← MCP Registry Integrity Report
com.googleapis.stitch/mcp
Verdict: high-severity findings present. Endpoint https://stitch.googleapis.com/mcp. Tools now: 16 (16 ever seen). Changes recorded: 16. Findings: 1 high. Last probe: OK at 2026-10-22T18:17 UTC. JSON
Current tools
apply_design_system · create_design_system · create_design_system_from_design_md · create_project · delete_project · download_file · edit_screens · generate_screen_from_text · generate_variants · get_project · get_screen · list_design_systems · list_projects · list_screens · update_design_system · upload_design_md
Findings (8)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-22 | download_file | secret_material_reference | high | `download_url` directly: those URLs require credentials and return a JSON wrapper rather than the file. **Output:** * |
| 2026-10-22 | download_file | cross_tool_reference | high | references sibling tool 'list_screens' |
| 2026-10-22 | generate_screen_from_text | cross_tool_reference | high | references sibling tool 'get_screen' |
| 2026-10-22 | generate_variants | cross_tool_reference | high | references sibling tool 'get_screen' |
| 2026-10-22 | upload_design_md | cross_tool_reference | high | references sibling tool 'create_design_system' |
| 2026-10-22 | create_design_system | cross_tool_reference | high | references sibling tool 'update_design_system' |
| 2026-10-22 | create_design_system_from_design_md | cross_tool_reference | high | references sibling tool 'get_project' |
| 2026-10-22 | apply_design_system | cross_tool_reference | high | references sibling tool 'get_project' |
Change history (16)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-22 18:17 | create_project | mutated | medium |
| 2026-10-22 18:17 | get_project | mutated | medium |
| 2026-10-22 18:17 | delete_project | mutated | medium |
| 2026-10-22 18:17 | list_projects | mutated | medium |
| 2026-10-22 18:17 | list_screens | mutated | medium |
| 2026-10-22 18:17 | get_screen | mutated | medium |
| 2026-10-22 18:17 | download_file | added | high |
| 2026-10-22 18:17 | generate_screen_from_text | mutated | high |
| 2026-10-22 18:17 | edit_screens | mutated | medium |
| 2026-10-22 18:17 | generate_variants | mutated | high |
| 2026-10-22 18:17 | upload_design_md | mutated | high |
| 2026-10-22 18:17 | create_design_system | mutated | high |
| 2026-10-22 18:17 | create_design_system_from_design_md | mutated | high |
| 2026-10-22 18:17 | update_design_system | mutated | medium |
| 2026-10-22 18:17 | list_design_systems | mutated | medium |
| 2026-10-22 18:17 | apply_design_system | mutated | high |
Probe history
10-22 18:17 OK (16) · 08-13 18:17 OK (15)
Run or depend on com.googleapis.stitch/mcp? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).