io.github.cyanheads/epa-mcp-server

by io.github.cyanheads· v0.8.0Official MCP Registry

Findings

Detected by Squatch rules from the server's metadata and protocol behavior. Latest completed scan: Nov 9, 2026, 12:11 UTC.

Severity: High8 findings

HighOpenSQ-TOOL-EXFIL-DIRECTIVE

Asks the AI model to pass conversation data or secrets

Model-facing text instructs the AI model to place conversation content, prompts, tool history or secrets into tool arguments or external destinations.

First seen Nov 1, 2026 · Last seen Nov 9, 2026

Suggested fix: Do not ask the model to include conversation, prompt or credential content in arguments.

HighOpenSQ-TOOL-EXFIL-SHAPED-PARAM

Free-text parameter commonly used to collect conversation data

A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.

First seen Nov 1, 2026 · Last seen Nov 9, 2026

Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.

HighOpenSQ-TOOL-EXFIL-DIRECTIVE

Asks the AI model to pass conversation data or secrets

Model-facing text instructs the AI model to place conversation content, prompts, tool history or secrets into tool arguments or external destinations.

First seen Nov 1, 2026 · Last seen Nov 9, 2026

Suggested fix: Do not ask the model to include conversation, prompt or credential content in arguments.

HighOpenSQ-TOOL-EXFIL-DIRECTIVE

Asks the AI model to pass conversation data or secrets

Model-facing text instructs the AI model to place conversation content, prompts, tool history or secrets into tool arguments or external destinations.

First seen Nov 1, 2026 · Last seen Nov 9, 2026

Suggested fix: Do not ask the model to include conversation, prompt or credential content in arguments.

HighOpenSQ-TOOL-EXFIL-DIRECTIVE

Asks the AI model to pass conversation data or secrets

Model-facing text instructs the AI model to place conversation content, prompts, tool history or secrets into tool arguments or external destinations.

First seen Nov 1, 2026 · Last seen Nov 9, 2026

Suggested fix: Do not ask the model to include conversation, prompt or credential content in arguments.

HighOpenSQ-TOOL-EXFIL-DIRECTIVE

Asks the AI model to pass conversation data or secrets

Model-facing text instructs the AI model to place conversation content, prompts, tool history or secrets into tool arguments or external destinations.

First seen Nov 1, 2026 · Last seen Nov 9, 2026

Suggested fix: Do not ask the model to include conversation, prompt or credential content in arguments.

HighOpenSQ-TOOL-EXFIL-DIRECTIVE

Asks the AI model to pass conversation data or secrets

Model-facing text instructs the AI model to place conversation content, prompts, tool history or secrets into tool arguments or external destinations.

First seen Nov 1, 2026 · Last seen Nov 9, 2026

Suggested fix: Do not ask the model to include conversation, prompt or credential content in arguments.

HighOpenSQ-TOOL-EXFIL-DIRECTIVE

Asks the AI model to pass conversation data or secrets

Model-facing text instructs the AI model to place conversation content, prompts, tool history or secrets into tool arguments or external destinations.

First seen Nov 1, 2026 · Last seen Nov 9, 2026

Suggested fix: Do not ask the model to include conversation, prompt or credential content in arguments.

Severity: Info4 findings

InfoOpenSQ-TOOL-EXFIL-SHAPED-PARAM

Free-text parameter commonly used to collect conversation data

A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.

First seen Oct 24, 2026 · Last seen Nov 9, 2026

Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.

InfoOpenSQ-TOOL-EXFIL-SHAPED-PARAM

Free-text parameter commonly used to collect conversation data

A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.

First seen Oct 24, 2026 · Last seen Nov 9, 2026

Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.

InfoOpenSQ-TOOL-EXFIL-SHAPED-PARAM

Free-text parameter commonly used to collect conversation data

A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.

First seen Oct 24, 2026 · Last seen Nov 9, 2026

Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.

InfoOpenSQ-TOOL-EXFIL-SHAPED-PARAM

Free-text parameter commonly used to collect conversation data

A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.

First seen Oct 24, 2026 · Last seen Nov 9, 2026

Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.

4 resolved or dismissed findings

InfoResolvedSQ-TOOL-EXFIL-SHAPED-PARAM

Free-text parameter commonly used to collect conversation data

A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.

First seen Oct 18, 2026 · Last seen Oct 20, 2026

Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.

Status history

ResolvedSquatchOct 24, 2026, 12:49 UTC

InfoResolvedSQ-TOOL-EXFIL-SHAPED-PARAM

Free-text parameter commonly used to collect conversation data

A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.

First seen Oct 18, 2026 · Last seen Oct 20, 2026

Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.

Status history

ResolvedSquatchOct 24, 2026, 12:49 UTC

InfoResolvedSQ-TOOL-EXFIL-SHAPED-PARAM

Free-text parameter commonly used to collect conversation data

A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.

First seen Oct 18, 2026 · Last seen Oct 20, 2026

Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.

Status history

ResolvedSquatchOct 24, 2026, 12:49 UTC

InfoResolvedSQ-TOOL-EXFIL-SHAPED-PARAM

Free-text parameter commonly used to collect conversation data

A free-text parameter has a name commonly abused to collect conversation, prompt or environment data.

First seen Oct 18, 2026 · Last seen Oct 20, 2026

Suggested fix: Constrain the parameter (enum, maxLength) or rename it to reflect its purpose; never ask the model to fill it with conversation content.

Status history

ResolvedSquatchOct 24, 2026, 12:49 UTC

What this scan does not cover

Squatch never calls a server's tools, so it cannot see what they actually do at run time.
It scans without credentials: tools behind authentication may not be visible.
It does not review source code, dependencies or the publisher's infrastructure.
A server can change behavior between scans; monitoring compares each scan with the last.
Classifications come from tool names, descriptions and schemas, which the publisher controls.

How Squatch scans servers

Security scan

High-severity findings detected

8 open findings at HIGH or above (0 critical).

1 piece of evidence

Source: Squatch observedscan
Metadata and configuration analysis; tools are not executed.
Observed Nov 9, 2026, 12:11 UTC

Last checked Nov 9, 2026, 12:11 UTC

Authentication

Squatch observed

Summary: { "type": "none", "challengeStatus": null, "scopesSupported": [], "resourceMetadataUrl": null, "authorizationServers": [] }

Protocol conformance

Checks: { "checks": [ { "check": "tools_list_deterministic", "passed": true }, { "check": "list_methods_succeed", "passed": true }, { "check": "list_results_schema_valid", "passed": true }, { "check": "pagination_terminates", "passed": true }, { "check": "tool_names_valid", "passed": true }, { "check": "tool_names_unique", "passed": true }, { "check": "no_network_schema_refs", "passed": true }, { "check": "x_mcp_header_valid", "passed": true }, { "check": "icon_urls_https_or_data", "detail": "no icons declared", "passed": true }, { "check": "discover_present", "passed": true }, { "check": "result_type_present", "passed": true }, { "check": "cacheable_fields_present", "passed": true }, { "check": "server_info_in_meta", "passed": true }, { "check": "no_session_id", "passed": true }, { "check": "unknown_method_404", "passed": true }, { "check": "notification_202", "passed": true }, { "check": "get_405", "passed": true } ], "toolsListNondeterministic": false }

Full technical details