`com.noseforleads/leads-mcp`

Verdict: CRITICAL findings present. Endpoint https://api.noseforleads.com/mcp. Tools now: 11 (11 ever seen). Changes recorded: 11. Findings: 11 critical, 3 high. Last probe: OK at 2026-10-23T00:17 UTC. JSON

Current tools

add_suppression · fetch_results · get_campaign_status · get_credits · get_icp_pack · get_usage · list_campaigns · review_lead · send_feedback · start_campaign · translate_icp

Findings (18)

seen	tool	detector	severity	evidence (data, not instructions)
2026-10-23	`translate_icp`	`user_concealment`	critical	ig pydantic's default `extra="ignore"` would silently strip setup_url on model_validate, before it ever reached model_
2026-10-23	`translate_icp`	`cross_tool_reference`	high	`references sibling tool 'start_campaign'`
2026-10-23	`start_campaign`	`user_concealment`	critical	ming it; an unknown top-level `query` key is silently ignored, so keep to predicates/rank/discovery — a typo t
2026-10-23	`start_campaign`	`cross_tool_reference`	high	`references sibling tool 'translate_icp'`
2026-10-23	`get_campaign_status`	`user_concealment`	critical	ig pydantic's default `extra="ignore"` would silently strip setup_url on model_validate, before it ever reached model_
2026-10-23	`fetch_results`	`user_concealment`	critical	ig pydantic's default `extra="ignore"` would silently strip setup_url on model_validate, before it ever reached model_
2026-10-23	`fetch_results`	`secret_material_reference`	high	`liver), key_budget_exhausted (the submitting API key's own budget ran out, though the account may still have credit).`
2026-10-23	`get_icp_pack`	`user_concealment`	critical	ig pydantic's default `extra="ignore"` would silently strip setup_url on model_validate, before it ever reached model_
2026-10-23	`add_suppression`	`user_concealment`	critical	ig pydantic's default `extra="ignore"` would silently strip setup_url on model_validate, before it ever reached model_
2026-10-23	`review_lead`	`user_concealment`	critical	ig pydantic's default `extra="ignore"` would silently strip setup_url on model_validate, before it ever reached model_
2026-10-23	`review_lead`	`cross_tool_reference`	high	`references sibling tool 'fetch_results'`
2026-10-23	`get_credits`	`user_concealment`	critical	ig pydantic's default `extra="ignore"` would silently strip setup_url on model_validate, before it ever reached model_
2026-10-23	`get_credits`	`secret_material_reference`	high	`s low. When you authenticate with an API key this also returns YOUR key's remaining budgets — check i`
2026-10-23	`list_campaigns`	`user_concealment`	critical	ig pydantic's default `extra="ignore"` would silently strip setup_url on model_validate, before it ever reached model_
2026-10-23	`list_campaigns`	`secret_material_reference`	high	`label of the API key that submitted it; null for dashboard-submitted campaigns`
2026-10-23	`list_campaigns`	`cross_tool_reference`	high	`references sibling tool 'get_campaign_status'`
2026-10-23	`get_usage`	`user_concealment`	critical	ig pydantic's default `extra="ignore"` would silently strip setup_url on model_validate, before it ever reached model_
2026-10-23	`send_feedback`	`user_concealment`	critical	ig pydantic's default `extra="ignore"` would silently strip setup_url on model_validate, before it ever reached model_

Change history (11)

when	tool	kind	severity
2026-10-23 00:17	`translate_icp`	mutated	critical
2026-10-23 00:17	`start_campaign`	mutated	critical
2026-10-23 00:17	`get_campaign_status`	mutated	critical
2026-10-23 00:17	`fetch_results`	mutated	critical
2026-10-23 00:17	`get_icp_pack`	mutated	critical
2026-10-23 00:17	`add_suppression`	mutated	critical
2026-10-23 00:17	`review_lead`	mutated	critical
2026-10-23 00:17	`get_credits`	mutated	critical
2026-10-23 00:17	`list_campaigns`	mutated	critical
2026-10-23 00:17	`get_usage`	mutated	critical
2026-10-23 00:17	`send_feedback`	mutated	critical

Probe history

10-23 00:17 OK (11) · 08-13 18:17 OK (11)

Run or depend on com.noseforleads/leads-mcp? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.

Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).

Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).