`io.boundra/boundra`

Verdict: high-severity findings present. Endpoint https://api.boundra.io/mcp. Tools now: 11 (11 ever seen). Changes recorded: 11. Findings: 1 high. Last probe: OK at 2026-10-23T06:17 UTC. JSON

Current tools

evaluate_payment · get_audit_trail · get_policy · get_policy_versions · get_spend_report · list_policy_requests · list_templates · render_template · request_policy_change · revoke_policy · set_policy

Findings (2)

seen	tool	detector	severity	evidence (data, not instructions)
2026-10-23	`evaluate_payment`	`model_directed_instruction`	high	`ing any payment. ALLOW = you may pay; DENY = you must abandon; ASK = a challenge is returned — relay the reason to the`
2026-10-23	`get_policy_versions`	`cross_tool_reference`	high	`references sibling tool 'get_policy'`

Change history (11)

when	tool	kind	severity
2026-10-23 06:17	`evaluate_payment`	added	high
2026-10-23 06:17	`request_policy_change`	added	info
2026-10-23 06:17	`get_policy`	added	info
2026-10-23 06:17	`get_spend_report`	added	info
2026-10-23 06:17	`get_audit_trail`	added	info
2026-10-23 06:17	`set_policy`	added	info
2026-10-23 06:17	`revoke_policy`	added	info
2026-10-23 06:17	`get_policy_versions`	added	high
2026-10-23 06:17	`list_policy_requests`	added	info
2026-10-23 06:17	`list_templates`	added	info
2026-10-23 06:17	`render_template`	added	info

Probe history

10-23 06:17 OK (11)

Run or depend on io.boundra/boundra? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.

Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).

Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).