`com.filtrous/mcp-catalog`

Verdict: high-severity findings present. Endpoint https://filtrous-mcp-catalog.filtrous.workers.dev/mcp. Tools now: 4 (4 ever seen). Changes recorded: 4. Findings: 4 high. Last probe: OK at 2026-10-22T18:17 UTC. JSON

Current tools

get_price_and_lead_time · get_product_details · request_quote · search_products

Findings (5)

seen	tool	detector	severity	evidence (data, not instructions)
2026-10-22	`search_products`	`secret_material_reference`	high	`ags, price, and availability. Open tool — no API key required.`
2026-10-22	`get_product_details`	`secret_material_reference`	high	`images, and spec metafields. Open tool — no API key required.`
2026-10-22	`get_product_details`	`cross_tool_reference`	high	`references sibling tool 'search_products'`
2026-10-22	`get_price_and_lead_time`	`secret_material_reference`	high	`ock for a SKU. KEYED tool — requires a valid API key. Tier pricing and lead time are placeholders until the Acumatica`
2026-10-22	`request_quote`	`secret_material_reference`	high	`contact info. KEYED tool — requires a valid API key. Sales follows up out-of-band.`

Change history (4)

when	tool	kind	severity
2026-10-22 18:17	`search_products`	mutated	high
2026-10-22 18:17	`get_product_details`	mutated	high
2026-10-22 18:17	`get_price_and_lead_time`	mutated	high
2026-10-22 18:17	`request_quote`	mutated	high

Probe history

10-22 18:17 OK (4) · 08-13 18:17 OK (4)

Run or depend on com.filtrous/mcp-catalog? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.

Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).

Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).