← MCP Registry Integrity Report
com.kenwea.www/marketplace
Verdict: CRITICAL findings present. Endpoint https://mcp.kenwea.com/mcp/v1. Tools now: 29 (41 ever seen). Changes recorded: 41. Findings: 6 high, 2 low, 1 critical. Last probe: OK at 2026-10-23T00:17 UTC. JSON
Current tools
kenwea.agent.getIdentity · kenwea.agent.sendHeartbeat · kenwea.analytics.getForecast · kenwea.collab.create · kenwea.collab.join · kenwea.community.ask · kenwea.dependencies.watch · kenwea.jobs.getStatus · kenwea.marketplace.getProduct · kenwea.marketplace.install · kenwea.marketplace.preview · kenwea.marketplace.publish · kenwea.marketplace.purchase · kenwea.marketplace.search · kenwea.notifications.ack · kenwea.notifications.list · kenwea.observer.getFeed · kenwea.onboarding.registerSelf · kenwea.onboarding.startOperatorAgent · kenwea.orders.deliver · kenwea.orders.listRequests · kenwea.orders.submitBid · kenwea.procurement.listDecisions · kenwea.recommendations.listRelatedProducts · kenwea.reputation.getGraph · kenwea.sandbox.check · kenwea.scale.getStatus · kenwea.wallet.getBalance · kenwea.wallet.listTransactions
Findings (37)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-23 | kenwea.agent.getIdentity | model_directed_instruction | high | with operator_required: no operatorId means you must be claimed (kenwea.onboarding.registerSelf gave you the pairing |
| 2026-10-23 | kenwea.agent.getIdentity | cross_tool_reference | high | references sibling tool 'kenwea.onboarding.registerSelf' |
| 2026-10-23 | kenwea.agent.sendHeartbeat | cross_tool_reference | high | references sibling tool 'kenwea.jobs.getStatus' |
| 2026-10-23 | kenwea.analytics.getForecast | cross_tool_reference | high | references sibling tool 'kenwea.marketplace.search' |
| 2026-10-23 | kenwea.collab.create | cross_tool_reference | high | references sibling tool 'kenwea.collab.join' |
| 2026-10-23 | kenwea.collab.join | cross_tool_reference | high | references sibling tool 'kenwea.notifications.list' |
| 2026-10-23 | kenwea.community.ask | cross_tool_reference | high | references sibling tool 'kenwea.orders.listRequests' |
| 2026-10-23 | kenwea.dependencies.watch | cross_tool_reference | high | references sibling tool 'kenwea.marketplace.search' |
| 2026-10-23 | kenwea.jobs.getStatus | cross_tool_reference | high | references sibling tool 'kenwea.marketplace.preview' |
| 2026-10-23 | kenwea.marketplace.getProduct | secret_material_reference | high | stalled (nothing_runs, quiet, network, reads_credentials, sends_credentials, unfinished), and the signed record can be f |
| 2026-10-23 | kenwea.marketplace.getProduct | url_in_description | low | https://api.kenwea.com/public/notary/records/<recordId |
| 2026-10-23 | kenwea.marketplace.getProduct | cross_tool_reference | high | references sibling tool 'kenwea.marketplace.search' |
| 2026-10-23 | kenwea.marketplace.install | cross_tool_reference | high | references sibling tool 'kenwea.marketplace.purchase' |
| 2026-10-23 | kenwea.marketplace.preview | cross_tool_reference | high | references sibling tool 'kenwea.jobs.getStatus' |
| 2026-10-23 | kenwea.marketplace.publish | url_in_description | low | https://, |
| 2026-10-23 | kenwea.marketplace.publish | cross_tool_reference | high | references sibling tool 'kenwea.jobs.getStatus' |
| 2026-10-23 | kenwea.marketplace.purchase | cross_tool_reference | high | references sibling tool 'kenwea.marketplace.install' |
| 2026-10-23 | kenwea.marketplace.search | cross_tool_reference | high | references sibling tool 'kenwea.analytics.getForecast' |
| 2026-10-23 | kenwea.notifications.ack | cross_tool_reference | high | references sibling tool 'kenwea.notifications.list' |
| 2026-10-23 | kenwea.notifications.list | cross_tool_reference | high | references sibling tool 'kenwea.notifications.ack' |
| 2026-10-23 | kenwea.observer.getFeed | cross_tool_reference | high | references sibling tool 'kenwea.notifications.list' |
| 2026-10-23 | kenwea.onboarding.registerSelf | user_concealment | critical | often gets wrong by sending `name`, which is silently ignored and then reported as a missing agent name. |
| 2026-10-23 | kenwea.onboarding.registerSelf | secret_material_reference | high | Self-register as a new agent with no credential and no human. Send agentName (not name, which is ignored); decla |
| 2026-10-23 | kenwea.onboarding.registerSelf | cross_tool_reference | high | references sibling tool 'kenwea.onboarding.startOperatorAgent' |
| 2026-10-23 | kenwea.onboarding.startOperatorAgent | secret_material_reference | high | der the calling operator and issue its first API key. agentName is the new agent's display name and keyLabel names th |
| 2026-10-23 | kenwea.onboarding.startOperatorAgent | cross_tool_reference | high | references sibling tool 'kenwea.onboarding.registerSelf' |
| 2026-10-23 | kenwea.orders.listRequests | cross_tool_reference | high | references sibling tool 'kenwea.community.ask' |
| 2026-10-23 | kenwea.orders.submitBid | cross_tool_reference | high | references sibling tool 'kenwea.orders.deliver' |
| 2026-10-23 | kenwea.procurement.listDecisions | secret_material_reference | high | Always true: procurement records never carry credentials. |
| 2026-10-23 | kenwea.procurement.listDecisions | cross_tool_reference | high | references sibling tool 'kenwea.wallet.listTransactions' |
| 2026-10-23 | kenwea.recommendations.listRelatedProducts | cross_tool_reference | high | references sibling tool 'kenwea.marketplace.search' |
| 2026-10-23 | kenwea.reputation.getGraph | cross_tool_reference | high | references sibling tool 'kenwea.agent.getIdentity' |
| 2026-10-23 | kenwea.sandbox.check | secret_material_reference | high | Credential-shaped patterns found. Pattern matches, not proof of intent. |
| 2026-10-23 | kenwea.sandbox.check | cross_tool_reference | high | references sibling tool 'kenwea.marketplace.preview' |
| 2026-10-23 | kenwea.scale.getStatus | cross_tool_reference | high | references sibling tool 'kenwea.agent.sendHeartbeat' |
| 2026-10-23 | kenwea.wallet.getBalance | cross_tool_reference | high | references sibling tool 'kenwea.wallet.listTransactions' |
| 2026-10-23 | kenwea.wallet.listTransactions | cross_tool_reference | high | references sibling tool 'kenwea.procurement.listDecisions' |
Change history (41)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-23 00:17 | kenwea.agent.getIdentity | added | high |
| 2026-10-23 00:17 | kenwea.agent.sendHeartbeat | added | high |
| 2026-10-23 00:17 | kenwea.analytics.getForecast | added | high |
| 2026-10-23 00:17 | kenwea.collab.create | mutated | high |
| 2026-10-23 00:17 | kenwea.collab.join | mutated | high |
| 2026-10-23 00:17 | kenwea.community.ask | mutated | high |
| 2026-10-23 00:17 | kenwea.dependencies.watch | mutated | high |
| 2026-10-23 00:17 | kenwea.jobs.getStatus | mutated | high |
| 2026-10-23 00:17 | kenwea.marketplace.getProduct | added | high |
| 2026-10-23 00:17 | kenwea.marketplace.install | mutated | high |
| 2026-10-23 00:17 | kenwea.marketplace.preview | mutated | high |
| 2026-10-23 00:17 | kenwea.marketplace.publish | mutated | high |
| 2026-10-23 00:17 | kenwea.marketplace.purchase | mutated | high |
| 2026-10-23 00:17 | kenwea.marketplace.search | mutated | high |
| 2026-10-23 00:17 | kenwea.notifications.ack | mutated | high |
| 2026-10-23 00:17 | kenwea.notifications.list | mutated | high |
| 2026-10-23 00:17 | kenwea.observer.getFeed | added | high |
| 2026-10-23 00:17 | kenwea.onboarding.registerSelf | mutated | critical |
| 2026-10-23 00:17 | kenwea.onboarding.startOperatorAgent | mutated | high |
| 2026-10-23 00:17 | kenwea.orders.deliver | mutated | medium |
| 2026-10-23 00:17 | kenwea.orders.listRequests | mutated | high |
| 2026-10-23 00:17 | kenwea.orders.submitBid | mutated | high |
| 2026-10-23 00:17 | kenwea.procurement.listDecisions | added | high |
| 2026-10-23 00:17 | kenwea.recommendations.listRelatedProducts | added | high |
| 2026-10-23 00:17 | kenwea.reputation.getGraph | added | high |
| 2026-10-23 00:17 | kenwea.sandbox.check | mutated | high |
| 2026-10-23 00:17 | kenwea.scale.getStatus | added | high |
| 2026-10-23 00:17 | kenwea.wallet.getBalance | added | high |
| 2026-10-23 00:17 | kenwea.wallet.listTransactions | added | high |
| 2026-10-23 00:17 | kenwea.agent.heartbeat | removed | info |
| 2026-10-23 00:17 | kenwea.agent.identity | removed | info |
| 2026-10-23 00:17 | kenwea.analytics.forecast | removed | info |
| 2026-10-23 00:17 | kenwea.auth.identify | removed | info |
| 2026-10-23 00:17 | kenwea.auth.profile | removed | info |
| 2026-10-23 00:17 | kenwea.observer.feed | removed | info |
| 2026-10-23 00:17 | kenwea.procurement.memory | removed | info |
| 2026-10-23 00:17 | kenwea.recommendations.relatedProducts | removed | info |
| 2026-10-23 00:17 | kenwea.reputation.graph | removed | info |
| 2026-10-23 00:17 | kenwea.scale.status | removed | info |
| 2026-10-23 00:17 | kenwea.wallet.balance | removed | info |
| 2026-10-23 00:17 | kenwea.wallet.transactions | removed | info |
Probe history
10-23 00:17 OK (29) · 08-13 18:17 OK (30)
Run or depend on com.kenwea.www/marketplace? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).