← MCP Registry Integrity Report
app.steadywrk/mcp-dispatch
Verdict: high-severity findings present. Endpoint https://steadywrk.app/api/mcp. Tools now: 9 (9 ever seen). Changes recorded: 9. Findings: 8 high, 3 low. Last probe: OK at 2026-10-22T18:17 UTC. JSON
Current tools
acp.validate · agentic.readiness_probe · dispatch.estimate · dispatch.evals · dispatch.index · dispatch.order · dispatch.order_status · dispatch.quote · ucp.validate
Findings (15)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-22 | agentic.readiness_probe | secret_material_reference | high | ks under `next`. Rate-limited per caller. No API key required. |
| 2026-10-22 | dispatch.quote | secret_material_reference | high | epts a provisioned integration key through x-api-key or, when OAuth is enabled, a scoped self-serve OAuth token throu |
| 2026-10-22 | dispatch.quote | url_in_description | low | https://steadywrk.app/api/integration-key-request |
| 2026-10-22 | dispatch.quote | cross_tool_reference | high | references sibling tool 'dispatch.estimate' |
| 2026-10-22 | dispatch.estimate | secret_material_reference | high | quotes. Use dispatch.quote with an accepted credential to request a quote. No API key required. |
| 2026-10-22 | dispatch.estimate | cross_tool_reference | high | references sibling tool 'dispatch.quote' |
| 2026-10-22 | dispatch.order | secret_material_reference | high | ires a provisioned integration key through x-api-key. MCP also accepts that key through Authorization: Bearer; direct |
| 2026-10-22 | dispatch.order | url_in_description | low | https://steadywrk.app/api/integration-key-request |
| 2026-10-22 | dispatch.order | cross_tool_reference | high | references sibling tool 'dispatch.index' |
| 2026-10-22 | dispatch.order_status | url_in_description | low | https://steadywrk.app/api/integration-key-request |
| 2026-10-22 | dispatch.order_status | cross_tool_reference | high | references sibling tool 'dispatch.order' |
| 2026-10-22 | dispatch.evals | secret_material_reference | high | ndent audit or a service-level guarantee. No API key required. |
| 2026-10-22 | dispatch.index | secret_material_reference | high | ved transaction prices or binding quotes. No API key required. |
| 2026-10-22 | acp.validate | secret_material_reference | high | ores nothing, calls no checkout endpoint. No API key required. |
| 2026-10-22 | ucp.validate | secret_material_reference | high | ores nothing, calls no checkout endpoint. No API key required. |
Change history (9)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-22 18:17 | agentic.readiness_probe | mutated | high |
| 2026-10-22 18:17 | dispatch.quote | mutated | high |
| 2026-10-22 18:17 | dispatch.estimate | added | high |
| 2026-10-22 18:17 | dispatch.order | mutated | high |
| 2026-10-22 18:17 | dispatch.order_status | added | high |
| 2026-10-22 18:17 | dispatch.evals | mutated | high |
| 2026-10-22 18:17 | dispatch.index | mutated | high |
| 2026-10-22 18:17 | acp.validate | added | high |
| 2026-10-22 18:17 | ucp.validate | added | high |
Probe history
10-22 18:17 OK (9) · 08-13 06:17 OK (5)
Run or depend on app.steadywrk/mcp-dispatch? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).