← MCP Registry Integrity Report

io.github.WellApp-ai/well-mcp

Verdict: CRITICAL findings present. Endpoint https://api.wellapp.ai/v1/mcp. Tools now: 94 (100 ever seen). Changes recorded: 200. Findings: {"critical":35,"high":127,"low":38}. Last probe: OK at 2026-09-28T18:17 UTC. JSON

Current tools

well_add_contact_channel · well_assign_account · well_assign_missing_invoice_owners · well_claim_statement_draft · well_create_company · well_create_company_candidate · well_create_company_workspace · well_create_invoice_document · well_create_invoice_from_data · well_create_person · well_create_statement_upload · well_delete_company · well_delete_invoice · well_delete_person · well_enqueue_invoice_fetch · well_get_accounting_settings · well_get_connector_coverage · well_get_customer_einvoicing_details · well_get_design_tokens · well_get_entity · well_get_graph · well_get_investment_holdings · well_get_own_company · well_get_schema · well_get_session_digest · well_get_skill · well_get_statement_import_result · well_get_worklist_status · well_invite_members · well_invoke_connector_tool · well_list_account_balances · well_list_accounts_needing_company · well_list_burn_exemptions · well_list_cash_scope · well_list_connector_tools · well_list_connectors · well_list_counterparties · well_list_ledger_accounts · well_list_member_candidates · well_list_missing_invoice_owners · well_list_missing_invoices · well_list_periods · well_list_recurring_contexts · well_list_retargetable_connectors · well_list_uncategorized_window · well_list_unposted_journals · well_list_unposted_transactions · well_list_workspaces · well_preview_invoice_fetch · well_preview_provider_export · well_propose_next_steps · well_query_records · well_remove_contact_channel · well_render_burn · well_render_canvas · well_render_cash_flow_bridge · well_render_cash_forecast · well_render_cash_position · well_render_cost_structure · well_render_mrr · well_render_runway · well_repost_journals · well_resolve_reconciliation_task · well_resolve_register_diff_gap · well_retarget_connectors · well_run_register_diff · well_search_company_registry · well_search_context · well_search_skill · well_set_counterparty_default_category · well_set_own_company · well_set_transaction_category · well_set_transaction_ledger_account · well_show_accounting_settings · well_show_canvas · well_show_company_candidates · well_show_invoice_design · well_show_records · well_show_retargetable_connectors · well_show_workspace_picker · well_sum_invoices · well_sum_transactions · well_switch_workspace · well_update_company · well_update_invoice · well_update_invoice_design · well_update_person · well_upload_document · well_upload_statement_bytes · well_upload_statement_content · well_upsert_accounting_settings · well_upsert_canvas · well_wait_for_process · well_wait_for_selection

Findings (200)

seentooldetectorseverityevidence (data, not instructions)
2026-09-28well_list_connectorsuser_concealmentcriticals ordering — so paging by the array's length silently skips exactly that many catalog rows on every later request.
2026-09-28well_list_connectorscross_tool_referencehighreferences sibling tool 'well_query_records'
2026-09-28well_list_connectorsoversized_descriptionlow12553 chars
2026-09-28well_preview_invoice_fetchurl_in_descriptionlowhttps://www.dropbox.com/manage/billing
2026-09-28well_preview_invoice_fetchcross_tool_referencehighreferences sibling tool 'well_list_missing_invoices'
2026-09-28well_preview_invoice_fetchoversized_descriptionlow7439 chars
2026-09-28well_switch_workspaceexfiltration_patterncriticalnection, or the whole call is refused. Never send it to name the workspace of a periods, counterparties or ack call: the
2026-09-28well_switch_workspacecross_tool_referencehighreferences sibling tool 'well_list_workspaces'
2026-09-28well_switch_workspaceoversized_descriptionlow5988 chars
2026-09-28well_wait_for_selectioncross_tool_referencehighreferences sibling tool 'well_list_workspaces'
2026-09-28well_wait_for_selectionoversized_descriptionlow6225 chars
2026-09-28well_wait_for_processcross_tool_referencehighreferences sibling tool 'well_upload_statement_bytes'
2026-09-28well_render_burnmodel_directed_instructionhighthan its typical month. When the two differ you MUST say so in prose: how many months recorded an outflow, and that t
2026-09-28well_render_burnoversized_descriptionlow5527 chars
2026-09-28well_render_mrrmodel_directed_instructionhighthan its typical month. When the two differ you MUST say so in prose: how many months recorded recurring revenue, and
2026-09-28well_render_mrroversized_descriptionlow5642 chars
2026-09-28well_list_account_balancescross_tool_referencehighreferences sibling tool 'well_sum_transactions'
2026-09-28well_list_account_balancesoversized_descriptionlow6099 chars
2026-09-28well_list_cash_scopeuser_concealmentcriticale any figure rather than presenting one that silently skipped them — and keep them apart, because they are different r
2026-09-28well_list_cash_scopecross_tool_referencehighreferences sibling tool 'well_wait_for_selection'
2026-09-28well_render_runwayoversized_descriptionlow4558 chars
2026-09-28well_list_member_candidatescross_tool_referencehighreferences sibling tool 'well_wait_for_selection'
2026-09-28well_list_unposted_transactionsuser_concealmentcriticalA caller reading one shape against the other silently sees empty fields rather than an error. The period is named in
2026-09-28well_list_unposted_transactionscross_tool_referencehighreferences sibling tool 'well_list_periods'
2026-09-28well_get_worklist_statuscross_tool_referencehighreferences sibling tool 'well_list_connectors'
2026-09-28well_get_worklist_statusoversized_descriptionlow4750 chars
2026-09-28well_get_connector_coverageuser_concealmentcriticals ordering — so paging by the array's length silently skips exactly that many catalog rows on every later request.
2026-09-28well_get_connector_coveragecross_tool_referencehighreferences sibling tool 'well_list_connectors'
2026-09-28well_get_session_digestcross_tool_referencehighreferences sibling tool 'well_get_skill'
2026-09-28well_claim_statement_drafturl_in_descriptionlowhttps://wellapp.ai/find-missing-invoices/#claim=...
2026-09-28well_claim_statement_draftcross_tool_referencehighreferences sibling tool 'well_get_statement_import_result'
2026-09-28well_show_canvascross_tool_referencehighreferences sibling tool 'well_render_burn'
2026-09-28well_upsert_canvascross_tool_referencehighreferences sibling tool 'well_render_burn'
2026-09-28well_render_canvascross_tool_referencehighreferences sibling tool 'well_render_cost_structure'
2026-09-28well_show_invoice_designcross_tool_referencehighreferences sibling tool 'well_update_invoice'
2026-09-28well_update_invoice_designuser_concealmentcriticalthat does not exist, is refused rather than silently ignored. An empty call (no fields) is refused. This does not mi
2026-09-28well_update_invoice_designcross_tool_referencehighreferences sibling tool 'well_update_invoice'
2026-09-22well_get_schemacross_tool_referencehighreferences sibling tool 'well_query_records'
2026-09-22well_query_recordsuser_concealmentcriticalname, a bank-issued label — so a name filter silently drops rows and the total reads as complete. On the invoices ro
2026-09-22well_query_recordsmodel_directed_instructionhighid only when a root has no `partyScope` and you must filter on issuer_pk / receiver_pk or the nested company_id you
2026-09-22well_query_recordscross_tool_referencehighreferences sibling tool 'well_get_schema'
2026-09-22well_query_recordsoversized_descriptionlow6660 chars
2026-09-22well_update_companycross_tool_referencehighreferences sibling tool 'well_query_records'
2026-09-22well_update_invoicecross_tool_referencehighreferences sibling tool 'well_get_schema'
2026-09-22well_add_contact_channelcross_tool_referencehighreferences sibling tool 'well_query_records'
2026-09-22well_remove_contact_channelcross_tool_referencehighreferences sibling tool 'well_query_records'
2026-09-22well_get_entitycross_tool_referencehighreferences sibling tool 'well_get_schema'
2026-09-22well_list_connector_toolscross_tool_referencehighreferences sibling tool 'well_invoke_connector_tool'
2026-09-22well_invoke_connector_toolcross_tool_referencehighreferences sibling tool 'well_query_records'
2026-09-22well_create_invoice_from_dataexfiltration_patterncriticaly without its id re-resolves it, which can attach the invoice to the wrong company or create a duplicate one. Creating and then
2026-09-22well_create_invoice_from_datamodel_directed_instructionhighg company in the workspace, bound directly — ALWAYS send this when you already know the company (e.g. you found it with w
2026-09-22well_create_invoice_from_datacross_tool_referencehighreferences sibling tool 'well_query_records'
2026-09-22well_list_workspacescross_tool_referencehighreferences sibling tool 'well_show_workspace_picker'
2026-09-22well_list_connectorsuser_concealmentcriticals ordering — so paging by the array's length silently skips exactly that many catalog rows on every later request.
2026-09-22well_list_connectorscross_tool_referencehighreferences sibling tool 'well_query_records'
2026-09-22well_list_connectorsoversized_descriptionlow12188 chars
2026-09-22well_run_register_diffcross_tool_referencehighreferences sibling tool 'well_resolve_reconciliation_task'
2026-09-22well_resolve_reconciliation_taskuser_concealmentcriticaldismisses the match — the candidate does not silently re-surface. Each task_id resolves independently; a failure on o
2026-09-22well_resolve_reconciliation_taskcross_tool_referencehighreferences sibling tool 'well_run_register_diff'
2026-09-22well_resolve_register_diff_gapcross_tool_referencehighreferences sibling tool 'well_query_records'
2026-09-22well_get_investment_holdingscross_tool_referencehighreferences sibling tool 'well_query_records'
2026-09-22well_render_cost_structurecross_tool_referencehighreferences sibling tool 'well_sum_transactions'
2026-09-22well_render_cost_structureoversized_descriptionlow4718 chars
2026-09-22well_get_own_companyuser_concealmentcriticalname, a bank-issued label), so a name filter silently drops rows. Returns `anchor` (`company_id`, `registered_name`,
2026-09-22well_get_own_companycross_tool_referencehighreferences sibling tool 'well_create_company'
2026-09-22well_list_missing_invoicescross_tool_referencehighreferences sibling tool 'well_list_periods'
2026-09-22well_list_missing_invoicesoversized_descriptionlow4420 chars
2026-09-22well_list_periodscross_tool_referencehighreferences sibling tool 'well_list_missing_invoices'
2026-09-22well_list_periodsoversized_descriptionlow10185 chars
2026-09-22well_preview_invoice_fetchurl_in_descriptionlowhttps://www.dropbox.com/manage/billing
2026-09-22well_preview_invoice_fetchcross_tool_referencehighreferences sibling tool 'well_list_missing_invoices'
2026-09-22well_preview_invoice_fetchoversized_descriptionlow7439 chars
2026-09-22well_switch_workspaceexfiltration_patterncriticalnection, or the whole call is refused. Never send it to name the workspace of a periods, counterparties or ack call: the
2026-09-22well_switch_workspacecross_tool_referencehighreferences sibling tool 'well_list_workspaces'
2026-09-22well_switch_workspaceoversized_descriptionlow5916 chars
2026-09-22well_list_counterpartiesuser_concealmentcriticalegorizing a counterparty does not change it; do not tell the user otherwise. This tool only reads. It categorizes nothin
2026-09-22well_list_counterpartiescross_tool_referencehighreferences sibling tool 'well_query_records'
2026-09-22well_list_counterpartiesoversized_descriptionlow4639 chars
2026-09-22well_wait_for_selectioncross_tool_referencehighreferences sibling tool 'well_list_workspaces'
2026-09-22well_wait_for_selectionoversized_descriptionlow6082 chars

Change history (200)

whentoolkindseverity
2026-09-28 18:17well_list_connectorsmutatedcritical
2026-09-28 18:17well_preview_invoice_fetchmutatedhigh
2026-09-28 18:17well_switch_workspacemutatedcritical
2026-09-28 18:17well_wait_for_selectionmutatedhigh
2026-09-28 18:17well_wait_for_processaddedhigh
2026-09-28 18:17well_render_burnmutatedhigh
2026-09-28 18:17well_render_mrrmutatedhigh
2026-09-28 18:17well_list_account_balancesmutatedhigh
2026-09-28 18:17well_render_cash_positionmutatedmedium
2026-09-28 18:17well_list_cash_scopemutatedcritical
2026-09-28 18:17well_render_runwaymutatedmedium
2026-09-28 18:17well_list_member_candidatesmutatedhigh
2026-09-28 18:17well_list_unposted_transactionsmutatedcritical
2026-09-28 18:17well_get_worklist_statusmutatedhigh
2026-09-28 18:17well_get_connector_coveragemutatedcritical
2026-09-28 18:17well_get_session_digestmutatedhigh
2026-09-28 18:17well_claim_statement_draftmutatedhigh
2026-09-28 18:17well_show_canvasaddedhigh
2026-09-28 18:17well_upsert_canvasaddedhigh
2026-09-28 18:17well_preview_provider_exportaddedinfo
2026-09-28 18:17well_render_canvasaddedhigh
2026-09-28 18:17well_show_invoice_designaddedhigh
2026-09-28 18:17well_update_invoice_designaddedcritical
2026-09-28 18:17well_get_runwayremovedinfo
2026-09-28 18:17well_get_cash_positionremovedinfo
2026-09-28 18:17well_get_cost_structureremovedinfo
2026-09-28 18:17well_get_burnremovedinfo
2026-09-28 18:17well_get_cash_forecastremovedinfo
2026-09-28 18:17well_get_cash_flow_bridgeremovedinfo
2026-09-28 12:17well_get_runwayremovedinfo
2026-09-28 12:17well_get_cash_positionremovedinfo
2026-09-28 12:17well_get_cost_structureremovedinfo
2026-09-28 12:17well_get_burnremovedinfo
2026-09-28 12:17well_get_cash_forecastremovedinfo
2026-09-28 12:17well_get_cash_flow_bridgeremovedinfo
2026-09-28 06:17well_get_runwayremovedinfo
2026-09-28 06:17well_get_cash_positionremovedinfo
2026-09-28 06:17well_get_cost_structureremovedinfo
2026-09-28 06:17well_get_burnremovedinfo
2026-09-28 06:17well_get_cash_forecastremovedinfo
2026-09-28 06:17well_get_cash_flow_bridgeremovedinfo
2026-09-28 00:17well_get_runwayremovedinfo
2026-09-28 00:17well_get_cash_positionremovedinfo
2026-09-28 00:17well_get_cost_structureremovedinfo
2026-09-28 00:17well_get_burnremovedinfo
2026-09-28 00:17well_get_cash_forecastremovedinfo
2026-09-28 00:17well_get_cash_flow_bridgeremovedinfo
2026-09-27 18:17well_get_runwayremovedinfo
2026-09-27 18:17well_get_cash_positionremovedinfo
2026-09-27 18:17well_get_cost_structureremovedinfo
2026-09-27 18:17well_get_burnremovedinfo
2026-09-27 18:17well_get_cash_forecastremovedinfo
2026-09-27 18:17well_get_cash_flow_bridgeremovedinfo
2026-09-27 12:17well_get_runwayremovedinfo
2026-09-27 12:17well_get_cash_positionremovedinfo
2026-09-27 12:17well_get_cost_structureremovedinfo
2026-09-27 12:17well_get_burnremovedinfo
2026-09-27 12:17well_get_cash_forecastremovedinfo
2026-09-27 12:17well_get_cash_flow_bridgeremovedinfo
2026-09-27 06:17well_get_runwayremovedinfo
2026-09-27 06:17well_get_cash_positionremovedinfo
2026-09-27 06:17well_get_cost_structureremovedinfo
2026-09-27 06:17well_get_burnremovedinfo
2026-09-27 06:17well_get_cash_forecastremovedinfo
2026-09-27 06:17well_get_cash_flow_bridgeremovedinfo
2026-09-27 00:17well_get_runwayremovedinfo
2026-09-27 00:17well_get_cash_positionremovedinfo
2026-09-27 00:17well_get_cost_structureremovedinfo
2026-09-27 00:17well_get_burnremovedinfo
2026-09-27 00:17well_get_cash_forecastremovedinfo
2026-09-27 00:17well_get_cash_flow_bridgeremovedinfo
2026-09-26 18:17well_get_runwayremovedinfo
2026-09-26 18:17well_get_cash_positionremovedinfo
2026-09-26 18:17well_get_cost_structureremovedinfo
2026-09-26 18:17well_get_burnremovedinfo
2026-09-26 18:17well_get_cash_forecastremovedinfo
2026-09-26 18:17well_get_cash_flow_bridgeremovedinfo
2026-09-26 12:17well_get_runwayremovedinfo
2026-09-26 12:17well_get_cash_positionremovedinfo
2026-09-26 12:17well_get_cost_structureremovedinfo
2026-09-26 12:17well_get_burnremovedinfo
2026-09-26 12:17well_get_cash_forecastremovedinfo
2026-09-26 12:17well_get_cash_flow_bridgeremovedinfo
2026-09-26 06:17well_get_runwayremovedinfo
2026-09-26 06:17well_get_cash_positionremovedinfo
2026-09-26 06:17well_get_cost_structureremovedinfo
2026-09-26 06:17well_get_burnremovedinfo
2026-09-26 06:17well_get_cash_forecastremovedinfo
2026-09-26 06:17well_get_cash_flow_bridgeremovedinfo
2026-09-26 00:17well_get_runwayremovedinfo
2026-09-26 00:17well_get_cash_positionremovedinfo
2026-09-26 00:17well_get_cost_structureremovedinfo
2026-09-26 00:17well_get_burnremovedinfo
2026-09-26 00:17well_get_cash_forecastremovedinfo
2026-09-26 00:17well_get_cash_flow_bridgeremovedinfo
2026-09-25 12:17well_get_runwayremovedinfo
2026-09-25 12:17well_get_cash_positionremovedinfo
2026-09-25 12:17well_get_cost_structureremovedinfo
2026-09-25 12:17well_get_burnremovedinfo
2026-09-25 12:17well_get_cash_forecastremovedinfo
2026-09-25 12:17well_get_cash_flow_bridgeremovedinfo
2026-09-25 06:17well_get_runwayremovedinfo
2026-09-25 06:17well_get_cash_positionremovedinfo
2026-09-25 06:17well_get_cost_structureremovedinfo
2026-09-25 06:17well_get_burnremovedinfo
2026-09-25 06:17well_get_cash_forecastremovedinfo
2026-09-25 06:17well_get_cash_flow_bridgeremovedinfo
2026-09-25 00:17well_get_runwayremovedinfo
2026-09-25 00:17well_get_cash_positionremovedinfo
2026-09-25 00:17well_get_cost_structureremovedinfo
2026-09-25 00:17well_get_burnremovedinfo
2026-09-25 00:17well_get_cash_forecastremovedinfo
2026-09-25 00:17well_get_cash_flow_bridgeremovedinfo
2026-09-24 18:17well_get_runwayremovedinfo
2026-09-24 18:17well_get_cash_positionremovedinfo
2026-09-24 18:17well_get_cost_structureremovedinfo
2026-09-24 18:17well_get_burnremovedinfo
2026-09-24 18:17well_get_cash_forecastremovedinfo
2026-09-24 18:17well_get_cash_flow_bridgeremovedinfo
2026-09-24 12:17well_get_runwayremovedinfo

Probe history

09-28 18:17 OK (94) · 09-28 12:17 OK (87) · 09-28 06:17 OK (87) · 09-28 00:17 OK (87) · 09-27 18:17 OK (87) · 09-27 12:17 OK (87) · 09-27 06:17 OK (87) · 09-27 00:17 OK (87) · 09-26 18:17 OK (87) · 09-26 12:17 OK (87) · 09-26 06:17 OK (87) · 09-26 00:17 OK (87) · 09-25 12:17 OK (87) · 09-25 06:17 OK (87) · 09-25 00:17 OK (87) · 09-24 18:17 OK (87) · 09-24 12:17 OK (87) · 09-24 06:17 OK (87) · 09-23 12:17 OK (87) · 09-23 06:17 OK (87) · 09-23 00:17 OK (87) · 09-22 18:17 OK (87) · 09-22 12:17 OK (82) · 09-22 00:17 OK (82) · 09-21 18:17 OK (82) · 09-21 12:17 OK (82) · 09-21 06:17 OK (82) · 09-21 00:17 OK (82) · 09-20 18:17 OK (82) · 09-20 12:17 OK (82)

Get alerted when this server changes: tooldrift.agentexchange.work ($29/mo watch).