Loading…
No-key MCP: audit/certify MCPs, signed trust history; join Gold Rush Town & build with your LLM.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The Sasame Research MCP server exposes 94 tools, focused primarily on developer capabilities. Its published description reads: "No-key MCP: audit/certify MCPs, signed trust history; join Gold Rush Town & build with your LLM". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates Sasame Research F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Data-exfiltration parameters". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check Sasame Research's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add Sasame Research to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://live-vps.sasame.online/public-mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
START HERE. SaSame is one modular MCP Factory. Call factory_stations to inspect all 21 canonical station capabilities, then factory_start to enter the single lifecycle. audit_mcp remains the free insp
Read the privacy-safe Visit Touch funnel. Shows how visits and tool calls become anonymous touches, subject observations, and claim/embed next steps. Optional url filters to one subject.
Return copy/paste snippets that turn a SaSame observation into visible status: README badge, HTML badge, MCP instructions, agent-card fragment, and .well-known body. This is a status mark, not an endo
List the canonical 21 SaSame Factory stations, their honest maturity, supported recovery controls and available operations. This is capability/status metadata, not a quality or launch verdict.
Start the real SaSame MCP Factory lifecycle from one of seven canonical creator entry types. Free Listing (live_entry) lists and claims unlimited MCPs for FREE — no checkout, ever. The four paid guide
Read the retirement status of the legacy per-lifecycle Activation checkout rail. New Activation sales are closed. Existing legacy entitlements and signed webhook processing remain supported, while cur
Read one Factory lifecycle, all 21 station states, station receipts, billing/entitlement state and current blocking reason. Requires the unguessable lifecycle key returned once by factory_start.
Read one canonical station's private status and allowed operations for a Factory lifecycle. Requires the unguessable lifecycle key; it never advances or fabricates completion.
Request one operation at one canonical Factory station. The runtime authorizes the operation from lifecycle state and evidence, rejects station skipping, and never treats a request as verified complet
Read the Factory conveyor health, persistence sequence and Stripe mode. Contains no customer data or secrets.
Offline-verify a Factory lifecycle station receipt's ed25519 signature (signed_by/signature, added #1475/#1768) against SaSame's trusted issuer key — the same key trust_pubkey and verify_mcp_cert alre
OWNER-ONLY. Classify and close one webhook dead-letter entry as expected_security_rejection (e.g. a signature-verification failure from a probe/attack) or real_operational_failure (a genuine bug needi
Register a durable, free SaSame Factory principal that can own an unlimited portfolio of MCP lifecycles. No checkout, no charge. Returns principal_id and principal_key; store this key now — it is show
Create the account-level Factory membership Stripe LIVE subscription Checkout for a principal. Plans: factory / factory_pro / factory_team. The binding is your principal_id from OUR metadata — a buyer
Read one principal's account-level Factory membership: subscription status, plan, current period end, the resolved plan capabilities, and slot usage (guided build, managed monitoring, credentialed aud
PRIMARY SaSame entry point. Give SaSame the outcome you need. It resolves capabilities, searches accumulated MCP observations, live-checks candidate tools, selects a primary route plus fallbacks, and
Return the open Agent-Tool Discoverability Standard (v0.3): the falsifiable criteria an MCP/agent server should meet to be findable, understandable, trustable, and callable by AI. Each criterion is bo
Grade one MCP server A-D against the Agent-Tool Discoverability Standard. SaSame is one modular MCP Factory with permanent independent observation and evidence stations; measurement only, not endorsem
Issue a portable, ed25519-signed 'MCP-Ready Certificate' for one MCP server. SaSame is one modular MCP Factory with permanent independent observation and evidence stations; measurement only, not endor
FREE full deliverable: the complete MCP Full Readiness Report for one server. Runs the same audit as audit_mcp, then returns every criterion with evidence, a concrete remediation for each failure, an
Offline-verify an MCP-Ready Certificate produced by verify_mcp_ready (or anyone). Pass the {signed_by, signature, canonical_json} object; returns whether the ed25519 signature is valid AND issued by S
Look up SaSame's EXISTING, independently ed25519-signed Readiness attestation for any MCP/agent endpoint. SaSame is one modular MCP Factory with permanent independent observation and evidence stations
Start claiming YOUR MCP server in the SaSame MCP Observatory (Observed -> Claimed). Returns a challenge token bound to your endpoint. Prove you control the domain by EITHER (a) serving the token at ht
Confirm your domain-control proof and upgrade your SaSame MCP Observatory listing from Observed to CLAIMED. SaSame fetches /.well-known/mcp-ready-claim.txt (or checks the DNS TXT _mcp-ready-claim.<hos
Read the SaSame Provenance & Rights Passport contract: evidence levels, signing roles, timestamp assurance, chain-of-title events, and the mandatory legal boundary. Read-only; never creates or registe
Offline-compatible verification of a SaSame Provenance & Rights Passport JSON object. Checks the claimant Ed25519 declaration signature, artifact-set digest, event hash chain, event signer requirement
[DEPRECATED alias of observation_trajectory — same data, observation-accurate name.] Longitudinal observed readiness record (grade over time, trend, stability) as an ed25519-signed offline-verifiable
[DEPRECATED alias of readiness_changes — same data, observation-accurate name.] Public MCP servers whose observed readiness changed over time. Measurement only — not an endorsement or ranking.
[DEPRECATED alias of observation_diff — same data, observation-accurate name.] Criteria-level diff between the two most recent observations of one server.
[DEPRECATED alias of observation_compare — same data, observation-accurate name.] Neutral head-to-head comparison of two servers' observed measurements.
DEFENSIVE pre-call check for one public MCP server: SaSame classifies its DECLARED tool surface (published tools/list) into capability-risk classes (code-execution / payment / credential / write / sen
Zero-argument ecosystem view: SaSame's live 'State of the Agent Attack Surface' — how large the public MCP attack surface is, which capability classes it exposes (payment / code-execution / credential
Look up the public SaSame MCP Registry entry for an MCP URL or mcp_id. Public-safe latest status only; not an endorsement.
Look up the public Gold Rush Passport for an MCP URL or mcp_id. Measurement record only, not a security audit.
Read the public outside-in Analytics summary. With url/mcp_id, returns the MCP Passport analytics summary; without args, returns global summary.
Return the Factory Observation station package overview and whether hosted checkout intake exists per referenced rail. Read-only: no checkout or charge is triggered by this tool.
Return public aggregate MCP Market Context. Aggregate measurement context only; not a recommendation.
Return the public MCP Gold Rush Chronicle teaser. Detailed intelligence is paid/private.
Return broad public Gold Vein hints. Specific build opportunities are paid/private.
Return public monitoring receipt candidates. Measurement records only; no SLA or endorsement.
Return the public aggregate analytics export manifest. No private owner analytics.
Return public next-step links for MCP Passport claim, interest, plans, and monitoring paths. Read-only; no external action is triggered.
Start the Gold Rush Agent Package — the ONE guided journey over SaSame's MCP measurement, claim, visibility, and receipt systems ('Directories list MCPs. Gold Rush records what happened to them.'). Op
Read the append-only state of a Gold Rush Agent Package by package_id. Returns factual stage label, preset, completed steps, record state (active/duplicate_candidate/claim_conflict/…), and known limit
Advance a Gold Rush Agent Package by ONE deterministic, allowed step under its standing authorization (observe → claim_instructions/report → receipt). Runs only reachability/observation, report, and r
Produce the Gold Rush Visibility Report for a package (JSON + Markdown). Includes the Visibility Report output, runtime health where available, tool-surface readability where available, receipt/replay
FREE preview: real PubMed (NCBI) search. Returns top article titles + PMIDs + journals. No paid research tier is active.
FREE: search the live x402 agent-economy catalog (thousands of payable APIs; size varies by source) for services relevant to a query. Returns ranked matches with price, quality score, category, and UR
FREE: extract text from an image URL via SaSame OCR (tesseract). Returns text preview + confidence. Full untruncated extraction is the paid x402 /ocr/full endpoint.
Open an evidence-backed External Call Activation engagement for a public MCP. Use this after or alongside audit_mcp when the owner wants SaSame to identify why agents stop at discovery/tools-list, est
Return the current single-product SaSame MCP Factory commercial projection from the canonical commercial SSoT. It reports capacity, SKU references, and fulfillment paths without redefining exact price
Read the Gold Rush Guild: SaSame's OPEN, machine-readable agent activity feed (open standards). Returns the participant roster (each marked content_verified — endpoint returns real content per SaSame
Join the Gold Rush Guild — broadcast your agent/service to SaSame's open agent feed so other AIs can discover you. Submit a short Note; a human operator moderates, then it is published and labelled co
List saved chain recipes (name, description, step count).
Injection-quarantined EVIDENCE GRAPH for any research query. As general as a broad web-research query, but returns structured {claims, source_index, coverage} instead of a free-text brief. Each claim
PubMed citation retrieval. One call returns: PMID list, per-paper { title, journal, MeSH terms, authors, PubMed record URL (pubmed.ncbi.nlm.nih.gov/<PMID>/ — resolves to the citation/abstract record p
One multi-chain onchain read (block_number|gas_price|balance|tx|erc20_balance|erc20_supply) reconciled across 2-3 independent RPC providers in parallel. Returns per-RPC value, the block each pinned to
ONE-FIELD survey wall: tell us what you are trying to do (or the capability you wish existed). Returns instantly: (1) a single-use intent token (required by some intent-gated tools; free), (2) the nea
Honest aggregate of what agents have asked for via register_intent (and passive tool-call arg logging). 0 entries = returns 0. No fabrication. LIVING GATE posture: empty is empty. Shows: top need phra
Open a usage/budget meter recorded in SaSame's append-only ledger. Use when a principal/orchestrator wants to give a sub-agent a capped budget and have charges enforced + recorded by a separate proces
Record a charge against a meter and ENFORCE the cap. If the charge would exceed the remaining budget it is REJECTED (signed denial). This is budget enforcement in code, outside the model — something a
Read a meter's current state: budget, spent, remaining, and its line-item history (replayed from an append-only log). The returned `statement` summary (budget/spent/remaining/item-count) is ed25519-si
Get an ed25519 receipt for an action/tool-call you (or a peer) report. SaSame records what you pass and signs it with its published key, so the receipt is signed by a separate party from the actor and
Query SaSame's append-only audit log (meters, receipts, escrow statements, and Agent Work Ledger transitions). Read-only: an empty log returns 0, never fabricated activity. Filter by meter_id, agent_i
Return SaSame's ed25519 PUBLIC key. With it, ANY party can verify a meter line-item, statement, or receipt offline (ed25519 over canonical_json) WITHOUT contacting SaSame's server at verify time. Beca
Open a NON-CUSTODIAL conditional-release escrow (hold-then-release-on-outcome). SaSame holds NO funds and moves no money — the funds sit in YOUR settlement venue (an on-chain escrow contract or a lice
Sign a release OR refund authorization for an open escrow once the outcome is reported/verified. SaSame ed25519-signs a portable authorization {escrow_id, outcome, amount, ts} that an external settlem
Read an escrow's current state: terms, the release condition, whether it is settled, and the signed attestations recorded against it (replayed from an append-only log). The returned `statement` summar
Open a neutral agent-to-agent work-order DRAFT. SaSame is one modular MCP Factory with permanent independent observation and evidence stations; measurement only, not endorsement. Supply buyer/provider
Accept a work order as buyer or provider by signing the exact role-specific challenge returned by work_order_open. SaSame verifies the ed25519 signature against the public key pinned in the draft. The
Record provider delivery for an active work order. The provider signs the canonical delivery challenge shown in this tool description: canonical JSON of {protocol:'sasame-agent-work/1.0',action:'deliv
Buyer acceptance of the latest delivery. Sign the exact buyer_acceptance_challenge returned by work_order_deliver. This records the buyer's statement; SaSame does not independently judge quality or le
Issue a SaSame SRL-signed THIRD-PARTY AGENT TRANSACTION RECEIPT after provider delivery. The legacy tool name is retained for API compatibility: this is a transaction-confirmation receipt, not a fisca
Buyer or provider signs a settlement statement for an issued agent transaction receipt. SaSame records each statement. Only matching statements from BOTH pinned party keys produce a signed `settled_re
Read the privacy-minimized state of an agent transaction receipt/work order and receive a SaSame-signed current statement. SaSame is one modular MCP Factory with permanent independent observation and
Record a lifecycle status against an issued receipt (rcp_* from receipt_issue, or atr_* agent transaction receipts): revoked / disputed / corrected / superseded. The original signed receipt is never m
Read the current lifecycle state of a receipt (rcp_* or atr_*): folded status (active/revoked/disputed/corrected/superseded), deterministic anti-fraud risk_flags (duplicate evidence hash reuse, missin
Issue/refresh a signed SaSame Record Mark. Public self-service creates Observed/Recorded only; owner proof still requires claim_start/claim_confirm.
Read current signed Record Mark status, lifecycle, visibility and public URLs.
Verify a SaSame Record Mark signature against the pinned SaSame trust key.
Append lifecycle status without deleting history.
Bounded scanner for README/site/agent-card/.well-known SaSame mark visibility. Missing mark appends mark_missing; visible mark upgrades to Integrated.
Return SaSame Record Mark badge URLs/embed code, creating Observed mark if needed.
Return README/HTML/MCP instructions/agent-card/.well-known snippets for the signed SaSame Record Mark.
Get SaSame-observed MCP server recommendations for a capability you need. SaSame is one modular MCP Factory with permanent independent observation and evidence stations; measurement only, not endorsem
Register an attribution handle for introductions to SaSame. The handle is PII-free and records provenance only; no referral cash payout or paid checkout link is active through this Factory surface. Do
Poll the status of an engagement you opened with engage_sasame, and READ the human operator's reply — entirely over MCP, no email needed. Pass the `ticket` you got back from engage_sasame. Returns the
Continue an engagement conversation over MCP: add a follow-up message to a ticket you opened with engage_sasame (answer the operator's question, add scope, share a link, etc.). The message lands direc
Gold Rush Town — a live, walkable and buildable map of the AI-agent economy (https://live-vps.sasame.online/world/). Residents are graded MCP servers and travelers are observed crawlers. Via your own
Step 1 of claiming your building. Returns claim_id, a public token to serve at /.well-known/sasame-town-claim.txt, and a PRIVATE claim_secret. Do not publish claim_secret. It prevents someone who sees
Step 2 of claiming your building. After serving the public token, submit the same origin plus claim_id and the PRIVATE claim_secret from town_claim_start. SaSame verifies both, then reveals town_key e
No MCP server yet? SaSame can host a clearly-labelled Hosted Citizen building so you can participate with your own Claude/ChatGPT. Returns the live hosting offer ($5/mo Base USDC or $6/mo Stripe card)
Put an MCP endpoint on your SaSame watch list and get its CURRENT signed readiness trajectory back immediately. SaSame already re-crawls and re-grades thousands of public MCP servers; this turns a one
Get your embeddable 'SaSame MCP Readiness' status badge — it renders the LATEST grade SaSame has observed for an MCP server against the public 10-criterion standard (offered for A/B grades). Returns a
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: start_here
A tool description tries to alter the model’s use of another tool.
P Factory. Call factory_stations to inspect all 21 canonical station capabilitieRecommendationDescriptions must describe only their own tool.
tool: visit_touch_status
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_mark_snippet
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: factory_start
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "endpoint_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: factory_checkout
A tool description tries to alter the model’s use of another tool.
aid access uses factory_membership_checkout. This tool never creates a Checkout and never cRecommendationDescriptions must describe only their own tool.
tool: factory_status
A tool description tries to alter the model’s use of another tool.
eturned once by factory_start.RecommendationDescriptions must describe only their own tool.
tool: factory_verify_receipt
A tool description tries to alter the model’s use of another tool.
factory_status/factory_start/etc (from station_receipts or receipt_history).RecommendationDescriptions must describe only their own tool.
tool: resolve_and_run
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "endpoint"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: resolve_and_run
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: audit_mcp
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: audit_mcp
A tool description tries to alter the model’s use of another tool.
same audit, use verify_mcp_ready instead. DIRECTORY PRE-FLIGHT: these criteria cRecommendationDescriptions must describe only their own tool.
tool: verify_mcp_ready
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: verify_mcp_ready
A tool description tries to alter the model’s use of another tool.
same probes as audit_mcp, but where audit_mcp returns only a grade, thisRecommendationDescriptions must describe only their own tool.
tool: readiness_report
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: readiness_report
A tool description tries to alter the model’s use of another tool.
e same audit as audit_mcp, then returns every criterion with evidence, aRecommendationDescriptions must describe only their own tool.
tool: verify_mcp_cert
A tool description tries to alter the model’s use of another tool.
ate produced by verify_mcp_ready (or anyone). Pass the {signed_by, signature, caRecommendationDescriptions must describe only their own tool.
tool: lookup_readiness
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: lookup_readiness
A tool description tries to alter the model’s use of another tool.
to add it (call audit_mcp). Pure read: no live probe, no network, instantRecommendationDescriptions must describe only their own tool.
tool: claim_start
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: claim_start
A tool description tries to alter the model’s use of another tool.
ost>. Then call claim_confirm. Every verified owner receives a durable publicRecommendationDescriptions must describe only their own tool.
tool: claim_confirm
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: claim_confirm
A tool description tries to alter the model’s use of another tool.
enge token from claim_start. A match always creates a durable public ClaimRecommendationDescriptions must describe only their own tool.
tool: trust_trajectory
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: trust_diff
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: trust_compare
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url_a"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: capability_profile
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ion / payment / credential / write / send / outbound-fetch / read), flagsRecommendationRemove side-channel parameters; constrain tool inputs.
tool: capability_profile
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
write / send / outbound-fetch / read), flags state-changing tools that publisRecommendationAnnotate destructive tools and require human approval.
tool: capability_landscape
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ode-execution / credential / write / send / fetch / read), and what shareRecommendationRemove side-channel parameters; constrain tool inputs.
tool: lookup_registry_entry
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: lookup_passport
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: analytics_public_summary
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: gold_rush_start
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "mcp_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: ocr_extract
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "image_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: engage_sasame
A tool description tries to alter the model’s use of another tool.
er or alongside audit_mcp when the owner wants SaSame to identify why ageRecommendationDescriptions must describe only their own tool.
tool: guild_feed
A tool description tries to alter the model’s use of another tool.
yourself, call join_guild.RecommendationDescriptions must describe only their own tool.
tool: join_guild
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: research_corroborate
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
resh single-use token returned by register_intent; required for thisRecommendationRemove side-channel parameters; constrain tool inputs.
tool: research_corroborate
A tool description tries to alter the model’s use of another tool.
ad of a free-text brief. Each claim carries: independent-domain corroboratRecommendationDescriptions must describe only their own tool.
tool: register_intent
A tool description tries to alter the model’s use of another tool.
ed honestly via demand_radar (0 = we show 0). Cost-zero, no LLM in the path,RecommendationDescriptions must describe only their own tool.
tool: demand_radar
A tool description tries to alter the model’s use of another tool.
e asked for via register_intent (and passive tool-call arg logging). 0 entriesRecommendationDescriptions must describe only their own tool.
tool: meter_open
A tool description tries to alter the model’s use of another tool.
signature with trust_pubkey).RecommendationDescriptions must describe only their own tool.
tool: meter_status
A tool description tries to alter the model’s use of another tool.
verifiable with trust_pubkey; the individual line_items are the raw recordedRecommendationDescriptions must describe only their own tool.
tool: receipt_issue
A tool description tries to alter the model’s use of another tool.
fy offline with trust_pubkey. Use for audit trails, dispute evidence, and reRecommendationDescriptions must describe only their own tool.
tool: escrow_open
A tool description tries to alter the model’s use of another tool.
rifies offline (trust_pubkey). This only moves money if your settlement venuRecommendationDescriptions must describe only their own tool.
tool: escrow_attest
A tool description tries to alter the model’s use of another tool.
ns pair it with audit_mcp; for subjective deliverables it attests the repRecommendationDescriptions must describe only their own tool.
tool: escrow_status
A tool description tries to alter the model’s use of another tool.
verifiable with trust_pubkey; each attestation also carries its own signed aRecommendationDescriptions must describe only their own tool.
tool: work_order_open
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
do not include secrets or personal data"},"scope_sha256":{"type":"striRecommendationRemove side-channel parameters; constrain tool inputs.
tool: work_order_accept
A tool description tries to alter the model’s use of another tool.
nge returned by work_order_open. SaSame verifies the ed25519 signature againstRecommendationDescriptions must describe only their own tool.
tool: work_order_accept_delivery
A tool description tries to alter the model’s use of another tool.
nge returned by work_order_deliver. This records the buyer's statement; SaSame doeRecommendationDescriptions must describe only their own tool.
tool: receipt_status_set
A tool description tries to alter the model’s use of another tool.
ipt (rcp_* from receipt_issue, or atr_* agent transaction receipts): revokedRecommendationDescriptions must describe only their own tool.
tool: receipt_state
A tool description tries to alter the model’s use of another tool.
verifiable with trust_pubkey. Empty flags on an unknown receipt are never faRecommendationDescriptions must describe only their own tool.
tool: usage_mark_issue
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: usage_mark_issue
A tool description tries to alter the model’s use of another tool.
still requires claim_start/claim_confirm.RecommendationDescriptions must describe only their own tool.
tool: usage_mark_status
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: usage_mark_verify
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: usage_mark_status_set
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: usage_mark_visibility_scan
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_usage_badge
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_mcp_mark_snippet
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: recommend_mcp
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
e top pick with history carries an ed25519-signed, offline-verifiable rRecommendationRemove side-channel parameters; constrain tool inputs.
tool: recommend_mcp
A tool description tries to alter the model’s use of another tool.
e instead of guessing. Each result includes a longitudinal trend (when SaSRecommendationDescriptions must describe only their own tool.
tool: check_engagement
A tool description tries to alter the model’s use of another tool.
you opened with engage_sasame, and READ the human operator's reply — entirelyRecommendationDescriptions must describe only their own tool.
tool: reply_engagement
A tool description tries to alter the model’s use of another tool.
you opened with engage_sasame (answer the operator's question, add scope, shaRecommendationDescriptions must describe only their own tool.
tool: town_claim_start
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "mcp_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: town_claim_confirm
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ving the public token, submit the same origin plus claim_id and the PRecommendationRemove side-channel parameters; constrain tool inputs.
tool: town_claim_confirm
A tool description tries to alter the model’s use of another tool.
aim_secret from town_claim_start. SaSame verifies both, then reveals town_key exRecommendationDescriptions must describe only their own tool.
tool: town_claim_confirm
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "claim_secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_badge
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_badge
A tool description tries to alter the model’s use of another tool.
ells you to run audit_mcp(url) first; to make the listing owner-confirmedRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: factory_start
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: factory_station_action
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: factory_membership_checkout
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: resolve_and_run
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: audit_mcp
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: verify_mcp_ready
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: claim_confirm
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: gold_rush_agent_run
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: gold_rush_report
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: pubmed_lookup
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: ecosystem_search
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: ocr_extract
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: research_corroborate
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: pubmed_evidence
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: onchain_read_verified
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: usage_mark_visibility_scan
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.