io.github.cyanheads/stackexchange-mcp-server

by io.github.cyanheads· v0.2.0Official MCP Registry

Findings

Detected by Squatch rules from the server's metadata and protocol behavior. Latest completed scan: Nov 7, 2026, 18:52 UTC.

Severity: High2 findings

HighOpenSQ-TOOL-SENSITIVE-PATH-REFERENCE

References credential or key locations

Model-facing text references credential, key or configuration file locations unrelated to the tool's stated purpose.

First seen Oct 18, 2026 · Last seen Nov 7, 2026

Suggested fix: Remove references to credential files, key stores and client configuration files.

HighOpenSQ-TOOL-SENSITIVE-PATH-REFERENCE

References credential or key locations

Model-facing text references credential, key or configuration file locations unrelated to the tool's stated purpose.

First seen Oct 18, 2026 · Last seen Nov 7, 2026

Suggested fix: Remove references to credential files, key stores and client configuration files.

Severity: Medium1 finding

MediumOpenSQ-TOOL-INJECTION-INSTRUCTIONS

Instructions addressed to the AI model

Model-facing text contains instructions addressed to the AI model rather than a description of the tool (for example to override prior instructions, to act before using tools, or to react to trigger phrases).

First seen Oct 18, 2026 · Last seen Nov 7, 2026

Suggested fix: Describe what the tool does and its parameters. Do not include instructions to the model about other tools, the user or the conversation.

What this scan does not cover

Squatch never calls a server's tools, so it cannot see what they actually do at run time.
It scans without credentials: tools behind authentication may not be visible.
It does not review source code, dependencies or the publisher's infrastructure.
A server can change behavior between scans; monitoring compares each scan with the last.
Classifications come from tool names, descriptions and schemas, which the publisher controls.

How Squatch scans servers

Security scan

High-severity findings detected

2 open findings at HIGH or above (0 critical).

1 piece of evidence

Source: Squatch observedscan
Metadata and configuration analysis; tools are not executed.
Observed Nov 7, 2026, 18:52 UTC

Last checked Nov 7, 2026, 18:52 UTC

Authentication

Squatch observed

Summary: { "type": "none", "challengeStatus": null, "scopesSupported": [], "resourceMetadataUrl": null, "authorizationServers": [] }

Protocol conformance

Checks: { "checks": [ { "check": "tools_list_deterministic", "passed": true }, { "check": "list_methods_succeed", "passed": true }, { "check": "list_results_schema_valid", "passed": true }, { "check": "pagination_terminates", "passed": true }, { "check": "tool_names_valid", "passed": true }, { "check": "tool_names_unique", "passed": true }, { "check": "no_network_schema_refs", "passed": true }, { "check": "x_mcp_header_valid", "passed": true }, { "check": "icon_urls_https_or_data", "detail": "no icons declared", "passed": true }, { "check": "discover_present", "passed": true }, { "check": "result_type_present", "passed": true }, { "check": "cacheable_fields_present", "passed": true }, { "check": "server_info_in_meta", "passed": true }, { "check": "no_session_id", "passed": true }, { "check": "unknown_method_404", "passed": true }, { "check": "notification_202", "passed": true }, { "check": "get_405", "passed": true } ], "toolsListNondeterministic": false }

Full technical details