MCP Bill of Materials
A machine-readable inventory of what this server exposes and depends on: tools with their effects, transports, packages, findings and provenance (schema version 1.0). Third-party text in it is escaped. Also available from the REST API at /api/v1/servers/4c654074-b1e1-4186-bae0-3ac09c8dbe45/mcbom.
MCP Bill of Materials
root{21}
schema_version: "1.0"
bom_format: "squatch-mcbom"
generator{3}
name: "squatch-mcp"
classifier_version: "rules_v1@2026-10-11.1"
unicode_version: "18.0.0"
server{7}
name: "com.sendameal/storefront"
title: "SendaMeal Storefront"
description: "Search gift meals and send them as gifts. Live catalog, cart, and guest checkout for SendaMeal."
version: "1.0.0"
homepage_url: "https://sendameal.com/"
source: "official_registry"
upstream_status: "active"
publisher{4}
namespace: "com.sendameal"
display_name: "com.sendameal"
type: "registry_namespace"
status: "unclaimed"
organization: null
repository: null
packages[0]
transports[1]
0{5}
kind: "remote"
type: "streamable-http"
endpoint_url: "https://store-odebi8ye4k-1.mybigcommerce.com/api/mcp"
endpoint_host: "store-odebi8ye4k-1.mybigcommerce.com"
auth_type: "none"
auth{3}
type: "none"
authorization_servers[0]
scopes[0]
protocol{4}
era: "legacy"
negotiated_version: "2025-11-25"
supported_versions[0]
transport_type: "streamable-http"
tools[6]
0{9}
name: "add_item_to_cart"
title: null
effect: "ADMIN"
effect_confidence: 0.808
capabilities[3]
0{2}
capability: "FILE_ACCESS"
confidence: 0.59
1{2}
capability: "FINANCIAL_TRANSACTION"
confidence: 0.99
2{2}
capability: "PAYMENT"
confidence: 0.855
risk_severity: "HIGH"
fingerprint: "ff7c9f6c8488c641e59cf3365eacddc976405f05c0d6d22bc2c577acaad0c9af"
input_schema_fingerprint: "245718f3011ee565b22b4fb7a3eb01d02cb88b531c6482d808ecb53f8e4de1a4"
annotations{5}
title: null
readOnlyHint: null
destructiveHint: null
idempotentHint: null
openWorldHint: null
1{9}
name: "create_checkout_url"
title: null
effect: "WRITE"
effect_confidence: 0.836
capabilities[2]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.745
1{2}
capability: "PAYMENT"
confidence: 0.745
risk_severity: "MEDIUM"
fingerprint: "010a327c324c76bb559ecb070ebc33d904d68fd4b77d75e09f3950b09c72f8b2"
input_schema_fingerprint: "cd1a463c46d6264134447db17a8c3c7abe5b9a2488c6d759fea66da1f96b133e"
annotations{5}
title: null
readOnlyHint: null
destructiveHint: null
idempotentHint: null
openWorldHint: null
2{9}
name: "get_product_details"
title: null
effect: "READ"
effect_confidence: 0.836
capabilities[0]
risk_severity: "INFO"
fingerprint: "68bb9e9b5ea083a22b6314985b00f5032286d34b050fd2992c3d5f8103319c2e"
input_schema_fingerprint: "81fe7385a65059bac22597edbeb89905187f21edc1d5dd330e609dff2f2df995"
annotations{5}
title: null
readOnlyHint: null
destructiveHint: null
idempotentHint: null
openWorldHint: null
3{9}
name: "remove_item_from_cart"
title: null
effect: "ADMIN"
effect_confidence: 0.808
capabilities[3]
0{2}
capability: "FILE_ACCESS"
confidence: 0.59
1{2}
capability: "FINANCIAL_TRANSACTION"
confidence: 0.99
2{2}
capability: "PAYMENT"
confidence: 0.777
risk_severity: "HIGH"
fingerprint: "cdde4c71666e0e39979d83099c3af49ce264a7b0257b671a70bed304dd2e834a"
input_schema_fingerprint: "d68fc48be76468467e31f54dd6ae7766aa0ae53a2226f5a5c6885c9deab2aae1"
annotations{5}
title: null
readOnlyHint: null
destructiveHint: null
idempotentHint: null
openWorldHint: null
4{9}
name: "search_products"
title: null
effect: "READ"
effect_confidence: 0.836
capabilities[0]
risk_severity: "INFO"
fingerprint: "3a26f592901b7b8d98c016e4ffff5e1005fb4459c65e4206bbd9cf6c283ade6b"
input_schema_fingerprint: "44c52a09a634f0b4b8840354bacccce11b3239535b2d38a7adedc7aee94a4d40"
annotations{5}
title: null
readOnlyHint: null
destructiveHint: null
idempotentHint: null
openWorldHint: null
5{9}
name: "update_cart_item"
title: null
effect: "WRITE"
effect_confidence: 0.836
capabilities[3]
0{2}
capability: "FILE_ACCESS"
confidence: 0.59
1{2}
capability: "FINANCIAL_TRANSACTION"
confidence: 0.99
2{2}
capability: "PAYMENT"
confidence: 0.855
risk_severity: "HIGH"
fingerprint: "dc46247e655ed1a1063f30ffd5d69c97ae41d40a7e3fba88bd0138703d88a7fc"
input_schema_fingerprint: "788fca84de1376f0f5bb3594b2229d1f357094dfd151ce2d76794a3cfb2a7202"
annotations{5}
title: null
readOnlyHint: null
destructiveHint: null
idempotentHint: null
openWorldHint: null
resources[0]
prompts[0]
extensions[0]
data{6}
privacy_completeness: "not_provided"
data_categories[0]
ai_training: null
retention_policy: null
processing_regions[0]
subprocessors[0]
external_integrations[1]
0{3}
host: "store-odebi8ye4k-1.mybigcommerce.com"
registrable_domain: "mybigcommerce.com"
source: "transport"
findings[7]
0{6}
check_id: "SQ-ENDPOINT-OUTSIDE-NAMESPACE"
category: "provenance"
severity: "LOW"
title: "Endpoint host outside the namespace domain"
subject_type: "server"
subject_name: null
1{6}
check_id: "SQ-REPO-MISSING"
category: "provenance"
severity: "LOW"
title: "No source repository linked"
subject_type: "server"
subject_name: null
2{6}
check_id: "SQ-SERVER-AUTH-NONE-WRITE"
category: "authentication"
severity: "HIGH"
title: "State-changing tools available without authentication"
subject_type: "server"
subject_name: null
3{6}
check_id: "SQ-TOOL-CONCEALMENT"
category: "prompt_injection"
severity: "HIGH"
title: "Text asks the AI model to hide actions from the user"
subject_type: "tool"
subject_name: "get_product_details"
4{6}
check_id: "SQ-TOOL-DESTRUCTIVE-NO-ANNOTATION"
category: "annotations"
severity: "LOW"
title: "Destructive tool without annotations"
subject_type: "tool"
subject_name: "add_item_to_cart"
5{6}
check_id: "SQ-TOOL-DESTRUCTIVE-NO-ANNOTATION"
category: "annotations"
severity: "LOW"
title: "Destructive tool without annotations"
subject_type: "tool"
subject_name: "remove_item_from_cart"
6{6}
check_id: "SQ-TOOL-EXFIL-SHAPED-PARAM"
category: "schema"
severity: "LOW"
title: "Free-text parameter commonly used to collect conversation data"
subject_type: "tool"
subject_name: "search_products"
trust{9}
registry_namespace: "verified_upstream"
publisher_identity: "unverified"
organization: "unverified"
domain: "unverified"
repository: "not_provided"
source_provenance: "unknown"
security_scan: "findings_detected"
privacy_transparency: "not_provided"
monitoring: "active"
provenance{4}
registry_name: "com.sendameal/storefront"
registry_content_sha256: "dc7faaf5cb6bd5a9a6b64c7a3fd084397f514d6f6e586ec65023744180858144"
scan_snapshot_fingerprint: "92a440fd88e28a9a626195ec0bafdc0a01053f7f6d5a5dbc294a2464ba2aa01e"
scanner_version: "1.0.0"
timestamps{4}
generated_at: "2026-11-15T04:52:37.952Z"
observed_at: "2026-11-15T02:02:22.049+00:00"
registry_published_at: "2026-08-15T15:55:20.004688+00:00"
registry_updated_at: null