LeashIndex Get the report

Index / data

S3eidat Tools

io-github-s3eidat-s3eidat-tools-mcp declares 162 capabilities across 162 tools, with 2 critical issues. One of them, no-revocation, is recorded for every server in the index because MCP has no field in which to declare a way to switch a tool off; a missing declaration is not evidence that the control is missing.

96/100 exposureHigh exposure

Manifest recorded 2026-11-04 from tools/list answered by the npm package s3eidat-tools-mcp@0.1.0 (published to npm as s3eidat-tools-mcp, listed in the official MCP registry as io.github.s3eidat/s3eidat-tools-mcp 0.1.0), run in an isolated container with no network access and no credentials. The date changes only when the manifest does. Not verified by a maintainer.

Issues

These describe what this server's manifest declares. A product can provide controls that MCP has no way to express — token revocation, an admin console, audit logs — and this page cannot see them. The absence of a declaration is not evidence that a control is absent.

critical · no-revocation · All 162 tools

162 of 162 tools declare no way for the customer to switch them off once granted. This applies to every tool because MCP has no field in which to declare a revocation mechanism; the product may provide one outside MCP that a manifest cannot show.

critical · irreversible-uncapped · 1 of 162 tools

1 tool is classified as irreversible and declares no limit.

high · no-expiry · All 162 tools

162 of 162 tools declare no expiry. This applies to every tool because MCP has no field in which to declare an expiry; the product may provide one outside MCP that a manifest cannot show.

high · no-audit-trail · All 162 tools

162 of 162 tools declare no record of their actions that the customer can read. This applies to every tool because MCP has no field in which to declare an audit requirement; the product may provide one outside MCP that a manifest cannot show.

low · uncapped-read · 161 of 162 tools

161 tools can read data and declare no limit.

Declared capabilities

How each tool was read. declared means the server's own annotation said so — self-reported and unverified. inferred is from the tool's name. assumed means nothing indicated either way.

ToolRead asBasis
ai_chartread declared
ai_chunk_textread declared
ai_create_pptxread declared
ai_create_xlsxread declared
ai_csv_profileread declared
ai_detect_languageread declared
ai_diagramread declared
ai_docx_to_markdownread declared
ai_extract_entitiesread declared
ai_file_identifyread declared
ai_html_to_markdownread declared
ai_image_diffread declared
ai_json_schema_inferread declared
ai_json_schema_validateread declared
ai_markdown_to_docxread declared
ai_markdown_to_pdfread declared
ai_media_inforead declared
ai_ocrread declared
ai_pdf_to_markdownread declared
ai_pptx_to_markdownread declared
ai_sql_queryread declared
ai_text_similarityread declared
ai_token_countread declared
ai_web_fetchread declared
ai_xlsx_to_markdownread declared
ai_zipdelete inferred
barcode_generateread declared
base_convertread declared
base64_decoderead declared
base64_encoderead declared
bytes_convertread declared
calc_ageread declared
calc_bmiread declared
calc_cash_countread declared
calc_compound_interestread declared
calc_date_diffread declared
calc_discountread declared
calc_due_dateread declared
calc_equationread declared
calc_expressionread declared
calc_fractionread declared
calc_fuel_costread declared
calc_gparead declared
calc_hijriread declared
calc_hoursread declared
calc_loanread declared
calc_percentageread declared
calc_primesread declared
calc_romanread declared
calc_salaryread declared
calc_sleepread declared
calc_split_billread declared
calc_statsread declared
calc_unit_convertread declared
calc_zakatread declared
chmod_calcread declared
cron_explainread declared
crypto_file_decryptread declared
crypto_file_encryptread declared
crypto_stego_hideread declared
crypto_stego_revealread declared
crypto_text_decryptread declared
crypto_text_encryptread declared
css_clampread declared
css_formatread declared
css_unitsread declared
csv_to_jsonread declared
curl_to_coderead declared
doc_attendance_sheetread declared
doc_business_cardsread declared
doc_calendarread declared
doc_invoiceread declared
doc_labelsread declared
doc_receiptread declared
doc_resumeread declared
gitignore_generateread declared
hash_computeread declared
html_formatread declared
http_statusread declared
id_generateread declared
id_inspectread declared
image_ascii_artread declared
image_ascii_bannerread declared
image_compressread declared
image_convertread declared
image_cropread declared
image_exif_readread declared
image_exif_stripread declared
image_favicon_setread declared
image_from_base64read declared
image_paletteread declared
image_placeholderread declared
image_resizeread declared
image_rotateread declared
image_svg_to_pngread declared
image_to_base64read declared
image_watermarkread declared
ip_in_rangeread declared
json_formatread declared
json_queryread declared
json_to_csvread declared
json_to_typesread declared
json_to_yamlread declared
jwt_decoderead declared
markdown_tableread declared
markdown_table_parseread declared
meta_tags_generateread declared
password_checkread declared
password_generateread declared
pdf_compressread declared
pdf_extract_pagesread declared
pdf_form_fieldsread declared
pdf_form_fillread declared
pdf_from_imagesread declared
pdf_inforead declared
pdf_mergeread declared
pdf_metadata_readread declared
pdf_metadata_writeread declared
pdf_organizeread declared
pdf_page_numbersread declared
pdf_rotateread declared
pdf_sign_imageread declared
pdf_splitread declared
pdf_to_imagesread declared
pdf_to_textread declared
pdf_watermarkread declared
prayer_timesread declared
qibla_directionread declared
qr_generateread declared
qr_readread declared
qr_wifiread declared
random_diceread declared
random_pickread declared
random_teamsread declared
regex_testread declared
secret_santa_drawread declared
sql_formatread declared
subnet_calcread declared
text_arabicread declared
text_caseread declared
text_citationread declared
text_cleanread declared
text_diffread declared
text_escaperead declared
text_fancyread declared
text_layout_fixread declared
text_loremread declared
text_morseread declared
text_number_to_wordsread declared
text_readabilityread declared
text_slugifyread declared
text_social_countread declared
text_word_countread declared
time_convertread declared
time_world_clockread declared
url_decoderead declared
url_encoderead declared
url_parseread declared
useragent_parseread declared
xml_formatread declared
xml_queryread declared
yaml_to_jsonread declared
Answering this question about your own agent? The self-serve stack report applies the same reading to your own stack or server and gives you a dated document you can hand to a customer's security review. It is generated in your browser, with nobody to wait for. Buying one does not change this page, its score or its place in the index — see Independence.
Maintain this server? If this page misreads your manifest, or your server has changed, submit its current tools/list response and it will be re-scored and dated. Corrections are published alongside the original, not in place of it.