Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Org-owned · Audited from source

Pollinations MCP server

by pollinations/pollinationsMIT licenceAudited 21 Sep 2026 · source 7cc3dc2a0748

npm sharedstreamable-http★ 5,101
✕BLOCKGrade F · 21/100 · 21 Sep 2026 · 7cc3dc2
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade F (21/100). It exposes 24 tools: 23 read, 1 write and 0 destructive. The audit recorded 75 findings (0 critical, 6 high, 20 medium, 45 low). Maintainer's description: Your Friendly Open-Source Gen-AI Platform

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Pollinations MCP server (pollinations/pollinations)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/pollinations/pollinations-2

Why this is BLOCK. The audit found 0 critical and 6 high findings; the most severe is Code injection at enter.pollinations.ai/worker-runtime.d.ts:2944. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

2 MCP servers are called Pollinations. You are viewing pollinations/pollinations. Compare all 2 →

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score21/100✕BLOCK F
0 critical6 high20 medium45 low4 info

75 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared15 observations
  • NetworkDeclared2 observations
  • ShellDeclared2 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsFoundSee the findings

Findings (75)

Sorted by severity · the 25 most severe of 75 are listed

HIGHCode injectioncode.eval_exec · enter.pollinations.ai/worker-runtime.d.ts:2944
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(input?: (string | URLPatternInit), baseURL?: string): URLPatternResult | null;
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · enter.pollinations.ai/worker-runtime.d.ts:9768
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(query: string): Promise<D1ExecResult>;
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHFilesystem / pathfs.credential_store · operations/infrastructure/gpu/zimage/deploy-all-ionet.sh:8
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
SSH_KEY="${SSH_KEY:-$HOME/.ssh/thomashkey}"
Why
touches a credential store
Fix
—
HIGHPrompt injectionprompt.credential_read · .claude/skills/model-debugging/SKILL.md:22
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- **403 errors**: Users denied access to specific models (API key restrictions)
Why
asks the agent to read credentials
Fix
—
HIGHPrompt injectionprompt.override · APIDOCS.md:3274
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
models ignore text inputs — any text prompt passed to the Trellis 2/Asset Harvester family will
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
HIGHPrompt injectionprompt.override · gen.pollinations.ai/src/docs/3d-generation.md:5
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
models ignore text inputs — any text prompt passed to the Trellis 2/Asset Harvester family will
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
MEDIUMInformation disclosuredisclose.log_secret · operations/observability/scripts/push-secrets.mjs:36
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`Skipping non-Worker secret ${name}`);
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.beacon_words · apps/composio-mcp/worker.js:156
F-04 Network egressCWE-200 · CWE-319Layer L1
callback_url: callbackUrl,
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · .claude/skills/monitor-services/SKILL.md:46
F-04 Network egressCWE-200 · CWE-319Layer L1
curl -s --connect-timeout 5 --max-time 10 http://192.222.51.105:8765/health
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · .claude/skills/monitor-services/SKILL.md:79
F-04 Network egressCWE-200 · CWE-319Layer L1
curl -s --connect-timeout 5 --max-time 10 http://192.222.51.105:8189/health
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · apps/ai-dungeon-master/src/components/figma/ImageWithFallback.tsx:4
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
'data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iODgiIGhlaWdodD0iODgiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjMDAwIiBzdHJva2UtbGluZWpvaW49InJvdW5kIiBvcGFjaXR5PSIuMyIgZmlsbD0ibm9uZSIgc3Ryb
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · apps/computer-mcp/secrets.vars.json:3
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"GITHUB_APP_PRIVATE_KEY": "ENC[AES256_GCM,data:8B9WeHKttha0jbRDpL0ehHCbcJZSxps6tVHt0eNrxCaEDysfmbB2xKiKgLJPe0gu0TEHHUdwLSxmLOmzbbMPPcZ6UrgkwRhleZPidJ7yuWgGUqC39jnvAOpqRS+6PG1C9DiLNylupVvXYhjqCNWatCdjs
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · enter.pollinations.ai/secrets/dev.vars.json:12
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"SSH_RUNPOD_KLEIN": "ENC[AES256_GCM,data:wnWlFH7oUX0qPWZ9/OMEkzV5MTlubVdD+/ZvHT4wXG9B5rU+LP4xsQdRms6vpsUT9byS7QaRPse3B+WBq+nM+Xu5ck8dEETSGSDrSnewSi1oKCwwHPVGz9KACknVTH11d0OJLuAkBPGQAdopLmilWL60ZJCNg28
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · enter.pollinations.ai/secrets/dev.vars.json:18
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"GITHUB_APP_PRIVATE_KEY": "ENC[AES256_GCM,data:zyTCGnoZfDyeoCBgQ3ix9kIVKBVzQ4zUWZi+UCl2vlrRcG8Kcs4EE5JHXISarkLpajNjgobyEJw7TKbKjdMRLFFOrU9Nv+z22j/xP9cIZFVW5Lt/F3oD3Od+0pEbRHVr+SRcf4F1qazQMjgg9AHqfbJKq
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · enter.pollinations.ai/secrets/prod.vars.json:12
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"SSH_RUNPOD_KLEIN": "ENC[AES256_GCM,data:z3u2POkOeuFFf8Hn4uiqLX4Lzz6z4kzwof+FbZo/8y8olfcfnq+mk9ufSa9SSWhLofKlPcE1w6+WdlxxSCVzXrM3MbGuiw2kswH8Wjvtzphs6xC7tqkWSuDo2bevKqSS2Qick4oCTeY2jqpX7G5m4omPlzbUemi
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.zero_width · apps/catgpt/script.js:56
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"🐈⬛",
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.zero_width · enter.pollinations.ai/frontend/src/components/news-faq/news-banner.tsx:30
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
emoji: "🧑💻",
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.zero_width · operations/app-management/app.json:2415
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"emoji": "🧑💻",
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.zero_width · operations/app-management/app.json:4788
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"emoji": "🧑🏫",
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.zero_width · operations/app-management/app.json:5145
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"emoji": "🧑💻",
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · apps/ask-jev-mcp/worker.test.js:9
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · apps/mcp/worker.test.js:9
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · enter.pollinations.ai/test/github-secret-scanning.test.ts:145
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · enter.pollinations.ai/test/oauth-code.test.ts:331
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

24 declared in source · 0 destructive

23 read1 write0 destructive
ToolWhat it doesRisk
create_chartCreate a chart or graph visualization from data points.write
ComposioUse Gmail, Slack, GitHub, Drive, and hundreds of other apps. Agents ask you to connect when needed.read
ComputerA private persistent computer: files and a bash shell that survive between runs.read
FFmpegTrim, convert, resize, compress, and remix audio and video.read
GitHubCode hostingread
PollinationsGenerate images, video, audio, text and embeddings from your own wallet.read
agentSame descriptionread
agentsExample agentsread
answerThe answerread
bashNo description in the sourceread
brief-agentConcise answersread
external-agentRuns on its ownerread
generateImageGenerate an imageread
jev_decideNo description in the sourceread
modelTestread
my-second-modelAccount API modelread
my-test-modelAccount API modelread
repo-agentFrom GitHubread
researcherNo description in the sourceread
runFfmpegNo description in the sourceread
unused-prompt-agent-nameUnused descriptionread
weatherGet weatherread
web_fetch_exaNo description in the sourceread
web_search_exaNo description in the sourceread

Safer alternatives

PyScrappy✓SAFE

mldsveda/pyscrappy

Adaptive Python web scraping toolkit + MCP server for AI agents. Self-healing selectors that survive site changes, TLS-fingerprint stealth to bypass anti-bot filters, CSS/XPath parsing, and 24 built-in scrapers, clean, structured, LLM-ready data from any URL.

1 writeGrade B
3d-scene-mcp✓SAFE

nirholas/3d-scene-mcp

Build and manipulate 3D scenes from natural language via AI agents.

Grade B

Audit history

  1. ✕BLOCK F 21 / 100

    Source changed, verdict held · 7cc3dc2a0748

  2. ✕BLOCK F 21 / 100

    First audit · 4b9e15302921

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK FMODELSATLASBLOCK · F

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Pollinations MCP server

What is the Pollinations MCP server?
Your Friendly Open-Source Gen-AI Platform
What tools does Pollinations expose?
24 in total: 23 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Pollinations safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (21/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Pollinations need?
It reads AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AZURE_MYCELI_PROD_API_KEY, AZURE_MYCELI_PROD_SWEDEN_API_KEY, BOT_TOKEN_CATGPT, BOT_TOKEN_OPPOSITE_PROMPT, CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_TOKEN_MYCELI, DASHSCOPE_API_KEY, DEEPINFRA_API_KEY, DISCORD_TOKEN and GH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Pollinations run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as shared.
How current is this page?
The grade is for one exact copy of the source (7cc3dc2a0748), read on 2026-09-21. The repository is watched and re-audited when it changes.
Which Pollinations MCP server is the right one?
2 unrelated servers share the name “Pollinations”; compare them side by side before you install.
I already installed Pollinations. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • pollinations/pollinations on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit 7cc3dc2a0748Observed · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.