`in.termal/termalin-web`

Verdict: high-severity findings present. Endpoint https://termal.in/api/v1/mcp. Tools now: 18 (18 ever seen). Changes recorded: 18. Findings: 4 high. Last probe: OK at 2026-10-23T06:17 UTC. JSON

Current tools

alerts_list · backup_create · backup_list · data_query · data_schema · data_tables · generate_password · hosts_list · job_list · job_start · job_status · job_stop · server_metrics · sftp_list · sftp_read · sftp_write · ssh_exec · ssh_exec_many

Findings (19)

seen	tool	detector	severity	evidence (data, not instructions)
2026-10-23	`generate_password`	`secret_material_reference`	high	`generate_password`
2026-10-23	`ssh_exec`	`secret_material_reference`	high	`de. Runs keyless over Termalin's tunnel — no SSH key, and the server needs no open inbound port. Each call is a fresh`
2026-10-23	`ssh_exec`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`ssh_exec_many`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`job_start`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`job_status`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`job_stop`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`job_list`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`server_metrics`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`backup_create`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`backup_list`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`sftp_list`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`sftp_read`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`sftp_write`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`data_query`	`secret_material_reference`	high	`un a database query on one of your servers — passwordless. It executes the engine's own client on the host over Termal`
2026-10-23	`data_query`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`data_tables`	`secret_material_reference`	high	`keys of a database on one of your servers — passwordless, over the same local-client path as data_query.`
2026-10-23	`data_tables`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`
2026-10-23	`data_schema`	`cross_tool_reference`	high	`references sibling tool 'hosts_list'`

Change history (18)

when	tool	kind	severity
2026-10-23 06:17	`hosts_list`	mutated	medium
2026-10-23 06:17	`generate_password`	mutated	high
2026-10-23 06:17	`ssh_exec`	mutated	high
2026-10-23 06:17	`ssh_exec_many`	added	high
2026-10-23 06:17	`job_start`	added	high
2026-10-23 06:17	`job_status`	added	high
2026-10-23 06:17	`job_stop`	added	high
2026-10-23 06:17	`job_list`	added	high
2026-10-23 06:17	`server_metrics`	added	high
2026-10-23 06:17	`backup_create`	added	high
2026-10-23 06:17	`backup_list`	added	high
2026-10-23 06:17	`alerts_list`	added	info
2026-10-23 06:17	`sftp_list`	mutated	high
2026-10-23 06:17	`sftp_read`	mutated	high
2026-10-23 06:17	`sftp_write`	mutated	high
2026-10-23 06:17	`data_query`	added	high
2026-10-23 06:17	`data_tables`	added	high
2026-10-23 06:17	`data_schema`	added	high

Probe history

10-23 06:17 OK (18) · 08-14 12:17 OK (6)

Run or depend on in.termal/termalin-web? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.

Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).

Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).