← MCP Registry Integrity Report
eu.tracepass/tracepass
Verdict: high-severity findings present. Endpoint https://ai.tracepass.eu/mcp. Tools now: 7 (7 ever seen). Changes recorded: 7. Findings: 4 low, 2 high. Last probe: OK at 2026-10-23T06:17 UTC. JSON
Current tools
tracepass_epcis · tracepass_passport_fields · tracepass_passport_parties · tracepass_passports · tracepass_products · tracepass_scope · tracepass_templates
Findings (6)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-23 | tracepass_passports | url_in_description | low | https://doi.org/ |
| 2026-10-23 | tracepass_passports | oversized_description | low | 8839 chars |
| 2026-10-23 | tracepass_passport_fields | secret_material_reference | high | orded in the passport's audit trail with the credential that made it (API key or connected app) and this MCP channel. ` |
| 2026-10-23 | tracepass_passport_parties | url_in_description | low | https://doi.org/ |
| 2026-10-23 | tracepass_scope | model_directed_instruction | high | acts. This is not legal advice; never write 'you must' — use product-type phrasing ('LMT batteries need a passport fro |
| 2026-10-23 | tracepass_scope | oversized_description | low | 4033 chars |
Change history (7)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-23 06:17 | tracepass_products | mutated | medium |
| 2026-10-23 06:17 | tracepass_passports | mutated | medium |
| 2026-10-23 06:17 | tracepass_passport_fields | mutated | high |
| 2026-10-23 06:17 | tracepass_passport_parties | mutated | medium |
| 2026-10-23 06:17 | tracepass_epcis | mutated | medium |
| 2026-10-23 06:17 | tracepass_templates | mutated | medium |
| 2026-10-23 06:17 | tracepass_scope | added | high |
Probe history
10-23 06:17 OK (7) · 08-14 06:17 OK (6)
Run or depend on eu.tracepass/tracepass? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).