Mmcp.market

Is BorealHost MCP server safe?

Yes, with the usual care.

B83/100grade B

Safe to use. Minor gaps such as a missing repository or slower maintenance.

What to know before installing
  • highWrite-action tools reachable without authentication

Public scan report

scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it

1 high1 low
  • Code scan6 source files scanned25/25
  • Live reliabilityremote reachable in 1538ms20/20
  • Tool poisoning184 tool descriptions checked13/15
  • Auth qualityopen endpoint exposes 61 write-action tools with no auth3/15
  • Maintenancelast push 13 days ago15/15
  • Maintainer identitynamespace and repository owner differ; GitHub account older than a year; website matches verified namespace7/10

Findings (2)

  • highWrite-action tools reachable without authenticationauth.open-write
  • lowUnusually long tool description (over 2,000 characters)poison.long-description
    tool complete_checkout: …Complete checkout with payment and start site provisioning. The checkout must be in "ready" status. Two payment methods: - "stripe_checkout" (default): Returns a short, chat-safe payment URL. **Present `payment_url` to the human — NOT `stripe_checkout_url`.** The raw Stripe URL has a required `#fragment` that chat UIs routinely strip when rendering markdown links, which causes Stripe to show "page not found". `payment_url` is a short BorealHost redirect that preserves the fragment via HTTP 302. After paying, the human lands on a confirmation page (`confirmation_url`) — not on raw JSON. Then poll get_checkout_status() until status becomes "completed". The API key appears in the first poll after payment (shown once, then cleared). Payment provisions the site; nothing else has to be called to create it. - "stripe_payment_method": Charges a Stripe PaymentMethod directly. Requires payment_method_id. On success, returns the API key immediately. Args: checkout_id: Checkout session ID payment_method: "stripe_checkout" (returns a payment_url for a human), "stripe_payment_method" (card on file), or "wallet" — pay from the account's prepaid balance against THIS key's allowance. Check get_wallet() first: `spendable_cents` is what you may actually spend, and a wallet payment is refused for plans that order dedicated hardware, which are authorised against a verified card payment instead. payment_method_id: Stripe PaymentMethod ID (pm_...). Required only for "stripe_payment_method". Returns (stripe_checkout): {"id": "uuid", "status": "awaiting_payment", "payment_url": "https://borealhost.ai/pay/<id>/?s=<secret>", "confirmation_url": "https://borealhost.ai/pay/<id>/confirmation/?s=...", "stripe_checkout_url": "https://checkout.stripe.com/c/pay/...", "message": "Present payment_url to the human..."} Returns (stripe_payment_method): {"id": "uuid", "status": "completed", "api_key": "bh_...", "api_key_message": "Store this API key securely...", "subscription_id": "uuid", "provisioning_job_id": "uuid"} Errors: VALIDATION_ERROR: Missing payment_method_id for stripe_payment_method FORBIDDEN: Checkout not in "ready" status …
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Other servers that do what BorealHost does

  • Layero
    Deploy and operate sites on Layero — hosting with build servers in Russia: domains, env, Data API.
    B
  • Coolftp
    Deploy a site to its SFTP/FTP host from a coding agent. Changed files only, undo, live checks.
    A
  • Boat House
    Deploy and share small apps with team login, persistent data, versioned updates and domains.
    A

BorealHost reviews, tools and install