access",
            "contribution": 20
          },
          {
            "id": "database-exfiltration-risk",
            "kind": "combination",
            "label": "Database exfiltration risk (high)",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "contribution": 15
          }
        ],
        "dangerousCombos": [
          {
            "id": "database-exfiltration-risk",
            "name": "Database exfiltration risk",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "capabilities": [
              "database:read",
              "network:outbound"
            ],
            "severity": "high"
          }
        ]
      },
      "dangerousCombos": [
        {
          "id": "database-exfiltration-risk",
          "name": "Database exfiltration risk",
          "description": "Database read combined with outbound network can exfiltrate production data.",
          "capabilities": [
            "database:read",
            "network:outbound"
          ],
          "severity": "high"
        }
      ]
    },
    {
      "kind": "mcp",
      "slug": "mcp-remote",
      "name": "mcp-remote",
      "vendor": "Community",
      "description": "",
      "website": null,
      "repository": null,
      "documentationUrl": null,
      "license": null,
      "version": null,
      "trustLevel": "community",
      "capabilities": [
        "network:outbound"
      ],
      "packaging": {
        "manager": "node",
        "packageName": "mcp-remote",
        "command": "node"
      },
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02T18:21:41.256Z",
      "risk": {
        "score": 40,
        "band": "medium",
        "signals": [
          {
            "id": "trust-community",
            "kind": "trust",
            "label": "Established community project",
            "contribution": -10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    },
    {
      "kind": "mcp",
      "slug": "mcp-remote-npx",
      "name": "mcp-remote (npx)",
      "vendor": "Community",
      "description": "",
      "website": null,
      "repository": null,
      "documentationUrl": null,
      "license": null,
      "version": null,
      "trustLevel": "community",
      "capabilities": [
        "network:outbound"
      ],
      "packaging": {
        "manager": "npm",
        "packageName": "mcp-remote",
        "command": "npx"
      },
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02T18:21:41.256Z",
      "risk": {
        "score": 40,
        "band": "medium",
        "signals": [
          {
            "id": "trust-community",
            "kind": "trust",
            "label": "Established community project",
            "contribution": -10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    },
    {
      "kind": "mcp",
      "slug": "grafana-mcp-server",
      "name": "Grafana MCP Server",
      "vendor": "Grafana Labs",
      "description": "Grafana's official server lets an agent query dashboards, datasources, alert rules, and incidents, so an assistant investigating an outage can pull the actual metrics rather than a screenshot of them.\n\nDeclared capabilities are outbound network access, credential access, and database reads through the connected datasources. That last one is the sharp edge: Grafana is a window onto whatever it is wired to, so the effective reach of this server is the union of every datasource in the organisation, which is usually broader than the person connecting it expects. Scope by folder and datasource, and prefer viewer-level credentials for assistants.",
      "website": "https://grafana.com/docs/grafana/latest/observability-as-code/mcp-server/",
      "repository": null,
      "documentationUrl": "https://grafana.com/docs/grafana/latest/observability-as-code/mcp-server/",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access",
        "database:read"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 35,
        "band": "medium",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "1 high-risk capability: credentials:access",
            "contribution": 10
          },
          {
            "id": "database-exfiltration-risk",
            "kind": "combination",
            "label": "Database exfiltration risk (high)",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "contribution": 15
          }
        ],
        "dangerousCombos": [
          {
            "id": "database-exfiltration-risk",
            "name": "Database exfiltration risk",
            "description": "Database read combined with outbound network can exfiltrate production data.",
            "capabilities": [
              "database:read",
              "network:outbound"
            ],
            "severity": "high"
          }
        ]
      },
      "dangerousCombos": [
        {
          "id": "database-exfiltration-risk",
          "name": "Database exfiltration risk",
          "description": "Database read combined with outbound network can exfiltrate production data.",
          "capabilities": [
            "database:read",
            "network:outbound"
          ],
          "severity": "high"
        }
      ]
    },
    {
      "kind": "mcp",
      "slug": "ahrefs-mcp-server",
      "name": "Ahrefs MCP Server",
      "vendor": "Ahrefs",
      "description": "Ahrefs' official server brings SEO and search analytics — backlinks, keyword data, rankings, and site audits — into an agent's toolset, so an assistant can research and report on search performance directly.\n\nCapabilities are outbound network access and credential access. Risk is modest: the data is largely about public web properties, and the tools are read-oriented. The practical caution is cost rather than security — API credits are consumed per call, and an agent left to explore a research question can iterate through a great many queries faster than a human would. Rate-limit the key.",
      "website": "https://ahrefs.com/api",
      "repository": null,
      "documentationUrl": "https://ahrefs.com/api",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 20,
        "band": "low",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "1 high-risk capability: credentials:access",
            "contribution": 10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    },
    {
      "kind": "mcp",
      "slug": "alpha-vantage-mcp-server",
      "name": "Alpha Vantage MCP Server",
      "vendor": "Alpha Vantage",
      "description": "Alpha Vantage's official server exposes realtime and historical market data — equities, ETFs, options, forex, crypto, commodities, fundamentals, and technical indicators — as agent tools.\n\nCapabilities are outbound network access and credential access for the API key. Risk is low: the data flows inward, and the key grants no ability to trade. The failure mode is analytical rather than security-related, and worth naming because people deploy these for decisions — an agent that fetches a number and reasons about it can be confidently wrong about what the number means, and market data has a great many near-identical fields that mean different things.",
      "website": "https://www.alphavantage.co/documentation/",
      "repository": null,
      "documentationUrl": "https://www.alphavantage.co/documentation/",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 20,
        "band": "low",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "1 high-risk capability: credentials:access",
            "contribution": 10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    },
    {
      "kind": "mcp",
      "slug": "asana-mcp-server",
      "name": "Asana MCP Server",
      "vendor": "Asana",
      "description": "Asana's official server exposes tasks, projects, and workspaces so an agent can read work context, create tasks, and update status as part of a planning or reporting workflow.\n\nIt declares outbound network access and credential access. The exposure profile is ordinary for a work-management connector — project data, assignees, timelines — with the usual caveat that task descriptions written by external collaborators are untrusted text arriving in a model's context. Scope the token to the workspaces an assistant actually needs; organisation-wide access is rarely necessary for the use cases people actually deploy.",
      "website": "https://developers.asana.com/docs/mcp-server",
      "repository": null,
      "documentationUrl": "https://developers.asana.com/docs/mcp-server",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 20,
        "band": "low",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "1 high-risk capability: credentials:access",
            "contribution": 10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    },
    {
      "kind": "mcp",
      "slug": "atlassian-mcp-server",
      "name": "Atlassian MCP Server",
      "vendor": "Atlassian",
      "description": "Atlassian's official server connects agents to Jira, Confluence, and Compass — searching issues, reading and writing pages, and pulling service metadata. In most enterprises this is the single richest source of institutional context an assistant can be given.\n\nThat richness is the risk. Confluence in particular tends to hold architecture documents, incident write-ups, and access instructions, and a broadly-scoped integration reads all of it. Declared capabilities are outbound network access and credential access. Jira descriptions from customer portals are untrusted text. Scope by project and space, and prefer read access for assistants that are answering questions rather than filing work.",
      "website": "https://support.atlassian.com/rovo/docs/getting-started-with-the-atlassian-remote-mcp-server/",
      "repository": null,
      "documentationUrl": "https://support.atlassian.com/rovo/docs/getting-started-with-the-atlassian-remote-mcp-server/",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 20,
        "band": "low",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "1 high-risk capability: credentials:access",
            "contribution": 10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    },
    {
      "kind": "mcp",
      "slug": "box-mcp-server",
      "name": "Box MCP Server",
      "vendor": "Box",
      "description": "Box's official server exposes enterprise content — files, folders, metadata, and search — so an agent can find and read documents held in a managed content platform.\n\nDeclared capabilities are outbound network access and credential access. Box is typically the system of record for contracts, board material, and regulated documents, which makes scope the entire security question: an integration authorised at the enterprise level can read the most sensitive corpus the company has. Use folder-scoped access and app users rather than a broad service account, and confirm that content classification and retention policies survive the trip into a model context.",
      "website": "https://developer.box.com/guides/box-mcp/",
      "repository": null,
      "documentationUrl": "https://developer.box.com/guides/box-mcp/",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 20,
        "band": "low",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "1 high-risk capability: credentials:access",
            "contribution": 10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    },
    {
      "kind": "mcp",
      "slug": "brave-search",
      "name": "Brave Search",
      "vendor": "Anthropic",
      "description": "",
      "website": null,
      "repository": null,
      "documentationUrl": null,
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access"
      ],
      "packaging": {
        "manager": "npm",
        "packageName": "@modelcontextprotocol/server-brave-search",
        "command": "npx"
      },
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02T18:21:41.256Z",
      "risk": {
        "score": 20,
        "band": "low",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "1 high-risk capability: credentials:access",
            "contribution": 10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    },
    {
      "kind": "mcp",
      "slug": "cal-com-mcp-server",
      "name": "Cal.com MCP Server",
      "vendor": "Cal.com",
      "description": "Cal.com's official server exposes scheduling — availability, event types, and bookings — so an agent can find a slot and book it as part of a longer workflow rather than handing the user a link.\n\nDeclared capabilities are outbound network access and credential access. Booking is a state-changing action with real-world consequences and a social cost when it goes wrong, which puts it in the category of tools worth keeping behind confirmation. Calendar data is also quietly revealing: attendee lists and meeting titles describe deals, hiring, and incidents to anyone who can read them.",
      "website": "https://cal.com/docs",
      "repository": null,
      "documentationUrl": "https://cal.com/docs",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 20,
        "band": "low",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "1 high-risk capability: credentials:access",
            "contribution": 10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    },
    {
      "kind": "mcp",
      "slug": "canva-mcp-server",
      "name": "Canva MCP Server",
      "vendor": "Canva",
      "description": "Canva's official MCP server lets agents work with designs, assets, exports, and comments — generating or modifying a design and exporting it without leaving the assistant.\n\nDeclared capabilities are outbound network access and credential access. Brand assets and unreleased marketing material are the sensitive content here, and export is the egress path: an agent that can export a design can produce a shareable artifact of anything in the account. For teams using Canva as a brand system of record, scope the connection to a folder rather than the whole account.",
      "website": "https://www.canva.dev/docs/apps/mcp-server/",
      "repository": null,
      "documentationUrl": "https://www.canva.dev/docs/apps/mcp-server/",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 20,
        "band": "low",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "1 high-risk capability: credentials:access",
            "contribution": 10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    },
    {
      "kind": "mcp",
      "slug": "everart",
      "name": "EverArt",
      "vendor": "Anthropic",
      "description": "",
      "website": null,
      "repository": null,
      "documentationUrl": null,
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access"
      ],
      "packaging": {
        "manager": "npm",
        "packageName": "@modelcontextprotocol/server-everart",
        "command": "npx"
      },
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02T18:21:41.256Z",
      "risk": {
        "score": 20,
        "band": "low",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "1 high-risk capability: credentials:access",
            "contribution": 10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    },
    {
      "kind": "mcp",
      "slug": "figma-mcp-server",
      "name": "Figma MCP Server",
      "vendor": "Figma",
      "description": "Figma's official MCP server gives an agent access to Dev Mode information — layer structure, auto-layout, variants, and design tokens — so a coding assistant can implement a design from its actual structure instead of from a screenshot.\n\nCapabilities are outbound network access and credential access. Design files are usually less sensitive than source or billing data, but they are not neutral: unreleased branding, unannounced features, and customer names in mockups all live in Figma. Scope the token to the files a project needs. The upside is real — reading tokens and spacing from the source removes a whole class of hallucinated CSS.",
      "website": "https://help.figma.com/hc/en-us/articles/32132100833559",
      "repository": null,
      "documentationUrl": "https://help.figma.com/hc/en-us/articles/32132100833559",
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access"
      ],
      "packaging": null,
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02",
      "risk": {
        "score": 20,
        "band": "low",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "1 high-risk capability: credentials:access",
            "contribution": 10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    },
    {
      "kind": "mcp",
      "slug": "filesystem",
      "name": "Filesystem",
      "vendor": "Anthropic",
      "description": "",
      "website": null,
      "repository": null,
      "documentationUrl": null,
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "filesystem:read",
        "filesystem:write"
      ],
      "packaging": {
        "manager": "npm",
        "packageName": "@modelcontextprotocol/server-filesystem",
        "command": "npx"
      },
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02T18:21:41.256Z",
      "risk": {
        "score": 20,
        "band": "low",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "1 high-risk capability: filesystem:write",
            "contribution": 10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    },
    {
      "kind": "mcp",
      "slug": "github",
      "name": "GitHub",
      "vendor": "Anthropic",
      "description": "",
      "website": null,
      "repository": null,
      "documentationUrl": null,
      "license": null,
      "version": null,
      "trustLevel": "official",
      "capabilities": [
        "network:outbound",
        "credentials:access",
        "git:access"
      ],
      "packaging": {
        "manager": "npm",
        "packageName": "@modelcontextprotocol/server-github",
        "command": "npx"
      },
      "configFiles": null,
      "category": null,
      "updatedAt": "2026-09-02T18:21:41.256Z",
      "risk": {
        "score": 20,
        "band": "low",
        "signals": [
          {
            "id": "trust-official",
            "kind": "trust",
            "label": "Published by the vendor",
            "contribution": -40
          },
          {
            "id": "high-risk-capabilities",
            "kind": "capability",
            "label": "1 high-risk capability: credentials:access",
            "contribution": 10
          }
        ],
        "dangerousCombos": []
      },
      "dangerousCombos": []
    }
  ]
}