← MCP Registry Integrity Report
app.zooza/mcp-server
Verdict: CRITICAL findings present. Endpoint https://mcp.zooza.app/mcp. Tools now: 18 (38 ever seen). Changes recorded: 38. Findings: 3 low, 12 high, 4 critical. Last probe: OK at 2026-10-22T18:17 UTC. JSON
Current tools
bookings_copy_booking · bookings_find · call_tool · classes_find_classes · classes_find_courses · classes_find_resource · classes_update · comms_send_message · get_skill · get_terminology · get_tool_schema · reports_get_data · sessions_cancel · sessions_find_events · sessions_get_attendance · sessions_mark_attendance · sessions_update · whoami
Findings (34)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-22 | whoami | cross_tool_reference | high | references sibling tool 'sessions_find_events' |
| 2026-10-22 | whoami | oversized_description | low | 4088 chars |
| 2026-10-22 | classes_find_courses | model_directed_instruction | high | an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[ |
| 2026-10-22 | classes_find_resource | model_directed_instruction | high | lace_id, course_id. **Virtual trainers** are always included regardless of place/course filters — they are system-wide place |
| 2026-10-22 | classes_find_resource | cross_tool_reference | high | references sibling tool 'classes_find_courses' |
| 2026-10-22 | classes_find_classes | model_directed_instruction | high | an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[ |
| 2026-10-22 | classes_find_classes | cross_tool_reference | high | references sibling tool 'classes_find_courses' |
| 2026-10-22 | classes_find_classes | oversized_description | low | 4060 chars |
| 2026-10-22 | bookings_find | model_directed_instruction | high | an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[ |
| 2026-10-22 | bookings_find | cross_tool_reference | high | references sibling tool 'classes_find_courses' |
| 2026-10-22 | sessions_find_events | user_concealment | critical | is `member` or `external_member`, the server silently auto-scopes to their assignments anyway; `meta.scoped_to` in the |
| 2026-10-22 | sessions_find_events | model_directed_instruction | high | EIR OWN sessions (any first-person framing), you MUST pass `trainer_id` matching `whoami.identity.user_id`. Without it |
| 2026-10-22 | sessions_find_events | cross_tool_reference | high | references sibling tool 'classes_find_courses' |
| 2026-10-22 | sessions_find_events | oversized_description | low | 4873 chars |
| 2026-10-22 | sessions_get_attendance | model_directed_instruction | high | an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[ |
| 2026-10-22 | sessions_get_attendance | cross_tool_reference | high | references sibling tool 'sessions_find_events' |
| 2026-10-22 | sessions_mark_attendance | user_concealment | critical | tendance_management="limited"`. - `ignore` — hide this event from the attendee's history (Zooza-specific; rare). `use_ |
| 2026-10-22 | sessions_mark_attendance | model_directed_instruction | high | an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[ |
| 2026-10-22 | sessions_mark_attendance | cross_tool_reference | high | references sibling tool 'sessions_find_events' |
| 2026-10-22 | classes_update | user_concealment | critical | ir consequences and let them choose — do NOT silently pick a scope, and do NOT stall. If the operator asks what a casc |
| 2026-10-22 | classes_update | model_directed_instruction | high | an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[ |
| 2026-10-22 | classes_update | cross_tool_reference | high | references sibling tool 'classes_find_resource' |
| 2026-10-22 | sessions_update | model_directed_instruction | high | an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[ |
| 2026-10-22 | sessions_update | cross_tool_reference | high | references sibling tool 'classes_find_resource' |
| 2026-10-22 | sessions_cancel | model_directed_instruction | high | an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[ |
| 2026-10-22 | sessions_cancel | cross_tool_reference | high | references sibling tool 'classes_find_resource' |
| 2026-10-22 | bookings_copy_booking | model_directed_instruction | high | an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[ |
| 2026-10-22 | bookings_copy_booking | cross_tool_reference | high | references sibling tool 'classes_find_classes' |
| 2026-10-22 | comms_send_message | exfiltration_pattern | critical | Comma-separated BCC addresses. |
| 2026-10-22 | comms_send_message | model_directed_instruction | high | an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[ |
| 2026-10-22 | comms_send_message | cross_tool_reference | high | references sibling tool 'classes_find_courses' |
| 2026-10-22 | reports_get_data | cross_tool_reference | high | references sibling tool 'get_skill' |
| 2026-10-22 | get_tool_schema | cross_tool_reference | high | references sibling tool 'call_tool' |
| 2026-10-22 | call_tool | cross_tool_reference | high | references sibling tool 'classes_update' |
Change history (38)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-22 18:17 | get_terminology | mutated | medium |
| 2026-10-22 18:17 | whoami | mutated | high |
| 2026-10-22 18:17 | classes_find_courses | mutated | high |
| 2026-10-22 18:17 | classes_find_resource | added | high |
| 2026-10-22 18:17 | classes_find_classes | mutated | high |
| 2026-10-22 18:17 | bookings_find | mutated | high |
| 2026-10-22 18:17 | sessions_find_events | mutated | critical |
| 2026-10-22 18:17 | sessions_get_attendance | mutated | high |
| 2026-10-22 18:17 | sessions_mark_attendance | mutated | critical |
| 2026-10-22 18:17 | classes_update | added | critical |
| 2026-10-22 18:17 | sessions_update | added | high |
| 2026-10-22 18:17 | sessions_cancel | added | high |
| 2026-10-22 18:17 | bookings_copy_booking | added | high |
| 2026-10-22 18:17 | comms_send_message | added | critical |
| 2026-10-22 18:17 | reports_get_data | mutated | high |
| 2026-10-22 18:17 | get_skill | mutated | medium |
| 2026-10-22 18:17 | get_tool_schema | added | high |
| 2026-10-22 18:17 | call_tool | added | high |
| 2026-10-22 18:17 | explain_data_model | removed | info |
| 2026-10-22 18:17 | comms_list_merge_vars | removed | info |
| 2026-10-22 18:17 | classes_list_schedule_patterns | removed | info |
| 2026-10-22 18:17 | negotiate_terminology | removed | info |
| 2026-10-22 18:17 | classes_find_billing_periods | removed | info |
| 2026-10-22 18:17 | trainers_find_rate_types | removed | info |
| 2026-10-22 18:17 | trainers_find | removed | info |
| 2026-10-22 18:17 | classes_find_places | removed | info |
| 2026-10-22 18:17 | sessions_add_summary | removed | info |
| 2026-10-22 18:17 | classes_preview_schedule | removed | info |
| 2026-10-22 18:17 | classes_preview_events | removed | info |
| 2026-10-22 18:17 | classes_commit_class | removed | info |
| 2026-10-22 18:17 | classes_prepare_update | removed | info |
| 2026-10-22 18:17 | classes_commit_update | removed | info |
| 2026-10-22 18:17 | sessions_prepare_update | removed | info |
| 2026-10-22 18:17 | sessions_commit_update | removed | info |
| 2026-10-22 18:17 | comms_list_templates | removed | info |
| 2026-10-22 18:17 | comms_prepare_message | removed | info |
| 2026-10-22 18:17 | comms_commit_message | removed | info |
| 2026-10-22 18:17 | submit_feedback | removed | info |
Probe history
10-22 18:17 OK (18) · 08-13 06:17 OK (30)
Run or depend on app.zooza/mcp-server? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).