coordinalo

Findings 209

Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.

• Hidden instructions in a tool description

  tool: lifecycle_history

  criticalMCP03

  A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").

  in-scoped keys. IMPORTANT: backfilled sc_resolved timestamps do NOT emit s

  tool-description-injection-markersTool poisoning-40

  RecommendationRemove model-directed instructions from tool descriptions.

• Tool input schema requests a secret

  tool: dunning_get_config

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: admin_list_providers

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  before calling admin_set_availability. The org owner is auto-provisioned as a provide

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: admin_list_providers

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: admin_create_service

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  ble. Next step: admin_set_availability to configure the provider schedule. Requires X-

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: admin_create_service

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: admin_set_availability

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  providerId from admin_list_providers first. Schedule uses day names and HH:MM times.

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: admin_set_availability

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: admin_toggle_discoverable

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: availability_get_slots

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  ils. Use before booking_create.

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: availability_get_slots

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: availability_get_provider_schedule

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  iguration). Use admin_set_availability to modify.

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: availability_get_provider_schedule

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: booking_create

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  parameter "notes"

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Cross-tool shadowing

  tool: booking_create

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  ate first). Use availability_get_slots to find valid time slots before calling this. S

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Metadata dictates tool-call ordering

  tool: booking_create

  highMCP06

  The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.

  ive, (2) client must exist (use client_create first). Use availability_get_slots to find valid time

  toxic-flow-orderingToxic flow / tool-call ordering-25

  RecommendationTool metadata must describe only the tool, never sequence the agent’s calls.

• Tool input schema requests a secret

  tool: booking_create

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: booking_get

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: booking_list

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: booking_cancel

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: booking_reschedule

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: booking_update_status

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  parameter "notes"

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: booking_update_status

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: booking_create_recurring

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  parameter "notes"

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: booking_create_recurring

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: booking_list_requests

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  Read-only. Use booking_resolve_request to approve or reject one.

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: booking_list_requests

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: booking_resolve_request

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: client_list

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: client_get

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: client_create

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  parameter "notes"

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: client_create

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: client_update

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  parameter "notes"

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: client_update

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: service_create

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  (requires X-Org-Api-Key). For initial org setup, prefer admin_create_se

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Cross-tool shadowing

  tool: service_create

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  g setup, prefer admin_create_service instead. After creating, use service_assign_pro

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: service_create

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: service_list

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: service_update

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  ocumented — see service_create for semantics) and qualityCapture (1–5 rating o

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: service_update

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: service_assign_provider

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: provider_get

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: provider_create

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: provider_update

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: provider_get_stats

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: finance_list_cobros

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  "maximum":100},"apiKey":{"type":"string"}},"required":["orgSlug"]}

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: finance_list_cobros

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: finance_get_cobro

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: finance_register_payment

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: finance_client_balance

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: finance_list_payments

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  "maximum":100},"apiKey":{"type":"string"}},"required":["orgSlug"]}

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: finance_list_payments

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: finance_list_ventas

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: finance_create_venta

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: finance_create_cobro

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: finance_aging

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  ype":"string"},"apiKey":{"type":"string"}},"required":["orgSlug"]}

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: finance_aging

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: finance_list_confirmations

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: finance_send_confirmations

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  es confirmation tokens and sets a grace period for auto-confirmation.

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: finance_send_confirmations

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: finance_list_gastos

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  y — complements finance_list_cobros/finance_list_payments (income side) to complete

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: finance_list_gastos

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: finance_list_invoices

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: comms_get_preferences

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: comms_update_preferences

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: comms_list_campaigns

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: comms_get_campaign

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: comms_send_message

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  pe":"boolean"},"apiKey":{"type":"string"}},"required":["orgSlug","clie

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: comms_send_message

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: comms_render_message

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  ype":"string"},"apiKey":{"type":"string"},"template":{"type":"string",

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: comms_render_message

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: comms_create_campaign

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  ype":"string"},"apiKey":{"type":"string"},"name":{"type":"string","min

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Cross-tool shadowing

  tool: comms_create_campaign

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  as draft — use comms_send_campaign to execute. Requires confirm: true.

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: comms_create_campaign

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: comms_send_campaign

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  ype":"string"},"apiKey":{"type":"string"},"campaignId":{"type":"string

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Cross-tool shadowing

  tool: comms_send_campaign

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  mediately — use comms_get_campaign to track progress (sent/delivered/opened/clicke

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: comms_send_campaign

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: comms_list_audiences

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  pe":"boolean"},"apiKey":{"type":"string"}},"required":["orgSlug"]}

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Cross-tool shadowing

  tool: comms_list_audiences

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  ly — use before comms_create_campaign to pick a target audience.

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: comms_list_audiences

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: org_summary

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  — cheaper than report_dashboard. If onboarding_status.ready is false, follow th

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: org_summary

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: report_occupancy

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: report_revenue

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: report_sc_summary

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: report_no_shows

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  "maximum":100},"apiKey":{"type":"string"}},"required":["orgSlug"]}

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: report_no_shows

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: report_deuda_real

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  ype":"string"},"apiKey":{"type":"string"}},"required":["orgSlug"]}

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: report_deuda_real

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: report_dashboard

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: agendas_list

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: agendas_get

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  unt. Use before agendas_update to inspect current settings.

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: agendas_get

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: agendas_create

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: agendas_update

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: agendas_delete

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: disputes_list

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: delivery_confirmations_list

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: members_list

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: members_invite

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  pe":"boolean"},"apiKey":{"type":"string"}},"required":["orgSlug","emai

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: members_invite

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: org_update

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: email_domain_get

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  configured. Use email_domain_register to set one up.

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: email_domain_get

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: email_domain_register

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  S records, call email_domain_verify to check status.

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: email_domain_register

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: email_domain_verify

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  ype":"string"},"apiKey":{"type":"string"}},"required":["orgSlug"]}

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: email_domain_verify

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: email_domain_delete

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: cierre_preview_cliente

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: cierre_crear_cliente

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: cierre_listar_clientes

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: cierre_eliminar_cliente

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: cierre_evaluar_org

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: cierre_cerrar_org

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: cierre_distribuir_utilidades

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: cierre_listar_utilidades

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: payroll_list_records

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: payroll_get_summary

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: settings_get

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: settings_update

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  d chapters. See settings_get for available keys, valid values and dependenci

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: settings_update

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: reminders_get_config

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  ype":"string"},"apiKey":{"type":"string"}},"required":["orgSlug"]}

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Cross-tool shadowing

  tool: reminders_get_config

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  e granular than settings_get reminders chapter.

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: reminders_get_config

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: reminders_update_config

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: portal_session_confirm

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  dmin confirm in booking_update_status. Idempotent: a session already confirmed return

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: portal_session_confirm

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: portal_session_cancel

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: portal_propose_reschedule

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  e proposer. Use booking_list_requests to track pending requests.

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: portal_propose_reschedule

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: portal_report_session

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  axLength":500},"apiKey":{"type":"string"}},"required":["orgSlug","sess

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: portal_report_session

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: portal_confirm_delivery

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: portal_cancel_reschedule_request

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  a conflict. Use booking_list_requests to find pending requests; use booking_resolve_r

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: portal_cancel_reschedule_request

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: session_note_upsert

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: session_note_get

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: resources_list

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: treatment_plans_list

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: treatment_plans_get

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: lifecycle_get_state

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: lifecycle_history

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  ion status, use lifecycle_get_state.sc_resolution. Requires X-Org-Api-Key.

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: lifecycle_history

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: lifecycle_transition

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  parameter "notes"

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Tool input schema requests a secret

  tool: lifecycle_transition

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: scheduling_confirm

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  tion token from scheduling_book, no API key needed; (2) with booking_id — uses

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: scheduling_confirm

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "credential"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Data-exfiltration parameters

  tool: scheduling_book

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  parameter "notes"

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Cross-tool shadowing

  tool: scheduling_book

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  booking_id. Use scheduling_confirm with the credential to finalize. Does NOT requi

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Cross-tool shadowing

  tool: scheduling_cancel

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  the charge, use booking_cancel instead. Requires confirm: true and X-Org-Api-K

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Tool input schema requests a secret

  tool: scheduling_cancel

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Tool input schema requests a secret

  tool: scheduling_reschedule

  highMCP01

  The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)

  parameter "apiKey"

  sensitive-param-requiredToken passthrough / credential capture-20

  RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.

• Cross-tool shadowing

  tool: public_availability_get_slots

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  time. Use after public_service_list to find bookable times.

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Data-exfiltration parameters

  tool: public_booking_create

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  parameter "notes"

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Cross-tool shadowing

  tool: public_booking_create

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  sion codes. Use public_service_list → public_availability_get_slots → public_bookin

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Cross-tool shadowing

  tool: public_booking_confirm

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  ken returned by public_booking_create. Advances the booking from pending_confirmation

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Cross-tool shadowing

  tool: public_booking_get

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  ken returned by public_booking_create. Returns status, scheduled time, service, and r

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• Data-exfiltration parameters

  tool: public_booking_cancel

  highMCP10

  A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.

  NOT require an API key. The booking token scopes access to a single bo

  exfiltration-paramsContext injection & over-sharing-25

  RecommendationRemove side-channel parameters; constrain tool inputs.

• Cross-tool shadowing

  tool: (server instructions)

  highMCP09

  A tool description tries to alter the model’s use of another tool.

  le provider) 3. admin_list_providers → get provider IDs (org owner is auto-provision

  tool-shadowingCross-server / shadowing-25

  RecommendationDescriptions must describe only their own tool.

• No authorization on a public remote server

  highMCP07

  The server accepts tool enumeration (and likely invocation) with no authentication.

  auth-none-on-public-remoteAuthorization-40

  RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.

• Over-broad tool surface

  tool: dunning_configure

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "dunning_configure"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: admin_set_availability

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "admin_set_availability"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: admin_toggle_discoverable

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "admin_toggle_discoverable"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: availability_get_slots

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "availability_get_slots"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: availability_get_provider_schedule

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "availability_get_provider_schedule"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: booking_create

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "booking_create"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: booking_cancel

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "booking_cancel"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: booking_reschedule

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "booking_reschedule"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: booking_update_status

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "booking_update_status"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: booking_create_recurring

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "booking_create_recurring"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: booking_list_requests

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "booking_list_requests"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: client_create

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "client_create"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: client_update

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "client_update"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: service_create

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "service_create"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: service_update

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "service_update"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: provider_create

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "provider_create"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: provider_update

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "provider_update"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: finance_register_payment

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "finance_register_payment"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: finance_create_venta

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "finance_create_venta"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: finance_create_cobro

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "finance_create_cobro"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: finance_send_confirmations

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "finance_send_confirmations"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: comms_update_preferences

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "comms_update_preferences"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: comms_send_message

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "comms_send_message"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: comms_render_message

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "comms_render_message"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: comms_create_campaign

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "comms_create_campaign"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: comms_send_campaign

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "comms_send_campaign"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: comms_list_audiences

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "comms_list_audiences"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: agendas_create

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "agendas_create"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: agendas_update

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "agendas_update"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: agendas_delete

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "agendas_delete"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: members_invite

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "members_invite"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: org_update

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "org_update"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: email_domain_get

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "email_domain_get"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: email_domain_verify

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "email_domain_verify"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: email_domain_delete

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "email_domain_delete"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: cierre_crear_cliente

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "cierre_crear_cliente"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: cierre_eliminar_cliente

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "cierre_eliminar_cliente"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: settings_update

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "settings_update"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: reminders_get_config

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "reminders_get_config"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: reminders_update_config

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "reminders_update_config"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: portal_report_session

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "portal_report_session"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: portal_confirm_delivery

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "portal_confirm_delivery"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: session_note_upsert

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "session_note_upsert"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: lifecycle_transition

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "lifecycle_transition"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: scheduling_cancel

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "scheduling_cancel"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: scheduling_reschedule

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "scheduling_reschedule"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: public_booking_create

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "public_booking_create"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

• Over-broad tool surface

  tool: public_booking_reschedule

  mediumMCP05

  The server advertises open-world / broadly-scoped capabilities.

  no annotations on write-capable tool "public_booking_reschedule"

  excessive-permissionsPrivilege escalation-10

  RecommendationScope tools to the minimum needed.

Scan history

1. 8/23/2026F0/100111 tools

• D

  vantaj

  Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.

  /mcp-servers/vantajOpen
• D

  TKAWEN Intelligence Gateway

  Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.

  /mcp-servers/tkawen-intelligence-gatewayOpen
• D

  Imperium Manifold MCP

  Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.

  /mcp-servers/imperium-manifold-mcpOpen
• D

  wever-labs-service-resolver

  Agentic rails for complex workflows with receipts, fees, and MCP tool access.

  /mcp-servers/wever-labs-service-resolverOpen
• D

  tc39-mcp

  Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.

  /mcp-servers/tc39-mcp-2Open
• D

  tc39-mcp

  Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.

  /mcp-servers/tc39-mcpOpen