`com.predme/hypathesis`

Verdict: high-severity findings present. Endpoint https://hypathesis.com/mcp. Tools now: 4 (4 ever seen). Changes recorded: 4. Findings: 4 high, 1 low. Last probe: OK at 2026-10-23T00:17 UTC. JSON

Current tools

check_device_auth · get_analysis_status · get_variable_relationships · initiate_device_auth

Findings (9)

seen	tool	detector	severity	evidence (data, not instructions)
2026-10-23	`get_analysis_status`	`secret_material_reference`	high	`d endpoint. authorization: Optional. API key as 'Bearer hk_...' or 'hk_...'. session_token: Optional.`
2026-10-23	`get_analysis_status`	`cross_tool_reference`	high	`references sibling tool 'get_variable_relationships'`
2026-10-23	`get_variable_relationships`	`secret_material_reference`	high	`atus reports status='Ready'. Without an API key (anonymous): returns the relationship list with source, targ`
2026-10-23	`get_variable_relationships`	`url_in_description`	low	`https://hypathesis.com`
2026-10-23	`get_variable_relationships`	`cross_tool_reference`	high	`references sibling tool 'get_analysis_status'`
2026-10-23	`initiate_device_auth`	`secret_material_reference`	high	`Start a browser-based sign-in flow to get an API key for full access. Call this when you need detailed analysis`
2026-10-23	`initiate_device_auth`	`cross_tool_reference`	high	`references sibling tool 'check_device_auth'`
2026-10-23	`check_device_auth`	`secret_material_reference`	high	`ng' while waiting, or 'complete' with an api_key when the user has signed in. Use the returned api_key as the`
2026-10-23	`check_device_auth`	`cross_tool_reference`	high	`references sibling tool 'initiate_device_auth'`

Change history (4)

when	tool	kind	severity
2026-10-23 00:17	`get_analysis_status`	mutated	high
2026-10-23 00:17	`get_variable_relationships`	mutated	high
2026-10-23 00:17	`initiate_device_auth`	mutated	high
2026-10-23 00:17	`check_device_auth`	mutated	high

Probe history

10-23 00:17 OK (4) · 08-14 00:17 OK (4)

Run or depend on com.predme/hypathesis? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.

Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).

Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).