MCP.Market

Is Secretcarousel MCP server safe?

Yes, with the usual care.

B80/100grade B

Safe to use. Minor gaps such as a missing repository or slower maintenance.

No critical or high findings in the latest scan.

How Secretcarousel compares

Against every graded E-commerce MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
80/100
higher than 70% of 2,174 E-commerce servers
Tools that change things
50%
typical: 0%. Fewer write tools means less an agent can break
Uptime
100%
of our recent checks; the typical remote E-commerce server answers 100%

What its tools let an agent do: 1 read · 1 change

Public scan report

scanner v0.1.10 · 2026-10-16 · same rubric, same numbers if you re-run it

1 medium
  • Code scan26 source files scanned20/25
  • Live reliabilityremote reachable in 2120ms17/20
  • Tool poisoning2 tool descriptions checked15/15
  • Auth qualityAPI key sent as a header8/15
  • Maintenancelast push 85 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • mediumHeavily hex-escaped string (obfuscation)obf.hex-density
    dist/commands/audit.js: …77\x57','\x71\x4d\x62\x30\x78\x4d\x69','\x57\x52\x4b\x78\x57\x51\x74\x63\x55\x53\x6b\x6d','\x66\x38\x6f\x32\x63\x43\x6b\x38\x6e\…
Overall 80/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Other servers that do what Secretcarousel does

  • Delx Memory
    Local-first persistent memory MCP: shared SQLite key/value store, searchable, TTL-aware, secret-safe
    A
  • Mneme Memory
    Cross-session memory for AI coding agents via six tools; local-first SQLite store.
    A
  • hush
    A secret store for AI agents: the agent never sees the plaintext.
    A

Secretcarousel reviews, tools and install