MCP Bill of Materials
A machine-readable inventory of what this server exposes and depends on: tools with their effects, transports, packages, findings and provenance (schema version 1.0). Third-party text in it is escaped. Also available from the REST API at /api/v1/servers/19121a71-4b8b-4870-ae49-0aab60b32706/mcbom.
MCP Bill of Materials
root{21}
schema_version: "1.0"
bom_format: "squatch-mcbom"
generator{3}
name: "squatch-mcp"
classifier_version: "rules_v1@2026-10-11.1"
unicode_version: "18.0.0"
server{7}
name: "com.galleyrender/galley-render"
title: "Galley Render"
description: "JSON in, PDF out. Render invoices, certificates, reports and cards from a template and a payload."
version: "0.2.0"
homepage_url: "https://galleyrender.com"
source: "official_registry"
upstream_status: "active"
publisher{4}
namespace: "com.galleyrender"
display_name: "com.galleyrender"
type: "registry_namespace"
status: "unclaimed"
organization: null
repository: null
packages[0]
transports[1]
0{5}
kind: "remote"
type: "streamable-http"
endpoint_url: "https://mcp.galleyrender.com/mcp"
endpoint_host: "mcp.galleyrender.com"
auth_type: "none"
auth{3}
type: "none"
authorization_servers[0]
scopes[0]
protocol{4}
era: "legacy"
negotiated_version: "2025-11-25"
supported_versions[0]
transport_type: "streamable-http"
tools[20]
0{9}
name: "answer_import"
title: "Answer an import's questions"
effect: "READ"
effect_confidence: 0.917
capabilities[0]
risk_severity: "INFO"
fingerprint: "460d453c181e0f38bcc61957245936c2baa112216a5f5d9aca5f63b09dd9eafc"
input_schema_fingerprint: "c669c651508407b524e050c370b3880fc5f1371ec947a0bda5a0e67fe1ec26db"
annotations{5}
title: null
readOnlyHint: false
destructiveHint: false
idempotentHint: false
openWorldHint: true
1{9}
name: "billing_portal"
title: "Open the billing portal"
effect: "WRITE"
effect_confidence: 0.747
capabilities[1]
0{2}
capability: "PAYMENT"
confidence: 0.935
risk_severity: "LOW"
fingerprint: "9ab9e7e1aa7cea42c81dcc3f6d34176ce3a4eae93c5ff7e116d98d7ade641df3"
input_schema_fingerprint: "7a014b717a77aac971ea0ab5c0ff47bb13e6cae7ef9442d9dedb15ce36381b15"
annotations{5}
title: "Open the billing portal"
readOnlyHint: false
destructiveHint: false
idempotentHint: true
openWorldHint: true
2{9}
name: "create_account"
title: "Create an account and get an API key"
effect: "ADMIN"
effect_confidence: 0.65
capabilities[2]
0{2}
capability: "PERSONAL_DATA"
confidence: 0.53
1{2}
capability: "SECRETS"
confidence: 0.718
risk_severity: "HIGH"
fingerprint: "059632fba87ea670377e7dd2ea34c762757030d3cb9d634451d2580d8333deba"
input_schema_fingerprint: "99863cdea4b328c05f89bc478fcd0d98bcfbc851b66ab8b5996b57a2d7098edb"
annotations{5}
title: null
readOnlyHint: false
destructiveHint: false
idempotentHint: true
openWorldHint: true
3{9}
name: "create_template"
title: "Create a template"
effect: "EXECUTE"
effect_confidence: 0.6
capabilities[0]
risk_severity: "CRITICAL"
fingerprint: "2a225e7b970c6afeaeb5c720bfd4f9ecf5d86fdbd3d0becfaf0a7eceae7c2a09"
input_schema_fingerprint: "3135553e87acad4b6e931d9ae678c57e9217266e46158edaa2834065f4299717"
annotations{5}
title: null
readOnlyHint: false
destructiveHint: false
idempotentHint: false
openWorldHint: true
4{9}
name: "get_import"
title: "Check an import, see its questions or its preview"
effect: "READ"
effect_confidence: 0.857
capabilities[0]
risk_severity: "INFO"
fingerprint: "a012386af7cae3683655351cd7b9a33fb693ae31d2ca58a3d101534d4c468108"
input_schema_fingerprint: "9f2eb54b41806c7f83ce433354e245d3188eeee8c3e59283e8845059a5f0f23d"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: null
openWorldHint: true
5{9}
name: "get_render"
title: "Get a render"
effect: "READ"
effect_confidence: 0.921
capabilities[1]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.632
risk_severity: "INFO"
fingerprint: "cace3c34d89a68c60db429273237283c37f25166a03b2f70f14551a34069d8dd"
input_schema_fingerprint: "6d4f1978f3f7c259d991162af058148d09a3d794047bf7cb0480d56826e7fdc9"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: null
openWorldHint: true
6{9}
name: "get_template"
title: "Get a template"
effect: "READ"
effect_confidence: 0.921
capabilities[0]
risk_severity: "INFO"
fingerprint: "b50feb42f0a93f53ff6b15acec9f29b557d3e5af454d6c20578839710ba2c315"
input_schema_fingerprint: "1b5fa69996a69cd0a449b84c952d35fa5b066f418a53eac60b380c69a0de9c96"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: null
openWorldHint: true
7{9}
name: "import_document"
title: "Make a template from a document the person already has"
effect: "WRITE"
effect_confidence: 0.848
capabilities[4]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.755
1{2}
capability: "FILE_ACCESS"
confidence: 0.749
2{2}
capability: "PAYMENT"
confidence: 0.567
3{2}
capability: "PERSONAL_DATA"
confidence: 0.796
risk_severity: "MEDIUM"
fingerprint: "fa49942e7a91ee7ae53305e1d3840219f93258bd9a25030af418a23c72401cc8"
input_schema_fingerprint: "547992ccf14cd0996e20e6e88dad16bfa08d93ede0c70167ce064614953d9d53"
annotations{5}
title: null
readOnlyHint: false
destructiveHint: false
idempotentHint: false
openWorldHint: true
8{9}
name: "link_account"
title: "Link this client to an existing account"
effect: "WRITE"
effect_confidence: 0.848
capabilities[3]
0{2}
capability: "AUTHENTICATION"
confidence: 0.53
1{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.539
2{2}
capability: "SECRETS"
confidence: 0.53
risk_severity: "HIGH"
fingerprint: "52ec2271edccd06deda336f95e576ca4ec0cf6c9b8a3d9c1d0ac44b67e185582"
input_schema_fingerprint: "61f02e40a1e67c2fe9a4690a00e650812bd1fcb660c426f2d427937fa903f894"
annotations{5}
title: null
readOnlyHint: false
destructiveHint: false
idempotentHint: true
openWorldHint: true
9{9}
name: "list_renders"
title: "List recent renders"
effect: "READ"
effect_confidence: 0.857
capabilities[0]
risk_severity: "INFO"
fingerprint: "14b94b4a55189ca74849613b71bc89de97786472674e502a2502820bc8a475b7"
input_schema_fingerprint: "17c9bdf63788665a24051b4bcd6c041c66a41c5d848ee3489566d12a1adddd1f"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: null
openWorldHint: true
10{9}
name: "list_templates"
title: "List templates"
effect: "READ"
effect_confidence: 0.921
capabilities[0]
risk_severity: "INFO"
fingerprint: "7e3d3676455025916b5e4dd7af3329d3ab9c0c593d3ff520b099a98a062f986f"
input_schema_fingerprint: "7a014b717a77aac971ea0ab5c0ff47bb13e6cae7ef9442d9dedb15ce36381b15"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: null
openWorldHint: true
11{9}
name: "render"
title: "Render a document"
effect: "READ"
effect_confidence: 0.917
capabilities[1]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.853
risk_severity: "INFO"
fingerprint: "43d2abb9fe30ca0fa5d4ebdb05242933880ccb99ee0640d02ac3315255e3915b"
input_schema_fingerprint: "14efa29206fe13b10037dbfd05009abe440c01b0e15e8bfe385b71772291762c"
annotations{5}
title: null
readOnlyHint: false
destructiveHint: false
idempotentHint: true
openWorldHint: true
12{9}
name: "rotate_key"
title: "Mint a new API key and retire the old one"
effect: "ADMIN"
effect_confidence: 0.703
capabilities[2]
0{2}
capability: "SECRETS"
confidence: 0.888
1{2}
capability: "SECURITY_CONTROL"
confidence: 0.5
risk_severity: "HIGH"
fingerprint: "7621c36369805efbd5fbc58196ae7dfbe786d84e6351932c51206815ceeb6a3a"
input_schema_fingerprint: "47c818e35ad0731e9db487d9a6f8294821e5d62ebaefe9dea1fe2fc6ce694b9d"
annotations{5}
title: null
readOnlyHint: false
destructiveHint: true
idempotentHint: false
openWorldHint: true
13{9}
name: "save_import"
title: "Save an import as a template"
effect: "WRITE"
effect_confidence: 0.902
capabilities[0]
risk_severity: "LOW"
fingerprint: "42cc82b5f7e9a9210809777658cea730119eca01b6a70370f7b13993f76dab12"
input_schema_fingerprint: "bf099fdb5c60cfa10eb2741fca6ea238d264297f30b45beebf01a03a95804a9e"
annotations{5}
title: null
readOnlyHint: false
destructiveHint: false
idempotentHint: true
openWorldHint: true
14{9}
name: "unlink_account"
title: "Unlink this client from its account"
effect: "WRITE"
effect_confidence: 0.902
capabilities[0]
risk_severity: "LOW"
fingerprint: "bae2313cd9fff142800af9172be854eaa90938fe11222b6add32647eb007bac4"
input_schema_fingerprint: "7a014b717a77aac971ea0ab5c0ff47bb13e6cae7ef9442d9dedb15ce36381b15"
annotations{5}
title: null
readOnlyHint: false
destructiveHint: true
idempotentHint: true
openWorldHint: true
15{9}
name: "update_template"
title: "Publish a new template version"
effect: "EXECUTE"
effect_confidence: 0.6
capabilities[0]
risk_severity: "CRITICAL"
fingerprint: "370fb47447e3802deb770ee4b4ca85467a91945dd6b068005eacd9092add8c49"
input_schema_fingerprint: "6ec4d6a9a31fb10e217e93399cc164e47ea9fb5446f3e503238a4183f4c0aedc"
annotations{5}
title: null
readOnlyHint: false
destructiveHint: false
idempotentHint: false
openWorldHint: true
16{9}
name: "upgrade"
title: "Upgrade to a paid plan"
effect: "WRITE"
effect_confidence: 0.822
capabilities[2]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.556
1{2}
capability: "PAYMENT"
confidence: 0.765
risk_severity: "MEDIUM"
fingerprint: "f28c7e0f0c4a6c59830ecff5584cfe658713889a770cd5ad7bdcf65678d3d0a5"
input_schema_fingerprint: "bafde9994c425922b1c503d5ded4c403a6b7c6df21feb38e021bc7b05b4c852b"
annotations{5}
title: "Upgrade to a paid plan"
readOnlyHint: false
destructiveHint: false
idempotentHint: true
openWorldHint: true
17{9}
name: "usage"
title: "Usage and limits"
effect: "UNKNOWN"
effect_confidence: 0.2
capabilities[0]
risk_severity: "LOW"
fingerprint: "956dc9a02c674bbe663b259a0fc8fafea0df07fdfd8bf92e212ad9577c4411c1"
input_schema_fingerprint: "7a014b717a77aac971ea0ab5c0ff47bb13e6cae7ef9442d9dedb15ce36381b15"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: null
openWorldHint: true
18{9}
name: "validate_data"
title: "Validate a payload against a template"
effect: "READ"
effect_confidence: 0.933
capabilities[0]
risk_severity: "INFO"
fingerprint: "7c7208741e70a9afa46567cb767b5412005a177d9cf2ea2298ae7b3dcc35ab1c"
input_schema_fingerprint: "d4a66ea77161f3fbcbd28dacb981b22afd0dd4690a36bb7b3e07bb893b225a19"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: null
openWorldHint: true
19{9}
name: "whoami"
title: "Which account am I, and how did I get here"
effect: "READ"
effect_confidence: 0.762
capabilities[2]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.567
1{2}
capability: "IDENTITY"
confidence: 0.5
risk_severity: "INFO"
fingerprint: "fc7d0170c0d449a88620d262ebd537e60043135208e8cd96d0f064eea6a05bf9"
input_schema_fingerprint: "7a014b717a77aac971ea0ab5c0ff47bb13e6cae7ef9442d9dedb15ce36381b15"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: null
openWorldHint: true
resources[0]
prompts[0]
extensions[0]
data{6}
privacy_completeness: "not_provided"
data_categories[0]
ai_training: null
retention_policy: null
processing_regions[0]
subprocessors[0]
external_integrations[1]
0{3}
host: "mcp.galleyrender.com"
registrable_domain: "galleyrender.com"
source: "transport"
findings[14]
0{6}
check_id: "SQ-REPO-MISSING"
category: "provenance"
severity: "LOW"
title: "No source repository linked"
subject_type: "server"
subject_name: null
1{6}
check_id: "SQ-SERVER-AUTH-NONE-WRITE"
category: "authentication"
severity: "HIGH"
title: "State-changing tools available without authentication"
subject_type: "server"
subject_name: null
2{6}
check_id: "SQ-TOOL-CONCEALMENT"
category: "prompt_injection"
severity: "MEDIUM"
title: "Text asks the AI model to hide actions from the user"
subject_type: "tool"
subject_name: "rotate_key"
3{6}
check_id: "SQ-TOOL-CREDENTIAL-ARGUMENT"
category: "schema"
severity: "MEDIUM"
title: "Asks the AI model to supply credentials as arguments"
subject_type: "tool"
subject_name: "link_account"
4{6}
check_id: "SQ-TOOL-CROSS-TOOL-REFERENCE"
category: "prompt_injection"
severity: "MEDIUM"
title: "Gives instructions about other tools"
subject_type: "tool"
subject_name: "create_template"
5{6}
check_id: "SQ-TOOL-CROSS-TOOL-REFERENCE"
category: "prompt_injection"
severity: "MEDIUM"
title: "Gives instructions about other tools"
subject_type: "tool"
subject_name: "render"
6{6}
check_id: "SQ-TOOL-CROSS-TOOL-REFERENCE"
category: "prompt_injection"
severity: "MEDIUM"
title: "Gives instructions about other tools"
subject_type: "tool"
subject_name: "update_template"
7{6}
check_id: "SQ-TOOL-INJECTION-INSTRUCTIONS"
category: "prompt_injection"
severity: "LOW"
title: "Instructions addressed to the AI model"
subject_type: "tool"
subject_name: "rotate_key"
8{6}
check_id: "SQ-TOOL-META-INSUFFICIENT"
category: "tool_design"
severity: "LOW"
title: "Description too thin to determine behavior"
subject_type: "tool"
subject_name: "usage"
9{6}
check_id: "SQ-TOOL-OVERLY-BROAD"
category: "tool_design"
severity: "MEDIUM"
title: "Runs arbitrary code with open-world access"
subject_type: "tool"
subject_name: "create_template"
10{6}
check_id: "SQ-TOOL-OVERLY-BROAD"
category: "tool_design"
severity: "MEDIUM"
title: "Runs arbitrary code with open-world access"
subject_type: "tool"
subject_name: "update_template"
11{6}
check_id: "SQ-TOOL-TITLE-EFFECT-MISMATCH"
category: "deceptive_metadata"
severity: "HIGH"
title: "Display title describes a lower-impact action than the name"
subject_type: "tool"
subject_name: "create_template"
12{6}
check_id: "SQ-TOOL-TITLE-EFFECT-MISMATCH"
category: "deceptive_metadata"
severity: "HIGH"
title: "Display title describes a lower-impact action than the name"
subject_type: "tool"
subject_name: "rotate_key"
13{6}
check_id: "SQ-TOOL-TITLE-EFFECT-MISMATCH"
category: "deceptive_metadata"
severity: "HIGH"
title: "Display title describes a lower-impact action than the name"
subject_type: "tool"
subject_name: "update_template"
trust{9}
registry_namespace: "verified_upstream"
publisher_identity: "unverified"
organization: "unverified"
domain: "unverified"
repository: "not_provided"
source_provenance: "unknown"
security_scan: "scan_incomplete"
privacy_transparency: "not_provided"
monitoring: "not_monitored"
provenance{4}
registry_name: "com.galleyrender/galley-render"
registry_content_sha256: "fb85f60e4ac4516f2dfc7643ad5a026f9179296db06558697b9b566ee5dd48c3"
scan_snapshot_fingerprint: "65b798fb15d621b4d805618dcbafa32a27df15e52a624e022a8b2a965f3fced8"
scanner_version: "1.0.0"
timestamps{4}
generated_at: "2026-11-15T13:56:45.287Z"
observed_at: "2026-10-26T09:27:48.626+00:00"
registry_published_at: "2026-09-22T17:53:33.02823+00:00"
registry_updated_at: null