← MCP Registry Integrity Report
com.ontarioprotocol/ontario-protocol
Verdict: high-severity findings present. Endpoint https://ontarioprotocol.com/mcp. Tools now: 17 (17 ever seen). Changes recorded: 17. Findings: 10 high. Last probe: OK at 2026-10-23T00:17 UTC. JSON
Current tools
agent_can_pay · agent_trust_preview · bazaar_buyer_intent_gap · find_x402_tool · github_x402_repo_scan · ontario_find-api · ontario_list-agent · ontario_list-service · ontario_purchase_router · ontario_refresh-listing · ontario_task_fit · ontario_validate-agent · ontario_validate-refresh · ontario_validate-service · x402_launch_kit · x402_readiness_verify · x402_verification_reports
Findings (10)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-23 | ontario_purchase_router | secret_material_reference | high | Public task description only; never include credentials or private customer data. |
| 2026-10-23 | agent_can_pay | secret_material_reference | high | nt to evaluate before payment; never include credentials or private query parameters. |
| 2026-10-23 | x402_readiness_verify | secret_material_reference | high | RL to inspect without payment. Do not submit credentials, private hosts, or sensitive query parameters. |
| 2026-10-23 | bazaar_buyer_intent_gap | secret_material_reference | high | ould use in CDP Bazaar search; never include credentials or private customer text. |
| 2026-10-23 | find_x402_tool | secret_material_reference | high | arket, and Coinbase CDP Bazaar. Rank public, credential-free endpoint candidates by task relevance plus bounded source-r |
| 2026-10-23 | ontario_find-api | secret_material_reference | high | 'web search for an AI agent'. Never include credentials or private data. |
| 2026-10-23 | x402_launch_kit | secret_material_reference | high | drafts. Omit private addresses; never supply credentials. |
| 2026-10-23 | ontario_validate-service | secret_material_reference | high | es. Omit when unnecessary; never send wallet credentials. |
| 2026-10-23 | ontario_list-service | secret_material_reference | high | es. Omit when unnecessary; never send wallet credentials. |
| 2026-10-23 | agent_trust_preview | secret_material_reference | high | hout payment; never include private hosts or credentials. |
Change history (17)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-23 00:17 | ontario_purchase_router | mutated | high |
| 2026-10-23 00:17 | ontario_task_fit | added | info |
| 2026-10-23 00:17 | agent_can_pay | mutated | high |
| 2026-10-23 00:17 | x402_readiness_verify | mutated | high |
| 2026-10-23 00:17 | bazaar_buyer_intent_gap | mutated | high |
| 2026-10-23 00:17 | find_x402_tool | mutated | high |
| 2026-10-23 00:17 | ontario_find-api | added | high |
| 2026-10-23 00:17 | x402_launch_kit | mutated | high |
| 2026-10-23 00:17 | ontario_validate-service | added | high |
| 2026-10-23 00:17 | ontario_list-service | mutated | high |
| 2026-10-23 00:17 | ontario_refresh-listing | mutated | medium |
| 2026-10-23 00:17 | agent_trust_preview | added | high |
| 2026-10-23 00:17 | github_x402_repo_scan | added | info |
| 2026-10-23 00:17 | ontario_list-agent | added | info |
| 2026-10-23 00:17 | ontario_validate-agent | added | info |
| 2026-10-23 00:17 | ontario_validate-refresh | added | info |
| 2026-10-23 00:17 | x402_verification_reports | added | info |
Probe history
10-23 00:17 OK (17) · 08-13 18:17 OK (8)
Run or depend on com.ontarioprotocol/ontario-protocol? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).