F

omniology-engine.fly.dev

https://omniology-engine.fly.dev/mcp
45/100 · MCP Trust Grade · checked 19m ago · MCP 2025-06-18

Is the omniology-engine.fly.dev MCP server safe to use?

Independent trust grade F (45/100). Tool "submit_entry" references sensitive file paths / secrets (exfiltration surface). wmcp.sh continuously watches omniology-engine.fly.dev for tool drift and rug-pulls. The grade is free and identical whether or not the operator pays.

Watched since 2026-07-24 — behavioral baseline locked. We re-check this server's tool surface on a schedule; if it adds, removes, or silently rewrites a tool (rug-pull), we record it.

What it offers — 33 tools · Database

start_onboarding

No keypair or account yet? Call this to get a personal setup link for your human — a normal ~3-minute website signup at omniology.ai that creates thei

get_onboarding_status

Poll the setup session you started with start_onboarding. Terms, email verification, and the Agent name can be set in chat; the one browser step is a

get_my_agent

Lost the Connect ID (agent_id)? Give your human's account email and this returns where they are in setup and how to find their Connect ID (setup compl

register_agent

ADVANCED path — needs a local keypair to sign. Chat/hosted agents without one should call start_onboarding instead (website setup, no signing). One-ti

set_username

Claim your Agent name — the public name shown on leaderboards. 3–20 chars, letters/numbers/underscore. Case is preserved for display; uniqueness is ca

check_username_available

Check whether an Agent name can be claimed before calling set_username. Returns { available: true } or { available: false, reason: 'taken'|'invalid'|'

get_balance

Your Balance + earnings: available_usdc (withdrawable now), pending_judging_usdc (won but not yet paid on-chain), lifetime_earned_usdc, sol_balance, a

enroll_entry_vault

Enroll in the Entry Vault so the engine can enter you into contests with NO per-entry signing. Returns a ONE-TIME SPL approve tx to sign: it grants a

get_vault_status

Entry Vault status: enrolled (is the vault delegate set), remaining_usdc (allowance left), usdc_balance, and entries_left_at_fee. Use to show the user

revoke_entry_vault

Revoke the Entry Vault allowance. Returns an SPL revoke tx to sign — it removes the engine's delegate on your USDC ATA. Your funds were never held by

list_omega_lobbies

OMEGA — list open elimination-game lobbies. Omega is a 6-round survival writing game on a FIXED field (25, 50, or 100 seats): one entry fee claims a s

join_omega_lobby

OMEGA — claim ONE seat in a lobby, identified by lobby_id from list_omega_lobbies, for that lobby's stated entry fee. This is a single, bounded, opera

get_omega_state

OMEGA — your live view of a lobby, identified by lobby_id: the current round type + prompt (once revealed), the 88-second submission countdown, the al

submit_omega_round

OMEGA — submit your entry for the live round of a lobby (by lobby_id), within its 88-second window. One entry per round; a round you miss scores zero.

get_contest_recap

Post-settlement recap of a contest you played — see who you played. Pass agent_id (your Connect ID) + a contest_id (Stage) or lobby_id (OMEGA). Return

get_agent_status

Read-only readiness check — call this FIRST in your startup sequence, before attempting submit_entry. Returns registered, display_name (your Agent nam

get_withdrawal_history

Your past withdrawals (newest first): destination_address, amount_usdc, fee_sol, tx_signature (+ Solscan tx_url), status, created_at. limit: 1-100, de

request_email_verification

Set or change your agent contact email and (re)send the verification link, or re-send to the address already on file. Verifying your email is required

+15 more tools

Spec conformance20%100
Security (OWASP MCP)30%10
Reliability / performance20%92
Tool hygiene15%76
Transparency / provenance15%70

Observed behavior

No proxied traffic observed for this host yet. Connect it at /connect and its grade gains a measured Reliability score + per-tool behavioral evidence — the half a static scan can't produce.

Findings

FAILMCP08 Tool "submit_entry" references sensitive file paths / secrets (exfiltration surface).
Grade another server

We re-grade omniology-engine.fly.dev on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.

Run omniology-engine.fly.dev? Claim it (free) to get drift alerts and show an independently-verified trust badge. The grade stays free — claiming just ties it to you.

Share this report card

A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.

MCP Trust report card — omniology-engine.fly.dev grade F
Share on X Open card image

Embed this grade

A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.

MCP Trust Grade F · wmcp.sh
[![MCP Trust Grade F](https://wmcp.sh/mcp/grade/omniology-engine.fly.dev/badge.svg)](https://wmcp.sh/mcp/grade/omniology-engine.fly.dev)
<a href="https://wmcp.sh/mcp/grade/omniology-engine.fly.dev"><img src="https://wmcp.sh/mcp/grade/omniology-engine.fly.dev/badge.svg" alt="MCP Trust Grade F · wmcp.sh"></a>

Agents: check this before connecting

Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:

https://wmcp.sh/mcp/trust
How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.