Detected by Squatch rules from the server's metadata and protocol behavior. Latest completed scan: .
Model-facing text instructs the AI model to place conversation content, prompts, tool history or secrets into tool arguments or external destinations.
First seen · Last seen
Suggested fix: Do not ask the model to include conversation, prompt or credential content in arguments.
Model-facing text contains instructions addressed to the AI model rather than a description of the tool (for example to override prior instructions, to act before using tools, or to react to trigger phrases).
First seen · Last seen
Suggested fix: Describe what the tool does and its parameters. Do not include instructions to the model about other tools, the user or the conversation.
The tool declares itself read-only, but its name or description indicates it changes, deletes or runs something. Clients that auto-approve read-only tools would run it without confirmation.
First seen · Last seen
Suggested fix: Set readOnlyHint to false and destructiveHint to reflect the tool's behavior.
Model-facing text contains instructions addressed to the AI model rather than a description of the tool (for example to override prior instructions, to act before using tools, or to react to trigger phrases).
First seen · Last seen
Suggested fix: Describe what the tool does and its parameters. Do not include instructions to the model about other tools, the user or the conversation.
Model-facing text contains instructions addressed to the AI model rather than a description of the tool (for example to override prior instructions, to act before using tools, or to react to trigger phrases).
First seen · Last seen
Suggested fix: Describe what the tool does and its parameters. Do not include instructions to the model about other tools, the user or the conversation.
Model-facing text contains instructions addressed to the AI model rather than a description of the tool (for example to override prior instructions, to act before using tools, or to react to trigger phrases).
First seen · Last seen
Suggested fix: Describe what the tool does and its parameters. Do not include instructions to the model about other tools, the user or the conversation.
Model-facing text contains instructions addressed to the AI model rather than a description of the tool (for example to override prior instructions, to act before using tools, or to react to trigger phrases).
First seen · Last seen
Suggested fix: Describe what the tool does and its parameters. Do not include instructions to the model about other tools, the user or the conversation.
Model-facing text contains instructions addressed to the AI model rather than a description of the tool (for example to override prior instructions, to act before using tools, or to react to trigger phrases).
First seen · Last seen
Suggested fix: Describe what the tool does and its parameters. Do not include instructions to the model about other tools, the user or the conversation.
Model-facing text contains instructions addressed to the AI model rather than a description of the tool (for example to override prior instructions, to act before using tools, or to react to trigger phrases).
First seen · Last seen
Suggested fix: Describe what the tool does and its parameters. Do not include instructions to the model about other tools, the user or the conversation.
Model-facing text contains instructions addressed to the AI model rather than a description of the tool (for example to override prior instructions, to act before using tools, or to react to trigger phrases).
First seen · Last seen
Suggested fix: Describe what the tool does and its parameters. Do not include instructions to the model about other tools, the user or the conversation.
The remote server lists state-changing tools without requiring authentication.
First seen · Last seen
Suggested fix: Require MCP authorization for servers that expose state-changing tools.
The tool declares itself read-only, but its name or description indicates it changes, deletes or runs something. Clients that auto-approve read-only tools would run it without confirmation.
First seen · Last seen
Suggested fix: Set readOnlyHint to false and destructiveHint to reflect the tool's behavior.
The tool declares itself read-only, but its name or description indicates it changes, deletes or runs something. Clients that auto-approve read-only tools would run it without confirmation.
First seen · Last seen
Suggested fix: Set readOnlyHint to false and destructiveHint to reflect the tool's behavior.
The tool declares itself read-only, but its name or description indicates it changes, deletes or runs something. Clients that auto-approve read-only tools would run it without confirmation.
First seen · Last seen
Suggested fix: Set readOnlyHint to false and destructiveHint to reflect the tool's behavior.
Model-facing text contains instructions addressed to the AI model rather than a description of the tool (for example to override prior instructions, to act before using tools, or to react to trigger phrases).
First seen · Last seen
Suggested fix: Describe what the tool does and its parameters. Do not include instructions to the model about other tools, the user or the conversation.
Model-facing text contains instructions addressed to the AI model rather than a description of the tool (for example to override prior instructions, to act before using tools, or to react to trigger phrases).
First seen · Last seen
Suggested fix: Describe what the tool does and its parameters. Do not include instructions to the model about other tools, the user or the conversation.
Model-facing text contains instructions addressed to the AI model rather than a description of the tool (for example to override prior instructions, to act before using tools, or to react to trigger phrases).
First seen · Last seen
Suggested fix: Describe what the tool does and its parameters. Do not include instructions to the model about other tools, the user or the conversation.
No source repository is linked in the registry entry.
First seen · Last seen
Suggested fix: Add a repository to server.json.