← MCP Registry Integrity Report
com.thousand-api/thousand-api
Verdict: high-severity findings present. Endpoint https://mcp.thousand-api.com/mcp. Tools now: 84 (84 ever seen). Changes recorded: 84. Findings: 4 high, 1 low. Last probe: OK at 2026-10-23T06:17 UTC. JSON
Current tools
convert.base64 · convert.color · convert.csv · convert.data_size · convert.format · convert.format_number · convert.get_qrcode · convert.markdown · convert.toml · convert.transform_image · convert.unit · convert.url_encoding · convert.xml · convert.yaml · data.calc_stats · data.diff_arrays · data.execute_batch · data.merge_json · data.query_json · data.sort_json · data.validate_all · data.validate_format · data.validate_json · data.validate_schema · datetime.add_business_days · datetime.add_calendar_days · datetime.calc_datetime_diff · datetime.calc_schedule · datetime.check_business_hours · datetime.check_custom_holidays · datetime.convert_iso_duration · datetime.convert_japanese_era · datetime.format_relative_time · datetime.generate_test_dates · datetime.get_calendar_month · datetime.get_cron_next · datetime.get_current_datetime · datetime.get_holidays · datetime.is_holiday · datetime.parse_laravel_schedule · network.calc_cidr · network.check_domain_format · network.check_ip_in_range · network.dns_lookup · network.get_exchange_rate · network.get_ip_info · network.get_page_meta · network.http_fetch · network.inspect_url · network.lookup_postal_code · network.resolve_url · security.decode_jwt · security.generate_hash · security.generate_hmac · security.generate_totp · security.generate_uuid · security.validate_barcode · security.validate_luhn · security.validate_uuid · text.calc_text_similarity · text.convert_japanese · text.convert_string_case · text.diff_markdown_tables · text.diff_text · text.estimate_tokens · text.extract_text_from_html · text.generate_random_string · text.generate_slug · text.get_text_stats · text.mask_pii · text.split_text · utility.calc_color_contrast · utility.calc_expression · utility.calc_loan · utility.calc_pagination · utility.calc_tax · utility.compare_versions · utility.convert_coordinates · utility.diagnose_mcp · utility.generate_color_palette · utility.get_distance · utility.get_tool_schema · utility.get_usage · utility.search_tools
Findings (12)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-23 | utility.get_tool_schema | cross_tool_reference | high | references sibling tool 'data.validate_json' |
| 2026-10-23 | utility.get_usage | secret_material_reference | high | ォータの使用状況（残量・リセット時刻）を返す / Returns the current API key plan and monthly quota usage before hitting limit_exceeded (429) |
| 2026-10-23 | utility.diagnose_mcp | secret_material_reference | high | s: API health via GET /v1/health (no quota), API key check via tool-settings (no quota), and disabled tool counts. [u |
| 2026-10-23 | data.execute_batch | cross_tool_reference | high | references sibling tool 'datetime.is_holiday' |
| 2026-10-23 | datetime.generate_test_dates | cross_tool_reference | high | references sibling tool 'datetime.add_calendar_days' |
| 2026-10-23 | text.split_text | cross_tool_reference | high | references sibling tool 'text.estimate_tokens' |
| 2026-10-23 | security.validate_uuid | model_directed_instruction | high | nal systems, or verifying AI-generated UUIDs before using them as database keys. [use_cases: security, validation] |
| 2026-10-23 | security.generate_totp | secret_material_reference | high | validates RFC 6238 TOTP (time-based one-time password) codes for 2FA implementations. Exact HMAC-SHA1 computation and |
| 2026-10-23 | convert.url_encoding | url_in_description | low | http://, |
| 2026-10-23 | network.check_domain_format | cross_tool_reference | high | references sibling tool 'network.dns_lookup' |
| 2026-10-23 | convert.format_number | cross_tool_reference | high | references sibling tool 'convert.format' |
| 2026-10-23 | data.validate_schema | cross_tool_reference | high | references sibling tool 'data.validate_json' |
Change history (84)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-23 06:17 | utility.search_tools | mutated | medium |
| 2026-10-23 06:17 | utility.get_tool_schema | mutated | high |
| 2026-10-23 06:17 | utility.get_usage | mutated | high |
| 2026-10-23 06:17 | utility.diagnose_mcp | mutated | high |
| 2026-10-23 06:17 | data.execute_batch | mutated | high |
| 2026-10-23 06:17 | datetime.get_holidays | mutated | medium |
| 2026-10-23 06:17 | datetime.get_calendar_month | mutated | medium |
| 2026-10-23 06:17 | datetime.is_holiday | mutated | medium |
| 2026-10-23 06:17 | datetime.add_business_days | mutated | medium |
| 2026-10-23 06:17 | datetime.add_calendar_days | mutated | medium |
| 2026-10-23 06:17 | datetime.generate_test_dates | mutated | high |
| 2026-10-23 06:17 | datetime.check_business_hours | mutated | medium |
| 2026-10-23 06:17 | datetime.check_custom_holidays | mutated | medium |
| 2026-10-23 06:17 | datetime.calc_schedule | mutated | medium |
| 2026-10-23 06:17 | datetime.get_cron_next | mutated | medium |
| 2026-10-23 06:17 | datetime.parse_laravel_schedule | mutated | medium |
| 2026-10-23 06:17 | network.get_exchange_rate | mutated | medium |
| 2026-10-23 06:17 | network.lookup_postal_code | mutated | medium |
| 2026-10-23 06:17 | network.get_page_meta | mutated | medium |
| 2026-10-23 06:17 | utility.get_distance | mutated | medium |
| 2026-10-23 06:17 | utility.convert_coordinates | mutated | medium |
| 2026-10-23 06:17 | convert.get_qrcode | mutated | medium |
| 2026-10-23 06:17 | network.get_ip_info | mutated | medium |
| 2026-10-23 06:17 | text.extract_text_from_html | mutated | medium |
| 2026-10-23 06:17 | text.get_text_stats | mutated | medium |
| 2026-10-23 06:17 | text.estimate_tokens | mutated | medium |
| 2026-10-23 06:17 | text.split_text | mutated | high |
| 2026-10-23 06:17 | text.mask_pii | mutated | medium |
| 2026-10-23 06:17 | text.diff_text | mutated | medium |
| 2026-10-23 06:17 | text.diff_markdown_tables | mutated | medium |
| 2026-10-23 06:17 | text.calc_text_similarity | mutated | medium |
| 2026-10-23 06:17 | network.resolve_url | mutated | medium |
| 2026-10-23 06:17 | convert.markdown | mutated | medium |
| 2026-10-23 06:17 | utility.generate_color_palette | mutated | medium |
| 2026-10-23 06:17 | utility.calc_color_contrast | mutated | medium |
| 2026-10-23 06:17 | convert.color | mutated | medium |
| 2026-10-23 06:17 | network.inspect_url | mutated | medium |
| 2026-10-23 06:17 | security.decode_jwt | mutated | medium |
| 2026-10-23 06:17 | convert.unit | mutated | medium |
| 2026-10-23 06:17 | security.generate_hash | mutated | medium |
| 2026-10-23 06:17 | security.generate_uuid | mutated | medium |
| 2026-10-23 06:17 | security.validate_uuid | mutated | high |
| 2026-10-23 06:17 | security.validate_barcode | mutated | medium |
| 2026-10-23 06:17 | security.validate_luhn | mutated | medium |
| 2026-10-23 06:17 | security.generate_hmac | mutated | medium |
| 2026-10-23 06:17 | security.generate_totp | mutated | high |
| 2026-10-23 06:17 | convert.csv | mutated | medium |
| 2026-10-23 06:17 | convert.yaml | mutated | medium |
| 2026-10-23 06:17 | convert.toml | mutated | medium |
| 2026-10-23 06:17 | convert.xml | mutated | medium |
| 2026-10-23 06:17 | convert.base64 | mutated | medium |
| 2026-10-23 06:17 | convert.url_encoding | mutated | medium |
| 2026-10-23 06:17 | convert.format | mutated | medium |
| 2026-10-23 06:17 | utility.calc_expression | mutated | medium |
| 2026-10-23 06:17 | utility.calc_tax | mutated | medium |
| 2026-10-23 06:17 | utility.calc_loan | mutated | medium |
| 2026-10-23 06:17 | utility.compare_versions | mutated | medium |
| 2026-10-23 06:17 | utility.calc_pagination | mutated | medium |
| 2026-10-23 06:17 | network.dns_lookup | mutated | medium |
| 2026-10-23 06:17 | network.calc_cidr | mutated | medium |
| 2026-10-23 06:17 | network.check_ip_in_range | mutated | medium |
| 2026-10-23 06:17 | network.check_domain_format | mutated | high |
| 2026-10-23 06:17 | network.http_fetch | mutated | medium |
| 2026-10-23 06:17 | data.query_json | mutated | medium |
| 2026-10-23 06:17 | data.calc_stats | mutated | medium |
| 2026-10-23 06:17 | data.validate_format | mutated | medium |
| 2026-10-23 06:17 | convert.data_size | mutated | medium |
| 2026-10-23 06:17 | convert.format_number | mutated | high |
| 2026-10-23 06:17 | text.convert_japanese | mutated | medium |
| 2026-10-23 06:17 | text.generate_slug | mutated | medium |
| 2026-10-23 06:17 | datetime.get_current_datetime | mutated | medium |
| 2026-10-23 06:17 | datetime.calc_datetime_diff | mutated | medium |
| 2026-10-23 06:17 | datetime.format_relative_time | mutated | medium |
| 2026-10-23 06:17 | datetime.convert_japanese_era | mutated | medium |
| 2026-10-23 06:17 | datetime.convert_iso_duration | mutated | medium |
| 2026-10-23 06:17 | text.convert_string_case | mutated | medium |
| 2026-10-23 06:17 | text.generate_random_string | mutated | medium |
| 2026-10-23 06:17 | data.validate_json | mutated | medium |
| 2026-10-23 06:17 | data.validate_schema | mutated | high |
| 2026-10-23 06:17 | data.validate_all | mutated | medium |
| 2026-10-23 06:17 | data.merge_json | mutated | medium |
| 2026-10-23 06:17 | data.diff_arrays | mutated | medium |
| 2026-10-23 06:17 | data.sort_json | mutated | medium |
| 2026-10-23 06:17 | convert.transform_image | mutated | medium |
Probe history
10-23 06:17 OK (84) · 08-14 00:17 OK (84)
Run or depend on com.thousand-api/thousand-api? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).