← MCP Registry Integrity Report
com.hadacart/catalog-snapshots
Verdict: high-severity findings present. Endpoint https://hadacart.com/api/catalog/mcp. Tools now: 4 (4 ever seen). Changes recorded: 4. Findings: 1 high, 1 low. Last probe: OK at 2026-10-24T18:17 UTC. JSON
Current tools
find_buying_guides · find_purchase_candidates · get_product · search_products
Findings (2)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-24 | find_purchase_candidates | secret_material_reference | high | Buyer payment preference only; not payment credentials or proof of merchant acceptance. Preserve this preference even |
| 2026-10-24 | find_purchase_candidates | url_in_description | low | https://hadacart.com/agents/tasks.json. |
Change history (4)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-24 18:17 | find_buying_guides | added | info |
| 2026-10-24 18:17 | find_purchase_candidates | added | high |
| 2026-10-24 18:17 | search_products | added | info |
| 2026-10-24 18:17 | get_product | added | info |
Probe history
10-24 18:17 OK (4)
Run or depend on com.hadacart/catalog-snapshots? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).