← MCP Registry Integrity Report
dev.kamy/kamy
Verdict: CRITICAL findings present. Endpoint https://mcp.kamy.dev/mcp. Tools now: 59 (62 ever seen). Changes recorded: 62. Findings: 40 high, 7 critical. Last probe: OK at 2026-10-23T06:17 UTC. JSON
Current tools
ask_kamy · attest_artifact · bulk_signature_requests · convert_document · create_envelope · create_schedule · create_signature_request · create_template · create_webhook · delete_schedule · edit_pdf · extract_document · extract_from_render · get_account · get_envelope · get_job · get_provenance_chain · get_render · get_render_pages · get_signature_certificate · get_signature_request · get_signature_template · get_started · get_template_schema · get_template_version · get_upload · list_renders · list_schedules · list_signature_requests · list_signature_templates · list_template_versions · list_templates · list_webhooks · merge_pdfs · pki_sign_pdf · preview_field_placement · publish_template · record_agent_action · remind_signature · render_async · render_batch · render_docx · render_html · render_pdf · render_pptx · render_xlsx · rollback_template · scan_tool_description · split_pdf · test_webhook · trace_record · trace_record_batch · trace_search · update_template · upload_file · validate_payload · verify_attestation · verify_mcp_server · verify_pdf_signature
Findings (96)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-23 | get_template_schema | cross_tool_reference | high | references sibling tool 'render_pdf' |
| 2026-10-23 | create_template | secret_material_reference | high | you start cutting versions. Requires a Kamy API key with the `templates:write` scope; without a key, returns dashboa |
| 2026-10-23 | create_template | cross_tool_reference | high | references sibling tool 'update_template' |
| 2026-10-23 | update_template | secret_material_reference | high | another account, return 403. Requires a Kamy API key with the `templates:write` scope; without a key, returns dashboa |
| 2026-10-23 | update_template | cross_tool_reference | high | references sibling tool 'publish_template' |
| 2026-10-23 | publish_template | secret_material_reference | high | atestVersion, publishedAt }. Requires a Kamy API key with the `templates:write` scope; without a key, returns dashboa |
| 2026-10-23 | publish_template | cross_tool_reference | high | references sibling tool 'update_template' |
| 2026-10-23 | rollback_template | secret_material_reference | high | kes a template UUID or slug. Requires a Kamy API key with the `templates:write` scope; without a key, returns dashboa |
| 2026-10-23 | rollback_template | cross_tool_reference | high | references sibling tool 'publish_template' |
| 2026-10-23 | list_template_versions | secret_material_reference | high | ad-only and spends no quota. Requires a Kamy API key with the `templates:read` scope; without a key, returns dashboar |
| 2026-10-23 | list_template_versions | cross_tool_reference | high | references sibling tool 'publish_template' |
| 2026-10-23 | get_template_version | secret_material_reference | high | ad-only and spends no quota. Requires a Kamy API key with the `templates:read` scope; without a key, returns dashboar |
| 2026-10-23 | get_template_version | cross_tool_reference | high | references sibling tool 'rollback_template' |
| 2026-10-23 | render_pdf | secret_material_reference | high | before this fails with 402. Requires a Kamy API key with the `render` scope; without a key, returns dashboard setup |
| 2026-10-23 | render_pdf | cross_tool_reference | high | references sibling tool 'get_template_schema' |
| 2026-10-23 | render_docx | secret_material_reference | high | r against the monthly quota. Requires a Kamy API key with the `render` scope; without a key, returns dashboard setup |
| 2026-10-23 | render_docx | cross_tool_reference | high | references sibling tool 'get_template_schema' |
| 2026-10-23 | render_pptx | secret_material_reference | high | r against the monthly quota. Requires a Kamy API key with the `render` scope; without a key, returns dashboard setup |
| 2026-10-23 | render_pptx | cross_tool_reference | high | references sibling tool 'render_pdf' |
| 2026-10-23 | render_xlsx | secret_material_reference | high | r against the monthly quota. Requires a Kamy API key with the `render` scope; without a key, returns dashboard setup |
| 2026-10-23 | render_xlsx | cross_tool_reference | high | references sibling tool 'render_pdf' |
| 2026-10-23 | render_html | secret_material_reference | high | ile step is the shared cost. Requires a Kamy API key with the `render` scope; without a key, returns dashboard setup |
| 2026-10-23 | render_html | cross_tool_reference | high | references sibling tool 'render_pdf' |
| 2026-10-23 | convert_document | secret_material_reference | high | ravel through the tool call. Requires a Kamy API key with the `render` scope; without a key, returns dashboard setup |
| 2026-10-23 | convert_document | cross_tool_reference | high | references sibling tool 'render_pdf' |
| 2026-10-23 | merge_pdfs | secret_material_reference | high | ed as one additional render. Requires a Kamy API key with the `render` scope; without a key, returns dashboard setup |
| 2026-10-23 | merge_pdfs | cross_tool_reference | high | references sibling tool 'render_pdf' |
| 2026-10-23 | split_pdf | secret_material_reference | high | _pdf or the signature tools. Requires a Kamy API key with the `render` scope; without a key, returns dashboard setup |
| 2026-10-23 | split_pdf | cross_tool_reference | high | references sibling tool 'merge_pdfs' |
| 2026-10-23 | edit_pdf | secret_material_reference | high | ather than failing the call. Requires a Kamy API key with the `render` scope; without a key, returns dashboard setup |
| 2026-10-23 | edit_pdf | cross_tool_reference | high | references sibling tool 'render_pdf' |
| 2026-10-23 | upload_file | secret_material_reference | high | ted MIME types are accepted. Requires a Kamy API key with the `uploads:write` scope; without a key, returns dashboard |
| 2026-10-23 | upload_file | cross_tool_reference | high | references sibling tool 'render_pdf' |
| 2026-10-23 | get_upload | secret_material_reference | high | ad-only and spends no quota. Requires a Kamy API key with the `uploads:read` scope; without a key, returns dashboard |
| 2026-10-23 | get_upload | cross_tool_reference | high | references sibling tool 'upload_file' |
| 2026-10-23 | validate_payload | secret_material_reference | high | the data before render_pdf. Requires a Kamy API key. |
| 2026-10-23 | validate_payload | cross_tool_reference | high | references sibling tool 'render_pdf' |
| 2026-10-23 | create_signature_request | user_concealment | critical | s. If the text is not on that page the field silently falls back to the raw x/y — call preview_field_placement first t |
| 2026-10-23 | create_signature_request | secret_material_reference | high | PDF to a signer for e-signature when a Kamy API key is configured. Without a key, returns dashboard setup instructio |
| 2026-10-23 | create_signature_request | cross_tool_reference | high | references sibling tool 'render_pdf' |
| 2026-10-23 | create_envelope | secret_material_reference | high | th a sign_url per recipient. Requires a Kamy API key with the `signatures:write` scope; without a key, returns dashbo |
| 2026-10-23 | create_envelope | cross_tool_reference | high | references sibling tool 'create_signature_request' |
| 2026-10-23 | get_signature_request | secret_material_reference | high | ad-only and spends no quota. Requires a Kamy API key with the `signatures:read` scope; without a key, returns dashboa |
| 2026-10-23 | get_signature_request | cross_tool_reference | high | references sibling tool 'create_signature_request' |
| 2026-10-23 | get_envelope | secret_material_reference | high | ad-only and spends no quota. Requires a Kamy API key with the `signatures:read` scope; without a key, returns dashboa |
| 2026-10-23 | get_envelope | cross_tool_reference | high | references sibling tool 'create_envelope' |
| 2026-10-23 | remind_signature | user_concealment | critical | Retry-After header, while the envelope form silently skips capped recipients and reports skipped_reason per row, so r |
| 2026-10-23 | remind_signature | secret_material_reference | high | e-reminder auto-cadence cap. Requires a Kamy API key with the `signatures:write` scope; without a key, returns dashbo |
| 2026-10-23 | bulk_signature_requests | secret_material_reference | high | ining rows come back failed. Requires a Kamy API key with the `signatures:write` scope; without a key, returns dashbo |
| 2026-10-23 | bulk_signature_requests | cross_tool_reference | high | references sibling tool 'create_envelope' |
| 2026-10-23 | preview_field_placement | user_concealment | critical | s. If the text is not on that page the field silently falls back to the raw x/y — call preview_field_placement first t |
| 2026-10-23 | preview_field_placement | secret_material_reference | high | is to re-render. Read-only. Requires a Kamy API key with the `signatures:read` scope; without a key, returns dashboa |
| 2026-10-23 | preview_field_placement | cross_tool_reference | high | references sibling tool 'create_signature_request' |
| 2026-10-23 | list_signature_templates | secret_material_reference | high | ad-only and spends no quota. Requires a Kamy API key with the `signatures:read` scope; without a key, returns dashboa |
| 2026-10-23 | list_signature_templates | cross_tool_reference | high | references sibling tool 'list_templates' |
| 2026-10-23 | get_signature_template | secret_material_reference | high | ad-only and spends no quota. Requires a Kamy API key with the `signatures:read` scope; without a key, returns dashboa |
| 2026-10-23 | get_signature_template | cross_tool_reference | high | references sibling tool 'create_signature_request' |
| 2026-10-23 | pki_sign_pdf | secret_material_reference | high | gn an existing render with PAdES when a Kamy API key is configured. Without a key, returns dashboard setup instructio |
| 2026-10-23 | pki_sign_pdf | cross_tool_reference | high | references sibling tool 'render_pdf' |
| 2026-10-23 | verify_pdf_signature | cross_tool_reference | high | references sibling tool 'verify_attestation' |
| 2026-10-23 | attest_artifact | secret_material_reference | high | ther the content is correct. Requires a Kamy API key. |
| 2026-10-23 | attest_artifact | cross_tool_reference | high | references sibling tool 'get_provenance_chain' |
| 2026-10-23 | verify_attestation | secret_material_reference | high | e — like the extract_document verify URL, no API key is required, so a recipient can confirm an artifact independentl |
| 2026-10-23 | verify_attestation | cross_tool_reference | high | references sibling tool 'extract_document' |
| 2026-10-23 | record_agent_action | secret_material_reference | high | , recorded_at, verify_url }. Requires a Kamy API key. |
| 2026-10-23 | record_agent_action | cross_tool_reference | high | references sibling tool 'get_provenance_chain' |
| 2026-10-23 | get_provenance_chain | secret_material_reference | high | n across the run. Read-only. Requires a Kamy API key. |
| 2026-10-23 | get_provenance_chain | cross_tool_reference | high | references sibling tool 'attest_artifact' |
| 2026-10-23 | trace_record | secret_material_reference | high | , recorded_at, verify_url }. Requires a Kamy API key with the trace:record scope; each call consumes monthly Trace qu |
| 2026-10-23 | trace_record | cross_tool_reference | high | references sibling tool 'trace_search' |
| 2026-10-23 | trace_record_batch | secret_material_reference | high | ify_url }] } in input order. Requires a Kamy API key with the `trace:record` scope; without a key, returns dashboard |
| 2026-10-23 | trace_record_batch | cross_tool_reference | high | references sibling tool 'trace_record' |
| 2026-10-23 | trace_search | secret_material_reference | high | in the dashboard. Read-only. Requires a Kamy API key with the trace:read scope. |
| 2026-10-23 | verify_mcp_server | user_concealment | critical | ll' case, where a server you already trusted silently rewrites a tool's description or input schema. Pass server_url a |
| 2026-10-23 | verify_mcp_server | secret_material_reference | high | ther than clearing anything. Requires a Kamy API key. |
| 2026-10-23 | scan_tool_description | exfiltration_pattern | critical | uctions addressed at the reading model, data-exfiltration hints, attempts to override your system prompt or hide content. |
| 2026-10-23 | scan_tool_description | secret_material_reference | high | pass in and fetches nothing. Requires a Kamy API key. |
| 2026-10-23 | get_started | secret_material_reference | high | document in one call: the steps to create an API key in the dashboard, and — when you name a `framework` — the instal |
| 2026-10-23 | get_started | cross_tool_reference | high | references sibling tool 'list_templates' |
| 2026-10-23 | get_account | secret_material_reference | high | tatus, the plan's limits (renders per month, API keys, seats, custom templates, overage pricing, priority queue), mon |
Change history (62)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-23 06:17 | list_templates | mutated | medium |
| 2026-10-23 06:17 | get_template_schema | mutated | high |
| 2026-10-23 06:17 | create_template | added | high |
| 2026-10-23 06:17 | update_template | added | high |
| 2026-10-23 06:17 | publish_template | added | high |
| 2026-10-23 06:17 | rollback_template | added | high |
| 2026-10-23 06:17 | list_template_versions | added | high |
| 2026-10-23 06:17 | get_template_version | added | high |
| 2026-10-23 06:17 | render_pdf | mutated | high |
| 2026-10-23 06:17 | render_docx | added | high |
| 2026-10-23 06:17 | render_pptx | added | high |
| 2026-10-23 06:17 | render_xlsx | added | high |
| 2026-10-23 06:17 | render_html | added | high |
| 2026-10-23 06:17 | convert_document | added | high |
| 2026-10-23 06:17 | merge_pdfs | added | high |
| 2026-10-23 06:17 | split_pdf | added | high |
| 2026-10-23 06:17 | edit_pdf | added | high |
| 2026-10-23 06:17 | upload_file | added | high |
| 2026-10-23 06:17 | get_upload | added | high |
| 2026-10-23 06:17 | validate_payload | mutated | high |
| 2026-10-23 06:17 | extract_document | mutated | medium |
| 2026-10-23 06:17 | ask_kamy | mutated | medium |
| 2026-10-23 06:17 | create_signature_request | mutated | critical |
| 2026-10-23 06:17 | create_envelope | added | high |
| 2026-10-23 06:17 | list_signature_requests | mutated | medium |
| 2026-10-23 06:17 | get_signature_certificate | mutated | medium |
| 2026-10-23 06:17 | get_signature_request | added | high |
| 2026-10-23 06:17 | get_envelope | added | high |
| 2026-10-23 06:17 | remind_signature | added | critical |
| 2026-10-23 06:17 | bulk_signature_requests | added | high |
| 2026-10-23 06:17 | preview_field_placement | added | critical |
| 2026-10-23 06:17 | list_signature_templates | added | high |
| 2026-10-23 06:17 | get_signature_template | added | high |
| 2026-10-23 06:17 | pki_sign_pdf | mutated | high |
| 2026-10-23 06:17 | verify_pdf_signature | mutated | high |
| 2026-10-23 06:17 | attest_artifact | added | high |
| 2026-10-23 06:17 | verify_attestation | added | high |
| 2026-10-23 06:17 | record_agent_action | added | high |
| 2026-10-23 06:17 | get_provenance_chain | added | high |
| 2026-10-23 06:17 | trace_record | added | high |
| 2026-10-23 06:17 | trace_record_batch | added | high |
| 2026-10-23 06:17 | trace_search | added | high |
| 2026-10-23 06:17 | verify_mcp_server | added | critical |
| 2026-10-23 06:17 | scan_tool_description | added | critical |
| 2026-10-23 06:17 | get_started | added | high |
| 2026-10-23 06:17 | get_account | added | high |
| 2026-10-23 06:17 | list_renders | added | high |
| 2026-10-23 06:17 | get_render | added | high |
| 2026-10-23 06:17 | get_render_pages | added | high |
| 2026-10-23 06:17 | extract_from_render | added | high |
| 2026-10-23 06:17 | render_async | added | critical |
| 2026-10-23 06:17 | get_job | added | high |
| 2026-10-23 06:17 | render_batch | added | high |
| 2026-10-23 06:17 | create_schedule | added | high |
| 2026-10-23 06:17 | list_schedules | added | info |
| 2026-10-23 06:17 | delete_schedule | added | high |
| 2026-10-23 06:17 | create_webhook | added | high |
| 2026-10-23 06:17 | list_webhooks | added | critical |
| 2026-10-23 06:17 | test_webhook | added | high |
| 2026-10-23 06:17 | install_sdk | removed | info |
| 2026-10-23 06:17 | generate_integration_code | removed | info |
| 2026-10-23 06:17 | get_api_key_instructions | removed | info |
Probe history
10-23 06:17 OK (59) · 08-14 06:17 OK (14)
Run or depend on dev.kamy/kamy? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).