← MCP Registry Integrity Report
com.timzinin.api/us-brand-intelligence
Verdict: high-severity findings present. Endpoint https://api.timzinin.com/mcp/us-brand-intelligence. Tools now: 21 (21 ever seen). Changes recorded: 21. Findings: 6 high, 6 low. Last probe: OK at 2026-10-23T06:17 UTC. JSON
Current tools
pricing_info · us-brand-action-queue · us-brand-evidence-chronology-builder · us-brand-evidence-citation-table · us-brand-evidence-snapshot-diff · us-brand-federal-award-snapshot · us-brand-offer-evidence-normalizer · us-brand-signal-batch-splitter · us-brand-signal-brand-summary · us-brand-signal-brief-composer · us-brand-signal-confidence-gate · us-brand-signal-cooccurrence-analyzer · us-brand-signal-crm-field-mapper · us-brand-signal-cross-tabulator · us-brand-signal-merge-report · us-brand-signal-metrics-aggregator · us-brand-signal-policy-simulator · us-brand-signal-rule-router · us-brand-signal-sequence-transition-analyzer · us-brand-signal-sla-checker · us-brand-signal-webhook-payload-builder
Findings (12)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-23 | us-brand-evidence-chronology-builder | secret_material_reference | high | itted HTTPS URL with a non-empty host and no credentials; the Actor does not fetch or verify it. |
| 2026-10-23 | us-brand-evidence-chronology-builder | url_in_description | low | https://[A-Za-z0-9 |
| 2026-10-23 | us-brand-evidence-citation-table | secret_material_reference | high | trict UTC; source URLs must be HTTPS without credentials or fragments. |
| 2026-10-23 | us-brand-evidence-citation-table | url_in_description | low | https://[^\s# |
| 2026-10-23 | us-brand-evidence-snapshot-diff | url_in_description | low | https://(?=[A-Za-z0-9 |
| 2026-10-23 | us-brand-federal-award-snapshot | secret_material_reference | high | overnment-intelligence agents; no buyer URL, API key, browser, or LLM. — $0.05/call, x402 (USDC on base). |
| 2026-10-23 | us-brand-signal-brand-summary | url_in_description | low | https://[\x20-\x7E |
| 2026-10-23 | us-brand-signal-crm-field-mapper | secret_material_reference | high | ile preserving evidence IDs and URLs. No CRM credentials, network calls, proxy, LLM, identity resolution, or arbitrary e |
| 2026-10-23 | us-brand-signal-crm-field-mapper | url_in_description | low | https://[^\s# |
| 2026-10-23 | us-brand-signal-merge-report | secret_material_reference | high | pplied HTTPS provenance URL; runtime rejects credentials, fragments, bracketed hosts, and non-default ports; never fetch |
| 2026-10-23 | us-brand-signal-merge-report | url_in_description | low | https://(?![^/?# |
| 2026-10-23 | us-brand-signal-webhook-payload-builder | secret_material_reference | high | HTTPS attribution URL without credentials or a non-default port. |
Change history (21)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-23 06:17 | pricing_info | mutated | medium |
| 2026-10-23 06:17 | us-brand-action-queue | mutated | medium |
| 2026-10-23 06:17 | us-brand-evidence-chronology-builder | mutated | high |
| 2026-10-23 06:17 | us-brand-evidence-citation-table | mutated | high |
| 2026-10-23 06:17 | us-brand-evidence-snapshot-diff | mutated | medium |
| 2026-10-23 06:17 | us-brand-federal-award-snapshot | mutated | high |
| 2026-10-23 06:17 | us-brand-offer-evidence-normalizer | mutated | medium |
| 2026-10-23 06:17 | us-brand-signal-batch-splitter | mutated | medium |
| 2026-10-23 06:17 | us-brand-signal-brand-summary | mutated | medium |
| 2026-10-23 06:17 | us-brand-signal-brief-composer | mutated | medium |
| 2026-10-23 06:17 | us-brand-signal-confidence-gate | mutated | medium |
| 2026-10-23 06:17 | us-brand-signal-cooccurrence-analyzer | mutated | medium |
| 2026-10-23 06:17 | us-brand-signal-crm-field-mapper | mutated | high |
| 2026-10-23 06:17 | us-brand-signal-cross-tabulator | mutated | medium |
| 2026-10-23 06:17 | us-brand-signal-merge-report | mutated | high |
| 2026-10-23 06:17 | us-brand-signal-metrics-aggregator | mutated | medium |
| 2026-10-23 06:17 | us-brand-signal-policy-simulator | mutated | medium |
| 2026-10-23 06:17 | us-brand-signal-rule-router | mutated | medium |
| 2026-10-23 06:17 | us-brand-signal-sequence-transition-analyzer | mutated | medium |
| 2026-10-23 06:17 | us-brand-signal-sla-checker | mutated | medium |
| 2026-10-23 06:17 | us-brand-signal-webhook-payload-builder | mutated | high |
Probe history
10-23 06:17 OK (21) · 08-14 00:17 OK (21)
Run or depend on com.timzinin.api/us-brand-intelligence? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).