{
 "server": "io.github.corply-dev/corply",
 "url": "https://corply.dev/mcp",
 "verdict": "high-severity findings present",
 "current_tool_count": 52,
 "tools_ever_seen": 52,
 "drift_events": 42,
 "findings_by_severity": {
  "high": 32
 },
 "last_probe": {
  "status": "OK",
  "n_tools": 52,
  "ran_at": "2026-08-15T06:17:15.854Z"
 },
 "current_tools": [
  "adopt_existing_company",
  "amend_frozen_application",
  "await_payment",
  "await_registered_agent_upgrade",
  "check_company_names",
  "configure_payment_catalog",
  "create_payment_integration_bundle",
  "create_payment_project",
  "create_payment_route_draft",
  "generate_documents",
  "get_bank_onboarding_status",
  "get_cap_table",
  "get_company_briefing",
  "get_org",
  "get_payment_pipeline_status",
  "get_status",
  "import_cap_table",
  "invite_cofounders",
  "invite_member",
  "manage_operating_access_grant",
  "mark_task_done",
  "nudge_signer",
  "prepare_83b_tin_input",
  "prepare_revenue_launch",
  "recall",
  "reconcile_bank_onboarding",
  "reconcile_payment_route",
  "record_existing_completion",
  "record_operating_event",
  "record_operating_evidence",
  "record_operating_fact",
  "redeem_invite",
  "refresh_payment_route_onboarding",
  "remember",
  "request_payment",
  "request_registered_agent_upgrade",
  "request_signature",
  "resolve_company_plan",
  "run_sandbox_payment_probe",
  "run_sandbox_payout_probe",
  "save_application",
  "sign_bundle",
  "start_bank_onboarding",
  "start_payment_route_onboarding",
  "submit_for_formation",
  "submit_operating_fact_evidence",
  "transition_operating_work_item",
  "upload_operating_evidence",
  "upsert_operating_subject",
  "validate_application",
  "verify_payment_integration",
  "whoami"
 ],
 "drift": [
  {
   "tool": "validate_application",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "check_company_names",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "generate_documents",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "request_payment",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "await_payment",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "request_registered_agent_upgrade",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "await_registered_agent_upgrade",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "request_signature",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "sign_bundle",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "submit_for_formation",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "remember",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "recall",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "invite_member",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "redeem_invite",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "invite_cofounders",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "nudge_signer",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "mark_task_done",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "prepare_revenue_launch",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "create_payment_project",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "configure_payment_catalog",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "create_payment_integration_bundle",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "verify_payment_integration",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "get_payment_pipeline_status",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "create_payment_route_draft",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "start_payment_route_onboarding",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "refresh_payment_route_onboarding",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "reconcile_payment_route",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "run_sandbox_payment_probe",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "run_sandbox_payout_probe",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "get_bank_onboarding_status",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "start_bank_onboarding",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "reconcile_bank_onboarding",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "resolve_company_plan",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "upsert_operating_subject",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "manage_operating_access_grant",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "record_operating_fact",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "record_operating_event",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "upload_operating_evidence",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "record_operating_evidence",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "submit_operating_fact_evidence",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "record_existing_completion",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "transition_operating_work_item",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-15T06:17:15.854Z"
  }
 ],
 "findings": [
  {
   "tool": "request_payment",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'request_registered_agent_upgrade'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "await_payment",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'request_payment'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "request_registered_agent_upgrade",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'await_registered_agent_upgrade'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "await_registered_agent_upgrade",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'request_registered_agent_upgrade'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "request_signature",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'request_payment'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "sign_bundle",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'get_status'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "submit_for_formation",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'request_payment'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "invite_cofounders",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'request_payment'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "prepare_revenue_launch",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "provider calls and no writes; never requests credentials, identity documents, bank/card data, or acceptance of terms. If",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "prepare_revenue_launch",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'get_company_briefing'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "create_payment_project",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'prepare_revenue_launch'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "configure_payment_catalog",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "onment-variable NAMES only—never Paddle IDs, API keys, webhook secrets, bank/card data, or customer data. Makes zero",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "configure_payment_catalog",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'create_payment_integration_bundle'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "create_payment_integration_bundle",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "overwrites existing files, and never handles credential values. The manifest is verify-exact and must never be merged fi",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "create_payment_integration_bundle",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'verify_payment_integration'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "get_payment_pipeline_status",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "s for one company. It never returns provider credentials, hosted payment tokens, bank/card data, or customer data; makes",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "create_payment_route_draft",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "n idempotency key; it cannot accept or store credentials, provider IDs, identity documents, terms acceptance, bank/card",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "create_payment_route_draft",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'get_payment_pipeline_status'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "start_payment_route_onboarding",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "identity documents, bank/card data, provider credentials, or terms acceptance in chat, activates no route, and moves no",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "start_payment_route_onboarding",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'get_payment_pipeline_status'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "refresh_payment_route_onboarding",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "oute connection. It accepts no provider IDs, credentials, identity documents, bank/card data, or terms acceptance from c",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "reconcile_payment_route",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "s only, exposes no provider account, wallet, credential, bank/card, or customer data, and moves no money. The first run",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "get_bank_onboarding_status",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "r returns SSNs, identity documents, provider credentials, or submitted KYC payloads. A handoff URL is available only to",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "start_bank_onboarding",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "ntity image, raw formation document, Mercury credential, or legal name/EIN override; Corply loads trusted company facts",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "start_bank_onboarding",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'get_bank_onboarding_status'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "upsert_operating_subject",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "s. Never fabricate personal, immigration, or credential data. Prerequisite: authenticated active organization access plu",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "upsert_operating_subject",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'record_operating_fact'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "record_operating_event",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'resolve_company_plan'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "upload_operating_evidence",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'record_operating_evidence'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "record_operating_evidence",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "sional determinations require named reviewer credentials. A guidance link or model assertion is never professional evide",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "record_operating_evidence",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'upload_operating_evidence'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  },
  {
   "tool": "submit_operating_fact_evidence",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'upload_operating_evidence'",
   "seen_at": "2026-08-15T06:17:15.854Z"
  }
 ],
 "probes": [
  {
   "status": "OK",
   "n_tools": 52,
   "ran_at": "2026-08-15T06:17:15.854Z"
  }
 ]
}