Detected by Squatch rules from the server's metadata and protocol behavior. Latest completed scan: .
The tool's display title describes a lower-impact action than its name (for example a read title on a delete tool).
First seen · Last seen
Suggested fix: Make the title describe the same action as the tool name.
The server's instructions field contains directives addressed to the AI model beyond describing how to use the server.
First seen · Last seen
Suggested fix: Limit server instructions to usage guidance for this server's own tools.
Model-facing text instructs the AI model to hide actions or information from the user.
First seen · Last seen
Suggested fix: Remove any wording that asks the model to act silently or withhold information from the user.
The remote server lists state-changing tools without requiring authentication.
First seen · Last seen
Suggested fix: Require MCP authorization for servers that expose state-changing tools.
Model-facing text instructs the AI model to hide actions or information from the user.
First seen · Last seen
Suggested fix: Remove any wording that asks the model to act silently or withhold information from the user.
The tool's display title describes a lower-impact action than its name (for example a read title on a delete tool).
First seen · Last seen
Suggested fix: Make the title describe the same action as the tool name.
Model-facing text instructs the AI model to place conversation content, prompts, tool history or secrets into tool arguments or external destinations.
First seen · Last seen
Suggested fix: Do not ask the model to include conversation, prompt or credential content in arguments.
Model-facing text instructs the AI model to hide actions or information from the user.
First seen · Last seen
Suggested fix: Remove any wording that asks the model to act silently or withhold information from the user.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
Model-facing text gives the AI model instructions about tools that this server does not provide (tool shadowing).
First seen · Last seen
Suggested fix: Describe only this server's own tools.
The tool declares itself read-only, but its name or description indicates it changes, deletes or runs something. Clients that auto-approve read-only tools would run it without confirmation.
First seen · Last seen
Suggested fix: Set readOnlyHint to false and destructiveHint to reflect the tool's behavior.
Model-facing text instructs the AI model to place conversation content, prompts, tool history or secrets into tool arguments or external destinations.
First seen · Last seen
Suggested fix: Do not ask the model to include conversation, prompt or credential content in arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
Model-facing text gives the AI model instructions about tools that this server does not provide (tool shadowing).
First seen · Last seen
Suggested fix: Describe only this server's own tools.
Model-facing text instructs the AI model to place conversation content, prompts, tool history or secrets into tool arguments or external destinations.
First seen · Last seen
Suggested fix: Do not ask the model to include conversation, prompt or credential content in arguments.
Model-facing text is unusually long, which consumes context and leaves room to hide content.
First seen · Last seen
Suggested fix: Shorten descriptions; move long documentation out of model-facing fields.
The tool declares itself read-only, but its name or description indicates it changes, deletes or runs something. Clients that auto-approve read-only tools would run it without confirmation.
First seen · Last seen
Suggested fix: Set readOnlyHint to false and destructiveHint to reflect the tool's behavior.
Model-facing text instructs the AI model to hide actions or information from the user.
First seen · Last seen
Suggested fix: Remove any wording that asks the model to act silently or withhold information from the user.
The tool declares itself read-only, but its name or description indicates it changes, deletes or runs something. Clients that auto-approve read-only tools would run it without confirmation.
First seen · Last seen
Suggested fix: Set readOnlyHint to false and destructiveHint to reflect the tool's behavior.
The tool declares itself read-only, but its name or description indicates it changes, deletes or runs something. Clients that auto-approve read-only tools would run it without confirmation.
First seen · Last seen
Suggested fix: Set readOnlyHint to false and destructiveHint to reflect the tool's behavior.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
Model-facing text gives the AI model instructions about tools that this server does not provide (tool shadowing).
First seen · Last seen
Suggested fix: Describe only this server's own tools.
Model-facing text instructs the AI model to hide actions or information from the user.
First seen · Last seen
Suggested fix: Remove any wording that asks the model to act silently or withhold information from the user.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
The server failed one or more MCP protocol conformance checks.
First seen · Last seen
Suggested fix: Review the failed checks against the MCP specification.
A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.
First seen · Last seen
Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.
Model-facing text gives the AI model instructions about tools that this server does not provide (tool shadowing).
First seen · Last seen
Suggested fix: Describe only this server's own tools.
Model-facing text gives the AI model instructions about tools that this server does not provide (tool shadowing).
First seen · Last seen
Suggested fix: Describe only this server's own tools.
The tool's name and description do not state what it does.
First seen · Last seen
Suggested fix: Describe the action the tool performs, its target and its side effects.
The tool's name and description do not state what it does.
First seen · Last seen
Suggested fix: Describe the action the tool performs, its target and its side effects.
The tool's name and description do not state what it does.
First seen · Last seen
Suggested fix: Describe the action the tool performs, its target and its side effects.
A prompt's description or arguments contain instructions addressed to the AI model.
First seen · Last seen
Suggested fix: Describe prompts neutrally.
Model-facing text gives the AI model instructions about tools that this server does not provide (tool shadowing).
First seen · Last seen
Suggested fix: Describe only this server's own tools.
The tool declares itself read-only, but its name or description indicates it changes, deletes or runs something. Clients that auto-approve read-only tools would run it without confirmation.
First seen · Last seen
Suggested fix: Set readOnlyHint to false and destructiveHint to reflect the tool's behavior.
Model-facing text gives the AI model instructions about tools that this server does not provide (tool shadowing).
First seen · Last seen
Suggested fix: Describe only this server's own tools.
The tool declares itself read-only, but its name or description indicates it changes, deletes or runs something. Clients that auto-approve read-only tools would run it without confirmation.
First seen · Last seen
Suggested fix: Set readOnlyHint to false and destructiveHint to reflect the tool's behavior.
A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.
First seen · Last seen
Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.
A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.
First seen · Last seen
Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.
The tool declares itself read-only, but its name or description indicates it changes, deletes or runs something. Clients that auto-approve read-only tools would run it without confirmation.
First seen · Last seen
Suggested fix: Set readOnlyHint to false and destructiveHint to reflect the tool's behavior.
Model-facing text gives the AI model instructions about tools that this server does not provide (tool shadowing).
First seen · Last seen
Suggested fix: Describe only this server's own tools.
The tool's name and description do not state what it does.
First seen · Last seen
Suggested fix: Describe the action the tool performs, its target and its side effects.
A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.
First seen · Last seen
Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.
A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.
First seen · Last seen
Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.
A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.
First seen · Last seen
Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.
Model-facing text instructs the AI model to hide actions or information from the user.
First seen · Last seen
Suggested fix: Remove any wording that asks the model to act silently or withhold information from the user.
Model-facing text instructs the AI model to hide actions or information from the user.
First seen · Last seen
Suggested fix: Remove any wording that asks the model to act silently or withhold information from the user.
A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.
First seen · Last seen
Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.
Some tools, resources or prompts returned by the server do not match the MCP schema.
First seen · Last seen
Suggested fix: Return items that validate against the MCP schema.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.
A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.
First seen · Last seen
Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.