{
 "server": "com.directmailamerica/mcp",
 "url": "https://directmailamerica.com/api/mcp",
 "verdict": "CRITICAL findings present",
 "current_tool_count": 71,
 "tools_ever_seen": 71,
 "drift_events": 71,
 "findings_by_severity": {
  "high": 8,
  "critical": 1
 },
 "last_probe": {
  "status": "OK",
  "n_tools": 71,
  "ran_at": "2026-10-24T00:17:42.836Z"
 },
 "current_tools": [
  "approve_email_letter",
  "archive_email_letterhead",
  "check_email_box",
  "convert_postcard_image",
  "create_credit_checkout",
  "delete_address",
  "delete_cover_sheet",
  "delete_email_letter_rule",
  "delete_email_letters",
  "delete_email_postcard",
  "delete_email_postcard_rule",
  "download_email_letter",
  "download_email_letterhead",
  "download_email_letters",
  "download_job_document",
  "edit_email_letter",
  "enable_email_to_postcard",
  "generate_email_postcard_artwork",
  "generate_postcard_artwork",
  "get_billing_history",
  "get_connection_status",
  "get_credits",
  "get_email_letter",
  "get_email_letter_polling",
  "get_email_postcard",
  "get_email_postcard_quote",
  "get_email_to_letter",
  "get_email_to_postcard",
  "get_job_details",
  "get_letter_status",
  "get_payment_status",
  "get_pricing",
  "get_product_catalog",
  "get_product_quote",
  "get_webhook_settings",
  "get_workspace_settings",
  "hold_email_postcard_review",
  "list_addresses",
  "list_cover_sheets",
  "list_email_letterheads",
  "list_email_letters",
  "list_email_postcards",
  "list_jobs",
  "prepare_email_letter",
  "preview_email_letter",
  "preview_email_letterhead",
  "preview_email_postcard",
  "preview_letter",
  "preview_product_quote",
  "purchase_credits",
  "quote_email_postcard",
  "quote_product",
  "reapply_email_letter",
  "reject_email_letter",
  "render_cover_sheet",
  "request_email_box",
  "revise_email_postcard_quote",
  "save_address",
  "save_cover_sheet",
  "save_email_letter_rule",
  "save_email_letterhead",
  "save_email_postcard_rule",
  "send_letter",
  "send_product_quote",
  "start_account_login",
  "test_webhook",
  "update_email_letter_polling",
  "update_email_letter_settings",
  "update_webhook_settings",
  "update_workspace_settings",
  "validate_address"
 ],
 "drift": [
  {
   "tool": "get_connection_status",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_product_catalog",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "quote_product",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "send_product_quote",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "send_letter",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_letter_status",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "list_jobs",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_pricing",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_credits",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "purchase_credits",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "create_credit_checkout",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_payment_status",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "start_account_login",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "list_email_letterheads",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "save_email_letterhead",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "archive_email_letterhead",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "preview_email_letterhead",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "download_email_letterhead",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "download_email_letters",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "delete_email_letters",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "preview_email_letter",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_email_to_letter",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "request_email_box",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "check_email_box",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "update_email_letter_settings",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "save_email_letter_rule",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "delete_email_letter_rule",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "list_email_letters",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_email_letter",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "download_email_letter",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "edit_email_letter",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "prepare_email_letter",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "reapply_email_letter",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "approve_email_letter",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "reject_email_letter",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_email_letter_polling",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "update_email_letter_polling",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "hold_email_postcard_review",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "delete_email_postcard",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_email_to_postcard",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "enable_email_to_postcard",
   "kind": "added",
   "severity": "critical",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "list_email_postcards",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_email_postcard",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "preview_email_postcard",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "quote_email_postcard",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_email_postcard_quote",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "revise_email_postcard_quote",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "save_email_postcard_rule",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "delete_email_postcard_rule",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "generate_email_postcard_artwork",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "list_addresses",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "validate_address",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "save_address",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "delete_address",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_workspace_settings",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "update_workspace_settings",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_billing_history",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_job_details",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "download_job_document",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_product_quote",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "preview_product_quote",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "list_cover_sheets",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "save_cover_sheet",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "delete_cover_sheet",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "render_cover_sheet",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "convert_postcard_image",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "generate_postcard_artwork",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "preview_letter",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_webhook_settings",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "update_webhook_settings",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "test_webhook",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-24T00:17:42.836Z"
  }
 ],
 "findings": [
  {
   "tool": "get_connection_status",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "opes and each tool permission. Never returns credentials. Browser sign-in alone does not connect MCP.",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "send_product_quote",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "stcard quotes require a production workspace credential and the usual OAuth read/write/send permissions.",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "start_account_login",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "art authentication, create an account, issue credentials, change permissions, or send mail. Website sign-in is separate",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "preview_email_letterhead",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'preview_email_letter'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "download_email_letterhead",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'download_email_letter'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "download_email_letters",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'download_email_letter'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "request_email_box",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "ace. Returns activation state, never mailbox credentials. No email or letter is sent by this tool.",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "check_email_box",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "updated workspace and demo state; no mailbox credentials.",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_email_letter",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'download_email_letter'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "download_email_letter",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "e owning workspace. No public URL or mailbox password is exposed; clients can decode and save the resource.",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "prepare_email_letter",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'approve_email_letter'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_email_letter_polling",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'get_email_letter'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "enable_email_to_postcard",
   "detector": "exfiltration_pattern",
   "severity": "critical",
   "field": "description",
   "evidence": "address enters its separate queue, including BCC delivery; no subject prefix is required. Does not change letter",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "enable_email_to_postcard",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "nding postcardAddress. Never returns mailbox credentials. Every email delivered to the postcard address enters its separ",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_email_postcard",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'preview_email_postcard'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "quote_email_postcard",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'send_product_quote'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_email_postcard_quote",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'get_email_postcard'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "save_email_postcard_rule",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'get_email_postcard'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "delete_email_postcard_rule",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'delete_email_postcard'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "generate_email_postcard_artwork",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'preview_email_postcard'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "get_workspace_settings",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "for account security, member invitations and API-key management. Never returns credentials or webhook signing secrets",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "preview_product_quote",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'send_product_quote'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "list_cover_sheets",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'save_cover_sheet'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  },
  {
   "tool": "save_cover_sheet",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'list_cover_sheets'",
   "seen_at": "2026-10-24T00:17:42.836Z"
  }
 ],
 "probes": [
  {
   "status": "OK",
   "n_tools": 71,
   "ran_at": "2026-10-24T00:17:42.836Z"
  }
 ]
}