← MCP Registry Integrity Report
global.rootz.cars/marketplace
Verdict: CRITICAL findings present. Endpoint https://cars.rootz.global/mcp. Tools now: 19 (19 ever seen). Changes recorded: 19. Findings: 1 critical. Last probe: OK at 2026-10-23T06:17 UTC. JSON
Current tools
cars_dealer_inventory · cars_dealers · cars_feedback · cars_history · cars_search · cars_session_add_car · cars_session_compare · cars_session_create · cars_session_deal · cars_session_interest · cars_session_message · cars_session_notify · cars_session_read · cars_session_reply · cars_session_tradein · cars_session_tradein_read · cars_session_visit · cars_stats · cars_vehicle
Findings (3)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-23 | cars_session_create | cross_tool_reference | high | references sibling tool 'cars_session_tradein' |
| 2026-10-23 | cars_session_notify | exfiltration_pattern | critical | preference for this session. Three levels: "bcc" (buyer gets a private copy of dealer replies — dealer never see |
| 2026-10-23 | cars_session_tradein_read | cross_tool_reference | high | references sibling tool 'cars_session_tradein' |
Change history (19)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-23 06:17 | cars_search | mutated | medium |
| 2026-10-23 06:17 | cars_vehicle | mutated | medium |
| 2026-10-23 06:17 | cars_dealers | mutated | medium |
| 2026-10-23 06:17 | cars_dealer_inventory | mutated | medium |
| 2026-10-23 06:17 | cars_history | mutated | medium |
| 2026-10-23 06:17 | cars_stats | mutated | medium |
| 2026-10-23 06:17 | cars_session_create | mutated | high |
| 2026-10-23 06:17 | cars_session_read | mutated | medium |
| 2026-10-23 06:17 | cars_session_add_car | mutated | medium |
| 2026-10-23 06:17 | cars_session_interest | mutated | medium |
| 2026-10-23 06:17 | cars_session_message | mutated | medium |
| 2026-10-23 06:17 | cars_session_compare | mutated | medium |
| 2026-10-23 06:17 | cars_session_deal | mutated | medium |
| 2026-10-23 06:17 | cars_session_reply | mutated | medium |
| 2026-10-23 06:17 | cars_session_notify | mutated | critical |
| 2026-10-23 06:17 | cars_session_tradein | mutated | medium |
| 2026-10-23 06:17 | cars_session_tradein_read | mutated | high |
| 2026-10-23 06:17 | cars_feedback | mutated | medium |
| 2026-10-23 06:17 | cars_session_visit | mutated | medium |
Probe history
10-23 06:17 OK (19) · 08-14 06:17 OK (19)
Run or depend on global.rootz.cars/marketplace? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).