Overwing

Q: Is Overwing MCP server safe?

QAmcp's test on 25 Oct 2026: No hidden instructions were found in its tool descriptions. Its error messages showed no secrets or internal details. 23 of its 41 tools are labeled read-only; the others may change or send things. Overall it scored 93/100 on 25 Oct 2026. A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.

by overwing.ai · https://overwing.ai/mcp

Guardrails for LLM output: pass / fail / review verdicts and one recommended action. Hosted or npm.

41 tools✓ no account neededPricing: on their site

See pricing →Visit website

93 /100

PASS · WITH NOTES

11 of 11 checks · 25 Oct 2026

Is Overwing MCP server safe?

No hidden instructions were found in its tool descriptions.
Its error messages showed no secrets or internal details.
23 of its 41 tools are labeled read-only; the others may change or send things.
Overall it scored 93/100 on 25 Oct 2026.

A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.

What it can do

41 tools, in the server's own words.

evaluate

Works with no API key: 10 evaluations a day, inputs up to 2,000 characters, and the text is not stored.

evaluate_batch

Score up to 50 texts against one rule set in a single call.

list_rule_setsread-only

List the prebuilt and custom rule sets available to this organization.

get_rule_setread-only

Fetch a rule set with its full rule definitions.

create_rule_set

Create a custom rule set with 1 to 25 rules.

get_evaluationread-only

Fetch a stored evaluation by id, including the original input and per-rule results.

list_evaluationsread-only

List recent evaluations, newest first, with optional verdict and rule set filters.

get_usageread-only

Daily usage, remaining quota for today, and plan limits.

whoamiread-only

Identify the organization and plan behind the API key on this request, the key's scope, the organization's data settings (store_inputs, retention_days), and wh…

create_account

Create an Overwing account for yourself, with no email: an organization and an API key, returned once.

prove_domain

Begin proving that your account controls a domain.

verify_domain

Look for the value prove_domain asked for, at the domain.

list_plansread-only

Public plan catalog: prices, daily limits, and per-minute burst limits.

atlas_lookupread-only

Say what a User-Agent string claims to be and whether the claim can be trusted, from the Overwing Atlas registry of AI crawlers, fetchers and browser agents.

atlas_agentsread-only

Browse or search Overwing Atlas, the registry of AI crawlers, fetchers and browser agents: name, operator, user-agent tokens, Web Bot Auth key directory, robot…

atlas_register_agent

Add an agent or crawler you operate to the Overwing Atlas registry, free, so a site that looks up its User-Agent learns who runs it.

atlas_verify_registration

Look for the proof at the operator's domain: the DNS TXT record or the file that atlas_register_agent asked for.

atlas_list_registrationsread-only

The agents this organization has registered in Overwing Atlas, newest first, each with its status (pending_verification, pending_review, published, rejected) a…

atlas_withdraw_registration

Withdraw a registration.

atlas_summaryread-only

Public numbers from Overwing Atlas: registry counts by purpose and verification, published browser-agent traffic shares, sector field-scan headlines (e.g.

beacon_start

Overwing Beacon answers one question about a site: is this product reachable by agents?

beacon_reportread-only

The report for a check started with beacon_start.

feedback

Send one message to the people who run Overwing: a verdict you think was wrong, an error you could not act on, a payment you could not make, a tool that did no…

beacon_sampleread-only

A real Overwing Beacon report, free: the check of overwing.ai itself, refreshed daily.

and 17 more

Test results

Safe mode: only tools labeled read-only were run. How the test works

!
Every tool is described
12 warnings
- !evaluate_batch: Inputs with no description: items, rule_set
- !list_rule_sets: Inputs with no description: include_inactive
- !get_rule_set: Inputs with no description: slug
- !create_rule_set: Inputs with no description: name, slug, description, rules
- !get_evaluation: Inputs with no description: id
- !list_evaluations: Inputs with no description: limit, verdict, rule_set, cursor
- !get_usage: Inputs with no description: days
- !atlas_agents: Inputs with no description: operator, limit
- and 4 more
note
✓
ConnectsConnected in 352 ms
pass
✓
Ready for the newest MCP versionUses the latest MCP version (2026-07-28)
pass
✓
Lists its toolsFound 41 tools
pass
✓
Tools are labeled safe or dangerousEvery tool has a safety label
pass
✓
No hidden instructionsNo hidden instructions found in tool descriptions
pass
✓
Tools work with good inputs
All good
- ✓list_rule_sets: Answered with an error, probably because of our sample input: api_key_required: list_rule_sets needs an organization key. Send Authorization: Bearer ow_live_... on the MCP connection. POST https://over…
- ✓get_rule_set: Answered with an error, probably because of our sample input: api_key_required: get_rule_set needs an organization key. Send Authorization: Bearer ow_live_... on the MCP connection. POST https://overwi…
- ✓get_evaluation: Answered with an error, probably because of our sample input: api_key_required: get_evaluation needs an organization key. Send Authorization: Bearer ow_live_... on the MCP connection. POST https://over…
- ✓list_evaluations: Answered with an error, probably because of our sample input: api_key_required: list_evaluations needs an organization key. Send Authorization: Bearer ow_live_... on the MCP connection. POST https://ov…
- ✓get_usage: Answered with an error, probably because of our sample input: api_key_required: get_usage needs an organization key. Send Authorization: Bearer ow_live_... on the MCP connection. POST https://overwing.…
- ✓whoami: Answered with an error, probably because of our sample input: api_key_required: whoami needs an organization key. Send Authorization: Bearer ow_live_... on the MCP connection. POST https://overwing.ai/…
- ✓list_plans: Worked (155 ms)
- ✓atlas_lookup: Worked (380 ms)
- and 32 more
pass
✓
Bad inputs give a clean error
All good
- ✓list_rule_sets: Refused wrong type for "include_inactive" with a clear error
- ✓get_rule_set: Refused missing required input "slug" with a clear error
- ✓get_rule_set: Refused wrong type for "slug" with a clear error
- ✓get_evaluation: Refused missing required input "id" with a clear error
- ✓get_evaluation: Refused wrong type for "id" with a clear error
- ✓list_evaluations: Refused wrong type for "limit" with a clear error
- ✓get_usage: Refused wrong type for "days" with a clear error
- ✓atlas_lookup: Refused missing required input "user_agent" with a clear error
- and 15 more
pass
✓
Tools work together
1 chain working
- ✓beacon_sample → beacon_report: beacon_report found what beacon_sample returned (id = "bcn_sample0000000000")
- ✓Stopped looking for more chains after the limit on tool calls
pass
✓
Fast enough
All good
- ✓Connecting took 352 ms
- ✓Listing tools took 145 ms
- ✓Average tool answer: 123 ms
- ✓atlas_lookup: Slowest tool: atlas_lookup (380 ms)
pass
✓
No secrets leakedChecked 68 error messages: no secrets or internal details
pass

Test it yourself

Free and open source. Same checks, same score.

npx qamcp-cli https://overwing.ai/mcp

Score over time

14 Oct 202693
17 Oct 202693
18 Oct 202693
25 Oct 202693

Reviews

Coming soon: reviews from people who use Overwing, signed in with GitHub, one per person. Reviews never change the score.

Is this your server?

Soon you can claim this page: re-test it from here, reply to results, and show a "Tested by QAmcp" badge.

Have a concern, or want it removed? Ask us and we'll take it off the list. How the directory works