`com.abbyseo/mcp-server`

Verdict: high-severity findings present. Endpoint https://www.abbyseo.com/mcp. Tools now: 8 (8 ever seen). Changes recorded: 8. Findings: 2 high. Last probe: OK at 2026-10-22T18:17 UTC. JSON

Current tools

find_my_reports · get_purchase_status · get_remediation_plan · get_scan_results · get_scan_status · how_to_use · purchase_report · submit_scan

Findings (9)

seen	tool	detector	severity	evidence (data, not instructions)
2026-10-22	`submit_scan`	`model_directed_instruction`	high	`a website URL. Returns a scan_id to poll. You MUST collect the user's email address before calling this tool — th`
2026-10-22	`submit_scan`	`cross_tool_reference`	high	`references sibling tool 'get_scan_status'`
2026-10-22	`get_scan_status`	`cross_tool_reference`	high	`references sibling tool 'submit_scan'`
2026-10-22	`get_scan_results`	`cross_tool_reference`	high	`references sibling tool 'submit_scan'`
2026-10-22	`purchase_report`	`cross_tool_reference`	high	`references sibling tool 'submit_scan'`
2026-10-22	`get_remediation_plan`	`model_directed_instruction`	high	`ings, explicit '❓ ASK THE OWNER' stops where you must get the owner's input (never invent brand names, keywords, phone`
2026-10-22	`get_remediation_plan`	`cross_tool_reference`	high	`references sibling tool 'submit_scan'`
2026-10-22	`get_purchase_status`	`cross_tool_reference`	high	`references sibling tool 'submit_scan'`
2026-10-22	`find_my_reports`	`cross_tool_reference`	high	`references sibling tool 'purchase_report'`

Change history (8)

when	tool	kind	severity
2026-10-22 18:17	`submit_scan`	mutated	high
2026-10-22 18:17	`get_scan_status`	mutated	high
2026-10-22 18:17	`get_scan_results`	mutated	high
2026-10-22 18:17	`purchase_report`	mutated	high
2026-10-22 18:17	`get_remediation_plan`	mutated	high
2026-10-22 18:17	`get_purchase_status`	mutated	high
2026-10-22 18:17	`find_my_reports`	mutated	high
2026-10-22 18:17	`how_to_use`	mutated	medium

Probe history

10-22 18:17 OK (8) · 08-13 12:17 OK (8)

Run or depend on com.abbyseo/mcp-server? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.

Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).

Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).