Is The Undesirables TCG Oracle MCP server safe?
Yes, with the usual care.
Safe to use. Minor gaps such as a missing repository or slower maintenance.
What to know before installing
- highWrite-action tools reachable without authentication
How The Undesirables TCG Oracle compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 84/100
- higher than 68% of 48,243 servers
- Tools that change things
- 4%
- typical: 0%. Fewer write tools means less an agent can break
- Uptime
- 96%
- of our recent checks; the typical remote server answers 100%
What its tools let an agent do: 23 read · 2 change
Public scan report
scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it
1 high1 low
- Code scan10 source files scanned25/25
- Live reliabilityremote reachable in 963ms20/20
- Tool poisoning25 tool descriptions checked13/15
- Auth qualityopen endpoint exposes 1 write-action tools with no auth3/15
- Maintenancelast push 13 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Findings (2)
- highWrite-action tools reachable without authentication
auth.open-write - lowUnusually long tool description (over 2,000 characters)
poison.long-descriptiontool souls_in_wallet: … Show every Undesirable soul a wallet holds, with each soul's public prediction track record and its most recent calls. FREE — no payment, no signature, no wallet connection required. Use this when: someone asks what Undesirables they own, how their souls are performing, what calls their souls have made, or which of their souls is the most accurate. HOW IT WORKS • Ownership is read from Ethereum mainnet (ERC-721 0xA893648A701C03B14bF2FB767B72b2C55ed5c17A). Only the minted souls 1..total_minted (from GET / on the oracle) have public records. • Nothing here is private, so you can look up ANY address — the caller does not have to prove they own it. Ask the user for their address. • Each minted soul locks 3 card predictions weekly, chosen deterministically from its on-chain personality traits. The oracle scores them 30 days later against real market prices. WHAT YOU GET BACK • souls[] — per soul: rating (A+..F / UNRATED), matured, hits, hit_rate, brier, open_calls, and recent_calls with each call's outcome (hit / miss / push) • wallet_totals — combined open + matured calls and overall hit rate • best_soul — the holder's most accurate soul, once any have matured HOLDERS WITH SEVERAL SOULS: this is a roster. Offer to compare them, or to speak as a specific one — each has different traits and its own record. IMPORTANT — records come in seasons. Season 1 (USD card board) is closed: its calls matured 07-31..08-09, and later USD calls are VOID (not misses) because the USD price panel froze 2026-09-07. Season 2 (Japanese dealer board) locks weekly from 2026-09-14; its first calls mature 2026-10-14, so newer souls may read UNRATED with open calls only. That is expected: every call was committed on-chain BEFORE its outcome. Judge `skill` (hit rate minus the best constant call on the soul's own picks), not raw hit rate. Args: address: 0x-prefixed EVM address to look up. calls: recent scored calls to include per soul (0-12, default 5). …
Overall 84/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON