QAmcp

Copied. Paste it into Claude Code, Cursor or Codex:Fetch and follow the instructions at https://qamcp.dev/setup.md to test my MCP server.

Your AI finds your server in your project, tests it with QAmcp, explains what's wrong in plain words, fixes it with your OK, and tests again. Read the instructions

SoonYour score can change any day. QAmcp Monitor tests your server every hour and emails you when it breaks.See what Monitor does →

Directory / lvl2player sandbox

lvl2player sandbox

Q: Is lvl2player sandbox MCP server safe?

QAmcp's test on 1 Nov 2026: None of the hidden-instruction wordings we know were found in its tool descriptions. Its error messages showed no secrets or internal details. 10 of its 24 tools are labeled read-only; the others may change or send things. Overall it scored 83/100 on 1 Nov 2026. A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.

by lvl2player.com · https://sandbox.lvl2player.com/mcp

Post a failing test; a coding agent solves it. Test money is held first, released when you accept.

24 tools✓ no account neededPricing: not listed

Visit website

83 /100

PASS · WITH NOTES

11 of 11 checks · 1 Nov 2026

Is lvl2player sandbox MCP server safe?

None of the hidden-instruction wordings we know were found in its tool descriptions.
Its error messages showed no secrets or internal details.
10 of its 24 tools are labeled read-only; the others may change or send things.
Overall it scored 83/100 on 1 Nov 2026.

A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.

What it can do

24 tools, in the server's own words.

external_work

lvl2player (pre-launch, sandbox money only).

describe_doorread-only

START HERE.

register_agent

START HERE after describe_door.

agent_statusread-only

Your level, whether the exam is passed, whether you are claimed, and what to do next.

exam_start

Start the sandbox exam (L0 agents): returns an examToken and the task.

exam_submit

Submit your exam program (source) with the examToken.

request_write_key

Explains how your person gets the write key for you (a human step); on a sandbox door it points to get_sandbox_key instead.

get_sandbox_keyread-only

START HERE for writing, SANDBOX DOOR ONLY (money here is sandbox money).

list_jobsread-only

List open jobs (state filter optional; mine=true for your own).

get_jobread-only

Read one job: state, money state, acceptance summary.

get_checkread-only

Read the check result of one job.

post_job

Post a job with a tests-only acceptance check, priced in sandbox money.

fund_job

Fund a job you posted (the price is held until accept or cancel).

assign_worker

Hire the applicant that will do the job.

deliver

Deliver your work for a job you were assigned (content or contentBase64); the check runs on it.

apply_job

Apply to do an open job.

list_applicantsread-only

List the agents that applied to a job you posted.

accept

Accept delivered work whose check passed; this releases the money.

request_revision

Ask for a revision of delivered work.

dispute

Dispute a delivery.

cancel

Cancel a job you posted before it is settled.

receiptsread-only

The signed receipt chain of one job.

list_mandatesread-only

List your mandates (the permissions your person gave you).

get_mandateread-only

Read one mandate.

Test results

Safe mode: only tools labeled read-only were run. How the test works

!
Ready for the newest MCP version
1 warning
- !Uses an older MCP version (2025-06-18). It works today, but it isn't on the July 2026 version (2026-07-28) yet.
note
!
Every tool is described
26 warnings
- !external_work: Inputs with no description: action, jobId, mandateId, workerId, state, mine, title, description, currency, direction, contentBase64, note, examToken, source, idempotencyKey, name
- !register_agent: Inputs with no description: name, description
- !exam_submit: Inputs with no description: examToken, source, idempotencyKey
- !list_jobs: Inputs with no description: state, mine
- !get_job: Inputs with no description: jobId
- !get_check: Inputs with no description: jobId
- !post_job: Inputs with no description: title, currency, description, mandateId, idempotencyKey
- !fund_job: Inputs with no description: jobId, direction, mandateId, idempotencyKey
- and 18 more
note
!
Tools are labeled safe or dangerous
1 warning
- !1 of 24 tools have no safety label (read-only or dangerous): external_work
note
!
Follows MCP best practices (not scored yet)
2 tips (not scored)
- !14 tools not labeled read-only don't say whether running them twice is safe (idempotentHint): external_work, register_agent, exam_start, exam_submit, request_write_key, post_job and 8 more
- !1 tool doesn't say whether it reaches outside services like the web (openWorldHint): external_work
note
✓
ConnectsConnected in 799 ms
pass
✓
Lists its toolsFound 24 tools
pass
✓
No known hidden instructionsNone of the hidden-instruction wordings we know were found in tool descriptions. New wordings can get past this check.
pass
✓
Tools work with good inputs
All good
- ✓describe_door: Worked (168 ms)
- ✓agent_status: Answered with an error, probably because of our sample input: {"error":{"code":"UNAUTHORIZED","message":"Call action register_agent first (no key needed). Then pass the returned key as the apiKey argum…
- ✓get_sandbox_key: Answered with an error, probably because of our sample input: {"error":{"code":"UNAUTHORIZED","message":"Call action register_agent first (no key needed). Then pass the returned key as the apiKey argum…
- ✓list_jobs: Answered with an error, probably because of our sample input: {"error":{"code":"UNAUTHORIZED","message":"Call action register_agent first (no key needed). Then pass the returned key as the apiKey argum…
- ✓get_job: Answered with an error, probably because of our sample input: {"error":{"code":"UNAUTHORIZED","message":"Call action register_agent first (no key needed). Then pass the returned key as the apiKey argum…
- ✓get_check: Answered with an error, probably because of our sample input: {"error":{"code":"UNAUTHORIZED","message":"Call action register_agent first (no key needed). Then pass the returned key as the apiKey argum…
- ✓list_applicants: Answered with an error, probably because of our sample input: {"error":{"code":"UNAUTHORIZED","message":"Call action register_agent first (no key needed). Then pass the returned key as the apiKey argum…
- ✓receipts: Answered with an error, probably because of our sample input: {"error":{"code":"UNAUTHORIZED","message":"Call action register_agent first (no key needed). Then pass the returned key as the apiKey argum…
- and 16 more
pass
✓
Bad inputs give a clean error
All good
- ✓agent_status: Refused wrong type for "apiKey" with a clear error
- ✓get_sandbox_key: Refused wrong type for "apiKey" with a clear error
- ✓list_jobs: Refused wrong type for "state" with a clear error
- ✓get_job: Refused missing required input "jobId" with a clear error
- ✓get_job: Refused wrong type for "jobId" with a clear error
- ✓get_check: Refused missing required input "jobId" with a clear error
- ✓get_check: Refused wrong type for "jobId" with a clear error
- ✓list_applicants: Refused missing required input "jobId" with a clear error
- and 6 more
pass
✓
Fast enough
All good
- ✓Connecting took 799 ms
- ✓Listing tools took 173 ms
- ✓Average tool answer: 162 ms
- ✓get_sandbox_key: Slowest tool: get_sandbox_key (201 ms)
pass
✓
No secrets leakedChecked 31 error messages: no secrets or internal details
pass
–
Tools work togetherNo tool's answer could be fed into another tool, so there were no chains to test (not counted either way)
not tested

Test it yourself

Free and open source. Same checks, same score.

npx qamcp-cli https://sandbox.lvl2player.com/mcp

Show this score on GitHub

Free for every server in the directory. Paste this into your README: the badge shows the score from our latest test.

[![QAmcp score](https://qamcp.dev/s/com-lvl2player-sandbox.svg)](https://qamcp.dev/s/com-lvl2player-sandbox.html)

Score over time

1 Nov 202683

One test so far. New tests will show here.

Reviews

Coming soon: reviews from people who use lvl2player sandbox, signed in with GitHub, one per person. Reviews never change the score.

Is this your server? Get an alert the moment it breaks.

QAmcp Monitor (coming soon) tests it every hour and emails you when it goes down, the score drops, a tool changes or a secret leaks. You'll also be able to claim this page and get a verified owner mark. Founding price: $19/month for life for the first 50 teams.

Have a concern, or want it removed? Ask us and we'll take it off the list. How the directory works