← MCP Registry Integrity Report
com.leap-labs/discovery-engine
Verdict: high-severity findings present. Endpoint https://disco.leap-labs.com/mcp. Tools now: 14 (14 ever seen). Changes recorded: 14. Findings: 14 high, 1 low. Last probe: OK at 2026-10-23T00:17 UTC. JSON
Current tools
discovery_account · discovery_add_payment_method · discovery_analyze · discovery_estimate · discovery_get_results · discovery_list_plans · discovery_login · discovery_login_verify · discovery_purchase_credits · discovery_signup · discovery_signup_verify · discovery_status · discovery_subscribe · discovery_upload
Findings (25)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-23 | discovery_estimate | secret_material_reference | high | ts. No authentication required — when an API key is supplied, also returns the caller's available credits. |
| 2026-10-23 | discovery_estimate | cross_tool_reference | high | references sibling tool 'discovery_analyze' |
| 2026-10-23 | discovery_upload | secret_material_reference | high | h file_content. Default: "data.csv". api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va |
| 2026-10-23 | discovery_upload | cross_tool_reference | high | references sibling tool 'discovery_analyze' |
| 2026-10-23 | discovery_analyze | model_directed_instruction | high | . Only applies to private runs — public runs always use LLMs. Default false. api_key: Disco API key (disco_...). |
| 2026-10-23 | discovery_analyze | secret_material_reference | high | s used to create the account (email code, no password needed). Call discovery_upload first to upload your file, t |
| 2026-10-23 | discovery_analyze | cross_tool_reference | high | references sibling tool 'discovery_estimate' |
| 2026-10-23 | discovery_status | secret_material_reference | high | un ID returned by discovery_analyze. api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va |
| 2026-10-23 | discovery_status | cross_tool_reference | high | references sibling tool 'discovery_analyze' |
| 2026-10-23 | discovery_get_results | secret_material_reference | high | un ID returned by discovery_analyze. api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va |
| 2026-10-23 | discovery_get_results | cross_tool_reference | high | references sibling tool 'discovery_analyze' |
| 2026-10-23 | discovery_account | secret_material_reference | high | nning a private analysis. Args: api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va |
| 2026-10-23 | discovery_signup | secret_material_reference | high | Create a Disco account and get an API key. Provide an email address to start the signup flow. If emai |
| 2026-10-23 | discovery_signup | cross_tool_reference | high | references sibling tool 'discovery_signup_verify' |
| 2026-10-23 | discovery_signup_verify | secret_material_reference | high | address used in discovery_signup. Returns an API key on success. Args: email: Email address used in the |
| 2026-10-23 | discovery_signup_verify | cross_tool_reference | high | references sibling tool 'discovery_signup' |
| 2026-10-23 | discovery_login | secret_material_reference | high | Get a new API key for an existing Disco account. Sends a 6-digit verification |
| 2026-10-23 | discovery_login | cross_tool_reference | high | references sibling tool 'discovery_signup' |
| 2026-10-23 | discovery_login_verify | secret_material_reference | high | Complete login and receive a new API key. Call this after discovery_login returns {"status": "verifi |
| 2026-10-23 | discovery_login_verify | cross_tool_reference | high | references sibling tool 'discovery_login' |
| 2026-10-23 | discovery_add_payment_method | secret_material_reference | high | ethod ID (pm_...) from Stripe's API. api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va |
| 2026-10-23 | discovery_add_payment_method | url_in_description | low | https://api.stripe.com/v1/payment_methods |
| 2026-10-23 | discovery_purchase_credits | secret_material_reference | high | credit packs to purchase. Default 1. api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va |
| 2026-10-23 | discovery_purchase_credits | cross_tool_reference | high | references sibling tool 'discovery_add_payment_method' |
| 2026-10-23 | discovery_subscribe | secret_material_reference | high | "free_tier", "tier_1", or "tier_2"). api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va |
Change history (14)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-23 00:17 | discovery_list_plans | mutated | medium |
| 2026-10-23 00:17 | discovery_estimate | mutated | high |
| 2026-10-23 00:17 | discovery_upload | mutated | high |
| 2026-10-23 00:17 | discovery_analyze | mutated | high |
| 2026-10-23 00:17 | discovery_status | mutated | high |
| 2026-10-23 00:17 | discovery_get_results | mutated | high |
| 2026-10-23 00:17 | discovery_account | mutated | high |
| 2026-10-23 00:17 | discovery_signup | mutated | high |
| 2026-10-23 00:17 | discovery_signup_verify | mutated | high |
| 2026-10-23 00:17 | discovery_login | mutated | high |
| 2026-10-23 00:17 | discovery_login_verify | mutated | high |
| 2026-10-23 00:17 | discovery_add_payment_method | mutated | high |
| 2026-10-23 00:17 | discovery_purchase_credits | mutated | high |
| 2026-10-23 00:17 | discovery_subscribe | mutated | high |
Probe history
10-23 00:17 OK (14) · 08-13 18:17 OK (14)
Run or depend on com.leap-labs/discovery-engine? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).