`com.gojinko.mcp/jinko`

Verdict: CRITICAL findings present. Endpoint https://mcp.gojinko.com. Tools now: 7 (7 ever seen). Changes recorded: 7. Findings: 8 high, 5 low, 3 critical. Last probe: OK at 2026-10-22T18:17 UTC. JSON

Current tools

book · find_destination · flight_calendar · flight_search · hotel_details · hotel_search · trip

Findings (23)

seen	tool	detector	severity	evidence (data, not instructions)
2026-10-22	`flight_calendar`	`secret_material_reference`	high	`addresses or device identifiers - Account credentials (passwords, tokens, API keys) - Health or biometric data -`
2026-10-22	`flight_calendar`	`cross_tool_reference`	high	`references sibling tool 'find_destination'`
2026-10-22	`find_destination`	`secret_material_reference`	high	`addresses or device identifiers - Account credentials (passwords, tokens, API keys) - Health or biometric data -`
2026-10-22	`find_destination`	`cross_tool_reference`	high	`references sibling tool 'flight_calendar'`
2026-10-22	`find_destination`	`oversized_description`	low	`4177 chars`
2026-10-22	`flight_search`	`user_concealment`	critical	`ssenger list (e.g. dropping an infant); that silently changes the user's request. PRICE CHECK FILTERS ARE NOT APPLIED`
2026-10-22	`flight_search`	`secret_material_reference`	high	`addresses or device identifiers - Account credentials (passwords, tokens, API keys) - Health or biometric data -`
2026-10-22	`flight_search`	`cross_tool_reference`	high	`references sibling tool 'flight_calendar'`
2026-10-22	`flight_search`	`oversized_description`	low	`11613 chars`
2026-10-22	`hotel_search`	`user_concealment`	critical	`retry hotel_name with corrected scope. Never silently auto-pick a low-confidence candidate. ERROR HANDLING — 422 DEST`
2026-10-22	`hotel_search`	`secret_material_reference`	high	`addresses or device identifiers - Account credentials (passwords, tokens, API keys) - Health or biometric data -`
2026-10-22	`hotel_search`	`cross_tool_reference`	high	`references sibling tool 'flight_search'`
2026-10-22	`hotel_search`	`oversized_description`	low	`11174 chars`
2026-10-22	`hotel_details`	`secret_material_reference`	high	`addresses or device identifiers - Account credentials (passwords, tokens, API keys) - Health or biometric data -`
2026-10-22	`hotel_details`	`cross_tool_reference`	high	`references sibling tool 'hotel_search'`
2026-10-22	`trip`	`user_concealment`	critical	`your tool-call history — the host runs them silently. • After a silent add, the widget sends a follow-up message that`
2026-10-22	`trip`	`model_directed_instruction`	high	`turns NO_ACTION error and confuses the user. Always include at least trip_id (when known) or one action object. WIDGET-EMIT`
2026-10-22	`trip`	`secret_material_reference`	high	`addresses or device identifiers - Account credentials (passwords, tokens, API keys) - Health or biometric data -`
2026-10-22	`trip`	`cross_tool_reference`	high	`references sibling tool 'flight_calendar'`
2026-10-22	`trip`	`oversized_description`	low	`8732 chars`
2026-10-22	`book`	`secret_material_reference`	high	`addresses or device identifiers - Account credentials (passwords, tokens, API keys) - Health or biometric data -`
2026-10-22	`book`	`url_in_description`	low	`https://checkout.stripe.com/...`
2026-10-22	`book`	`cross_tool_reference`	high	`references sibling tool 'flight_calendar'`

Change history (7)

when	tool	kind	severity
2026-10-22 18:17	`flight_calendar`	mutated	high
2026-10-22 18:17	`find_destination`	mutated	high
2026-10-22 18:17	`flight_search`	mutated	critical
2026-10-22 18:17	`hotel_search`	mutated	critical
2026-10-22 18:17	`hotel_details`	mutated	high
2026-10-22 18:17	`trip`	mutated	critical
2026-10-22 18:17	`book`	mutated	high

Probe history

10-22 18:17 OK (7) · 08-13 18:17 OK (7)

Run or depend on com.gojinko.mcp/jinko? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.

Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).

Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).