`com.tabularrecipe/tabular-recipe`

Verdict: high-severity findings present. Endpoint https://api.tabularrecipe.com/mcp. Tools now: 8 (8 ever seen). Changes recorded: 8. Findings: 3 high. Last probe: OK at 2026-10-23T00:17 UTC. JSON

Current tools

checkout_status · claim_checkout · convert_recipe · create_checkout · get_usage · list_styles · parse_recipe · render_recipe

Findings (3)

seen	tool	detector	severity	evidence (data, not instructions)
2026-10-23	`create_checkout`	`secret_material_reference`	high	`sted checkout for a credit bundle without an API key. Returns a checkout URL and a secret one-time claim token. A hum`
2026-10-23	`checkout_status`	`secret_material_reference`	high	`its sessionId and secret claimToken, but no API key.`
2026-10-23	`claim_checkout`	`secret_material_reference`	high	`eckout plus its secret claim token for a new API key. The key is returned once; store it immediately.`

Change history (8)

when	tool	kind	severity
2026-10-23 00:17	`parse_recipe`	mutated	medium
2026-10-23 00:17	`render_recipe`	mutated	medium
2026-10-23 00:17	`convert_recipe`	mutated	medium
2026-10-23 00:17	`list_styles`	mutated	medium
2026-10-23 00:17	`get_usage`	mutated	medium
2026-10-23 00:17	`create_checkout`	mutated	high
2026-10-23 00:17	`checkout_status`	mutated	high
2026-10-23 00:17	`claim_checkout`	mutated	high

Probe history

10-23 00:17 OK (8) · 08-14 00:17 OK (8)

Run or depend on com.tabularrecipe/tabular-recipe? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.

Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).

Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).