{"uid":"cap_UnmWF_1q9FLjQCcM7P1GJ","slug":"hermes-plant-mcp-risk-score-f1222f9d","name":"Hermes Plant MCP Risk Score","description":"Analyze an MCP server manifest for security risk before install — destructive actions, over-broad scopes, sensitive-data egress, weak auth, prompt-injection surface, and permission diff. Returns per-tool, per-factor findings with severity, why, and a concrete fix (not just a score).","url":"https://hermesplant.com/api/agent-services/mcp-risk/score","method":"GET","headers":{},"bodySchema":{"type":"object","properties":{"tools":{"type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"type":"string"},"scopes":{"type":"array","items":{"type":"string"}},"network":{"type":"boolean"},"description":{"type":"string"},"inputSchema":{"type":"object"},"permissions":{"type":"array","items":{"type":"string"}}}},"description":"The server's tool manifest"},"server":{"type":"string","description":"MCP server name/URL (optional)"},"authModel":{"type":"string","description":"e.g. oauth, token, none"},"priorTools":{"type":"array","items":{"type":"string"},"description":"Tool names from a prior manifest, to diff capability growth"}}},"responseSchema":{"type":"json","example":{"risk":"critical","status":"scored","service":"mcp-risk-score","byFactor":{"weak-auth":1,"over-broad-scope":1,"sensitive-egress":1,"destructive-action":1},"requestId":"mcp_<uuid>","findingsCount":5,"requiresApproval":true,"recommendedAction":"block_install_until_scoped_and_approved"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_K9flB-9CySd99gg53NI8X","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scores an MCP (Model Context Protocol) server or agent tool for operator safety risks such as weak auth, over-broad scope, sensitive egress, and destructive actions, returning a risk rating and recommended action.","exampleAgentPrompt":"Before we install this MCP server, run a Hermes Plant risk score on it — I need to know if it has weak auth, overly broad scope, or any destructive actions, and whether it should be blocked until approved.","exampleUseCases":null,"resultDescription":"A JSON object containing a risk level (e.g. 'critical'), a status of 'scored', a breakdown of risk factors (weak-auth, over-broad-scope, sensitive-egress, destructive-action each scored 0 or 1), total findingsCount, a requiresApproval boolean, and a recommendedAction string such as 'block_install_until_scoped_and_approved', plus a unique requestId.","failureModes":["Missing or malformed MCP server payload returns 400 with validation error","Insufficient USDC balance or x402 payment failure returns 402","Unrecognized MCP schema version may result in incomplete scoring","Network timeout returns 504 with no score produced","Rate limiting may return 429 if too many calls in a short window"],"whenToPreferThis":"Use this endpoint when an AI agent operator or orchestration layer needs to gate-check an MCP server or tool plugin before installation or execution — especially in regulated, enterprise, or high-stakes trading environments where weak auth, sensitive data egress, or destructive tool calls pose meaningful risk. Prefer this over manual review when you need a deterministic, test-backed score with a clear pass/block recommendation.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T06:31:45.182Z","isFirstParty":false}