← MCP Registry Integrity Report
com.tunnelpowered/knowledge-base
Verdict: CRITICAL findings present. Endpoint https://api.tunnelpowered.com/api/mcp. Tools now: 17 (17 ever seen). Changes recorded: 17. Findings: 13 high, 1 critical. Last probe: OK at 2026-10-23T06:17 UTC. JSON
Current tools
ask_business · ask_business_freeform · cancel_order · check_availability · check_commitment · check_escalation · check_merchant_verification · check_replies · commit_order · contact_business · get_business · get_rate_card · request_order_change · request_quote · reschedule_order · search_businesses · send_followup
Findings (30)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-23 | search_businesses | secret_material_reference | high | uthentication: none. This tool works with no credentials. |
| 2026-10-23 | get_business | user_concealment | critical | on is named in `missing` rather than dropped silently, so an empty field means "we do not hold this", not "they do not |
| 2026-10-23 | get_business | secret_material_reference | high | uthentication: none. This tool works with no credentials. |
| 2026-10-23 | get_business | cross_tool_reference | high | references sibling tool 'search_businesses' |
| 2026-10-23 | check_merchant_verification | secret_material_reference | high | uthentication: none. This tool works with no credentials. |
| 2026-10-23 | check_merchant_verification | cross_tool_reference | high | references sibling tool 'search_businesses' |
| 2026-10-23 | ask_business | secret_material_reference | high | uthentication: none. This tool works with no credentials. |
| 2026-10-23 | ask_business | cross_tool_reference | high | references sibling tool 'search_businesses' |
| 2026-10-23 | ask_business_freeform | secret_material_reference | high | uthentication: none. This tool works with no credentials. |
| 2026-10-23 | ask_business_freeform | cross_tool_reference | high | references sibling tool 'search_businesses' |
| 2026-10-23 | check_escalation | secret_material_reference | high | uthentication: none. This tool works with no credentials. |
| 2026-10-23 | check_escalation | cross_tool_reference | high | references sibling tool 'ask_business' |
| 2026-10-23 | check_commitment | secret_material_reference | high | uthentication: none. This tool works with no credentials. |
| 2026-10-23 | check_commitment | cross_tool_reference | high | references sibling tool 'commit_order' |
| 2026-10-23 | get_rate_card | secret_material_reference | high | uthentication: none. This tool works with no credentials. |
| 2026-10-23 | get_rate_card | cross_tool_reference | high | references sibling tool 'search_businesses' |
| 2026-10-23 | request_quote | secret_material_reference | high | uthentication: none. This tool works with no credentials. |
| 2026-10-23 | request_quote | cross_tool_reference | high | references sibling tool 'search_businesses' |
| 2026-10-23 | check_availability | secret_material_reference | high | uthentication: none. This tool works with no credentials. |
| 2026-10-23 | check_availability | cross_tool_reference | high | references sibling tool 'search_businesses' |
| 2026-10-23 | commit_order | secret_material_reference | high | t POST /api/v1/agents/register, exchange the credentials at POST /api/v1/agents/token. |
| 2026-10-23 | commit_order | cross_tool_reference | high | references sibling tool 'search_businesses' |
| 2026-10-23 | cancel_order | cross_tool_reference | high | references sibling tool 'check_escalation' |
| 2026-10-23 | reschedule_order | cross_tool_reference | high | references sibling tool 'check_escalation' |
| 2026-10-23 | request_order_change | cross_tool_reference | high | references sibling tool 'check_escalation' |
| 2026-10-23 | contact_business | secret_material_reference | high | t POST /api/v1/agents/register, exchange the credentials at POST /api/v1/agents/token, and send the result as an Authori |
| 2026-10-23 | contact_business | cross_tool_reference | high | references sibling tool 'search_businesses' |
| 2026-10-23 | check_replies | secret_material_reference | high | d` and `token` from contact_business are the credential for this call. No bearer token is needed. |
| 2026-10-23 | check_replies | cross_tool_reference | high | references sibling tool 'contact_business' |
| 2026-10-23 | send_followup | cross_tool_reference | high | references sibling tool 'contact_business' |
Change history (17)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-23 06:17 | search_businesses | mutated | high |
| 2026-10-23 06:17 | get_business | mutated | critical |
| 2026-10-23 06:17 | check_merchant_verification | mutated | high |
| 2026-10-23 06:17 | ask_business | mutated | high |
| 2026-10-23 06:17 | ask_business_freeform | mutated | high |
| 2026-10-23 06:17 | check_escalation | mutated | high |
| 2026-10-23 06:17 | check_commitment | mutated | high |
| 2026-10-23 06:17 | get_rate_card | mutated | high |
| 2026-10-23 06:17 | request_quote | mutated | high |
| 2026-10-23 06:17 | check_availability | mutated | high |
| 2026-10-23 06:17 | commit_order | mutated | high |
| 2026-10-23 06:17 | cancel_order | mutated | high |
| 2026-10-23 06:17 | reschedule_order | mutated | high |
| 2026-10-23 06:17 | request_order_change | mutated | high |
| 2026-10-23 06:17 | contact_business | mutated | high |
| 2026-10-23 06:17 | check_replies | mutated | high |
| 2026-10-23 06:17 | send_followup | mutated | high |
Probe history
10-23 06:17 OK (17) · 08-14 00:17 OK (17)
Run or depend on com.tunnelpowered/knowledge-base? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).