← MCP Registry Integrity Report
com.courseprofiler/courseprofiler
Verdict: CRITICAL findings present. Endpoint https://courseprofiler.com/mcp. Tools now: 26 (26 ever seen). Changes recorded: 26. Findings: 4 critical, 5 high, 3 low. Last probe: OK at 2026-10-22T18:17 UTC. JSON
Current tools
analyze_activity · assess_finish_time_goal · build_runner_profile_from_strava · compare_execution · compare_pacing_strategies · create_race_plan · enrich_course_waypoints · export_race_plan_pdf · generate_course_segments · generate_runner_profile · get_activity_submission · get_artifact · get_artifact_upload_requirements · get_course_submission_requirements · get_job · get_race_plan_requirements · get_runner_profile_requirements · get_storage_readiness · import_course · import_profile_attachment · inspect_analysis · inspect_runner_profile · search_race_catalog · submit_course · validate_course_profile · validate_runner_profile
Findings (34)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-22 | create_race_plan | user_concealment | critical | oaded .usrprof source_file artifacts; do not silently use all local files. Ask about intent only when unclear; profile |
| 2026-10-22 | create_race_plan | cross_tool_reference | high | references sibling tool 'search_race_catalog' |
| 2026-10-22 | search_race_catalog | model_directed_instruction | high | t/course/location identity must be confirmed before using the CRSProf URL. |
| 2026-10-22 | import_course | cross_tool_reference | high | references sibling tool 'get_job' |
| 2026-10-22 | enrich_course_waypoints | cross_tool_reference | high | references sibling tool 'import_course' |
| 2026-10-22 | generate_course_segments | cross_tool_reference | high | references sibling tool 'create_race_plan' |
| 2026-10-22 | generate_runner_profile | user_concealment | critical | lection only if not already explicit. Do not silently use every local file. profile_intent is advisory: the server doe |
| 2026-10-22 | generate_runner_profile | secret_material_reference | high | runner_profile_from_strava and never ask for credentials or tokens. Follow its browser-consent/job flow. Pass the genera |
| 2026-10-22 | generate_runner_profile | cross_tool_reference | high | references sibling tool 'create_race_plan' |
| 2026-10-22 | submit_course | url_in_description | low | https://www.goldentrailseries.com/ |
| 2026-10-22 | submit_course | cross_tool_reference | high | references sibling tool 'create_race_plan' |
| 2026-10-22 | get_course_submission_requirements | cross_tool_reference | high | references sibling tool 'submit_course' |
| 2026-10-22 | get_race_plan_requirements | cross_tool_reference | high | references sibling tool 'create_race_plan' |
| 2026-10-22 | get_artifact_upload_requirements | cross_tool_reference | high | references sibling tool 'get_artifact' |
| 2026-10-22 | get_job | cross_tool_reference | high | references sibling tool 'get_artifact' |
| 2026-10-22 | validate_course_profile | cross_tool_reference | high | references sibling tool 'get_artifact' |
| 2026-10-22 | validate_runner_profile | cross_tool_reference | high | references sibling tool 'get_artifact' |
| 2026-10-22 | export_race_plan_pdf | cross_tool_reference | high | references sibling tool 'get_job' |
| 2026-10-22 | build_runner_profile_from_strava | secret_material_reference | high | itly ask whether to merge or replace. Strava credentials are never accepted through MCP: this tool returns a private one |
| 2026-10-22 | build_runner_profile_from_strava | cross_tool_reference | high | references sibling tool 'create_race_plan' |
| 2026-10-22 | analyze_activity | secret_material_reference | high | _token} requires the server feature enabled; API keys are optional. Persist the private caller/key before submission, |
| 2026-10-22 | analyze_activity | url_in_description | low | https://courseprofiler.com/agent-upload.html. |
| 2026-10-22 | analyze_activity | cross_tool_reference | high | references sibling tool 'get_job' |
| 2026-10-22 | inspect_analysis | cross_tool_reference | high | references sibling tool 'analyze_activity' |
| 2026-10-22 | compare_execution | cross_tool_reference | high | references sibling tool 'get_job' |
| 2026-10-22 | inspect_runner_profile | cross_tool_reference | high | references sibling tool 'import_profile_attachment' |
| 2026-10-22 | assess_finish_time_goal | user_concealment | critical | ration require explicit user approval, never silently retry with permission. Returns canonical support/classifications |
| 2026-10-22 | assess_finish_time_goal | cross_tool_reference | high | references sibling tool 'get_artifact' |
| 2026-10-22 | compare_pacing_strategies | user_concealment | critical | ration require explicit user approval, never silently retry with permission. Returns bounded canonical alternatives an |
| 2026-10-22 | compare_pacing_strategies | cross_tool_reference | high | references sibling tool 'get_artifact' |
| 2026-10-22 | import_profile_attachment | url_in_description | low | https://courseprofiler.com/agent-upload.html |
| 2026-10-22 | import_profile_attachment | cross_tool_reference | high | references sibling tool 'inspect_runner_profile' |
| 2026-10-22 | get_activity_submission | secret_material_reference | high | mitting; never expose in URLs/logs. Omit for API-key identity. |
| 2026-10-22 | get_activity_submission | cross_tool_reference | high | references sibling tool 'analyze_activity' |
Change history (26)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-22 18:17 | create_race_plan | mutated | critical |
| 2026-10-22 18:17 | search_race_catalog | mutated | high |
| 2026-10-22 18:17 | import_course | mutated | high |
| 2026-10-22 18:17 | enrich_course_waypoints | mutated | high |
| 2026-10-22 18:17 | generate_course_segments | mutated | high |
| 2026-10-22 18:17 | generate_runner_profile | mutated | critical |
| 2026-10-22 18:17 | submit_course | mutated | high |
| 2026-10-22 18:17 | get_course_submission_requirements | mutated | high |
| 2026-10-22 18:17 | get_race_plan_requirements | mutated | high |
| 2026-10-22 18:17 | get_runner_profile_requirements | mutated | medium |
| 2026-10-22 18:17 | get_artifact_upload_requirements | mutated | high |
| 2026-10-22 18:17 | get_job | mutated | high |
| 2026-10-22 18:17 | get_artifact | mutated | medium |
| 2026-10-22 18:17 | validate_course_profile | mutated | high |
| 2026-10-22 18:17 | validate_runner_profile | mutated | high |
| 2026-10-22 18:17 | export_race_plan_pdf | mutated | high |
| 2026-10-22 18:17 | build_runner_profile_from_strava | added | high |
| 2026-10-22 18:17 | analyze_activity | added | high |
| 2026-10-22 18:17 | inspect_analysis | added | high |
| 2026-10-22 18:17 | compare_execution | added | high |
| 2026-10-22 18:17 | inspect_runner_profile | added | high |
| 2026-10-22 18:17 | assess_finish_time_goal | added | critical |
| 2026-10-22 18:17 | compare_pacing_strategies | added | critical |
| 2026-10-22 18:17 | import_profile_attachment | added | high |
| 2026-10-22 18:17 | get_storage_readiness | added | info |
| 2026-10-22 18:17 | get_activity_submission | added | high |
Probe history
10-22 18:17 OK (26) · 08-13 12:17 OK (16)
Run or depend on com.courseprofiler/courseprofiler? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).