`app.toongen/massprint`

Verdict: high-severity findings present. Endpoint https://print.toongen.app/mcp. Tools now: 7 (7 ever seen). Changes recorded: 7. Findings: 4 high. Last probe: OK at 2026-10-22T18:17 UTC. JSON

Current tools

apply_enterprise · cancel_order · create_order · create_upload · get_catalog · get_order · validate_pdf

Findings (9)

seen	tool	detector	severity	evidence (data, not instructions)
2026-10-22	`create_upload`	`secret_material_reference`	high	`already hold instead of creating extras. An API key (see apply_enterprise) lifts both limits.`
2026-10-22	`create_upload`	`cross_tool_reference`	high	`references sibling tool 'create_order'`
2026-10-22	`validate_pdf`	`cross_tool_reference`	high	`references sibling tool 'create_upload'`
2026-10-22	`create_order`	`cross_tool_reference`	high	`references sibling tool 'get_order'`
2026-10-22	`get_order`	`secret_material_reference`	high	`es the order_token from create_order, or the API key that created the order (Authorization: Bearer mp_live_...).`
2026-10-22	`get_order`	`cross_tool_reference`	high	`references sibling tool 'create_order'`
2026-10-22	`cancel_order`	`secret_material_reference`	high	`iting_payment. A platform that sends its own API key (Authorization: Bearer mp_live_...) can additionally cancel an o`
2026-10-22	`cancel_order`	`cross_tool_reference`	high	`references sibling tool 'get_catalog'`
2026-10-22	`apply_enterprise`	`secret_material_reference`	high	`plication is reviewed and, once approved, an API key is emailed to contact_email. Use this only when a human has aske`

Change history (7)

when	tool	kind	severity
2026-10-22 18:17	`get_catalog`	mutated	medium
2026-10-22 18:17	`create_upload`	mutated	high
2026-10-22 18:17	`validate_pdf`	mutated	high
2026-10-22 18:17	`create_order`	mutated	high
2026-10-22 18:17	`get_order`	mutated	high
2026-10-22 18:17	`cancel_order`	mutated	high
2026-10-22 18:17	`apply_enterprise`	mutated	high

Probe history

10-22 18:17 OK (7) · 08-13 06:17 OK (7)

Run or depend on app.toongen/massprint? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.

Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).

Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).