`com.kalemap/menu`

Verdict: high-severity findings present. Endpoint https://kalemap.com/mcp. Tools now: 6 (6 ever seen). Changes recorded: 6. Findings: 1 high. Last probe: OK at 2026-10-24T00:17 UTC. JSON

Current tools

city_vegan_places · get_menu · list_cities · place_vegan_options · places_near · search_places

Findings (3)

seen	tool	detector	severity	evidence (data, not instructions)
2026-10-24	`get_menu`	`secret_material_reference`	high	`and explicit unknowns. Requires a developer API key or a consented OAuth connection in the Authorization header. Eac`
2026-10-24	`place_vegan_options`	`cross_tool_reference`	high	`references sibling tool 'get_menu'`
2026-10-24	`city_vegan_places`	`cross_tool_reference`	high	`references sibling tool 'list_cities'`

Change history (6)

when	tool	kind	severity
2026-10-24 00:17	`get_menu`	added	high
2026-10-24 00:17	`search_places`	added	info
2026-10-24 00:17	`place_vegan_options`	added	high
2026-10-24 00:17	`places_near`	added	info
2026-10-24 00:17	`city_vegan_places`	added	high
2026-10-24 00:17	`list_cities`	added	info

Probe history

10-24 00:17 OK (6)

Run or depend on com.kalemap/menu? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.

Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).

Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).