Event management platform for creating events, selling tickets, managing guest lists, affiliates, and promo codes.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 28 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The socialloop MCP server exposes 146 tools, focused primarily on general-purpose capabilities. Its published description reads: "Event management platform for creating events, selling tickets, managing guest lists, affiliates, and promo codes". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates socialloop F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Data-exfiltration parameters" and "Single tool combines the lethal trifecta". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check socialloop's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add socialloop to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://socialloop.ai/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
List the events you host — name, date, status, visibility, location, capacity, and headcount, plus the total count. See how many events you have, or find an event's id before acting on it. Optional fi
Create an event draft on the user's behalf and return a claim link they open to publish it. Use when a user wants to create or publish an event — works even if they have no SocialLoop account yet. The
Refine an event draft you previously created (title, time, location, tickets, etc.) using its edit token, against the same claim link. Use to iterate with the user before they publish.
Edit a live event you manage: name, description (with links), category, start/end time, cover image, turn public discovery on/off, show or hide the guest list, visibility, capacity, and approval. Requ
Turn an existing event into a recurring series — pattern (daily/weekly/biweekly/monthly) + end (end_after total occurrences, or end_date). The source becomes occurrence 1; the rest are created on cade
Manage a recurring series — action 'extend' (add additional_count more occurrences), 'end' (cancel upcoming; mode 'pause' to suspend, optional from_date), or 'resume' (restart a paused series). Requir
Duplicate an event's setup into a new draft — copies name (+ '(Copy)'), description, category, image, location, visibility, ticket tiers/pricing, and extras (promo codes, discount profiles, forms, imm
Set or replace a live event's cover image. Provide ONE of: image_base64 (the raw image bytes — use this to set an image attached or generated in the chat, passing its FULL bytes) OR image_url (a publi
Generate a brand-new cover image (a finished event flyer) for an event from a TEXT prompt — describe the vibe, palette, imagery, and energy. We render it server-side (no image upload from you needed —
Refine the event's CURRENT cover with a short instruction ('make it warmer', 'swap the background', 'bigger title') — we re-render from the existing cover, keep the composition, and set the new one. T
Set a custom vanity URL for a live event you manage (e.g. socialloop.ai/go/sundown-sessions). 3–30 lowercase letters, numbers, and hyphens; must be unique. Requires event_id; you must be a host.
Set or change a live event's address/location. Provide `address` (the text shown on the event page); optionally `venue_name` and `latitude`+`longitude` to also move the map pin. Use this to fix or upd
Invite a co-host to a live event by email. role 'producer' = full permissions; role 'co_host' = display + invite-from-own-list. They get an email and join on accept. Requires event_id; you must be a h
Show or hide a host on a live event's public page without changing their permissions (visible=false hides, true shows). host_id defaults to you. Requires event_id; you must be a host.
Cancel a live event you manage — marks it cancelled, removes it from public discovery, cleans up invites/affiliates/broadcasts. Irreversible and outward-facing. Requires event_id; you must be a host.
Add a ticket tier to a live event you manage — free RSVP (price 0) or paid, with capacity, optional approval, or a secret unlock code. Paid tiers need Stripe connected. Requires event_id; you must be
Edit a ticket tier on a live event you manage — name, price, capacity (not below sold), description, approval, or secret. Paid prices need Stripe. Requires event_id + tier_id; you must be a host.
Archive a ticket tier (take it off sale) on a live event you manage. Reversible. Requires event_id + tier_id; you must be a host.
Restore an archived ticket tier to active (back on sale). Requires event_id + tier_id; you must be a host.
Reorder the active ticket tiers' display order. Pass ALL active tier ids in the desired order. Requires event_id; you must be a host.
Permanently delete a ticket tier — only if no tickets were sold (otherwise archive it). Irreversible. Requires event_id + tier_id; you must be a host.
List the ticket tiers on a live event you manage — name, price, capacity, sold, available — with totals. Requires event_id; you must be a host. Read-only.
List the guests on a live event you manage — name, email, phone, category, plus-ones, check-in status — with totals and checked-in count. Optional category filter. Requires event_id; you must be a hos
Export a live event's guest list as a downloadable CSV (name, email, phone, category, ticket class, plus-ones, checked-in, note) and return a download link. Optional category filter. Requires event_id
Add a guest to a live event's guest list — name, optional email, phone, category (e.g. vip/press), plus-ones, note, tags, and an optional ticket tier. Counts against the weekly invite limit. Requires
Edit a guest-list entry on a live event you manage — name, email, phone, category, plus-ones, note, tags. Only guest-list entries, never purchased tickets. Requires event_id + guest_id; you must be a
Remove a guest-list entry from a live event you manage — deletes the entry and cleans up its counters. Only guest-list entries, never purchased tickets. Requires event_id + guest_id; you must be a hos
Check a guest in (or back out) at a live event you manage — toggles their ticket between active and checked-in. Pass checked_in false to undo. Requires event_id + guest_id; you must be a host.
Check in one of a guest's allowed plus-ones at a live event you manage (fails if they're at their plus-one limit). Requires event_id + parent_guest_id + plus_one_name; you must be a host.
Promote a guest (who has a SocialLoop account) to staff on a live event — role doorPerson, guestList, manager, promoter, host, or custom. Grants real permissions. Requires event_id + guest_id + user_i
Remove a staff member's role on a live event and demote them back to a guest (they keep their spot). Requires event_id + user_id; you must be a host.
Bulk-add up to 200 guests to a live event's guest list in one call (parse the CSV / contact list into rows; each needs at least a first name). Counts the whole batch against the weekly invite limit. R
Get the full record for one guest on a live event — identity, tier, plus-ones, check-in status + time, staff role, tags, note, activity log, and plus-ones. Requires event_id + guest_id; you must be a
Change an existing staff member's role and/or permissions on a live event (doorPerson, guestList, manager, promoter, host, or custom). Requires event_id + user_id and a role and/or permissions; you mu
List the staff on a live event you manage — each member's role, permissions, name/email, and whether they were promoted from a guest. Requires event_id; you must be a host. Read-only.
List the pending WAITLIST / approval requests on a live event you manage — how many are waiting, who asked, which tier, and when (oldest first). This is the event waitlist. Pair with approve_guest_req
Approve someone on the event WAITLIST / approval queue — issues them a capacity-limited comp ticket and notifies them. Get request_id + user_id + ticket_class_id from list_guest_requests. Requires eve
Deny someone on the event WAITLIST / approval queue — releases their held slot back to the tier, frees them to re-register, and emails them. Get request_id from list_guest_requests. Requires event_id
Send invitations to a live event — app, email, or both — to people (recipient_uids), saved lists (distribution_list_ids), and/or manual contacts (external_contacts). Optionally attach a promo code, ad
Send an announcement to ALL guests of a live event you manage — one message delivered by email (to guests with an address on file, minus unsubscribes) AND as an in-app push notification. Provide subje
Check the status of an invitation send — state, recipient count, invites/emails sent, failures, % complete. Requires event_id + job_id; you must be a host. Read-only.
Cancel a running or scheduled invitation send (stops future batches; already-scheduled emails still deliver). Requires event_id + job_id; you must be a host.
List your saved distribution lists (name + contact count) so you can pick one to invite from with send_invitations. Requires a connected account. Read-only.
Import contacts into one of your distribution lists (your network) — give a list_name (created if new) plus a contacts array ({name,email,phone}) and/or raw csv text (header row auto-mapped). Normaliz
Create a trackable share link (socialloop.ai/go/…) for a live event — tag it with a source (instagram, newsletter) and optional campaign; clicks are counted. Opens the public or immersive page. Requir
Get the shareable links for a live event — public URL, immersive-page URL, vanity short link, and every trackable custom link with its source and click count. Requires event_id; you must be a host. Re
Create a discount/promo code (percent or fixed) on a live event or an unclaimed draft. Provide either event_id, or draft_id + edit_token.
Edit a promo code on a live event — code, discount, max uses, start/expiry, applicable classes, or enable/disable. Requires event_id + promo_code_id; you must be a host.
Create up to 500 promo codes on a live event in one call (duplicates and invalid rows skipped with reasons). Counts against the event's promo-code plan cap. Requires event_id; you must be a host.
List the promo codes on a live event — code, discount, usage vs cap, schedule, classes, and whether each is an affiliate/profile code. Requires event_id; you must be a host. Read-only.
Invite an affiliate/promoter to a live event by email with their discount and optional commission. Sends an invite email; they get a tracked code on accept. Counts against the affiliate plan cap. Requ
Create a reusable 'open' affiliate profile — a shareable link promoters self-join (no named email; use add_affiliate for a specific person). Set per-tier discount, optional code prefix, affiliate cap,
Invite up to 200 affiliates to a live event at once by email with a shared discount/commission. Sends each an invite email. Counts against the affiliate plan cap. Requires event_id + emails; you must
Change an affiliate's commission rates on a live event (map of promo_code_id → commission). Affects future sales only. Requires event_id + affiliate_id; you must be a host.
Remove an affiliate from a live event — disables their promo codes (keeps redemption history) and revokes access. Requires event_id + affiliate_id; you must be a host.
List the affiliates on a live event — name, email, their promo codes (discount + commission), and sales stats (tickets sold, revenue, commission). Requires event_id; you must be a host. Read-only.
Extend an affiliate to another ticket tier — adds the tier to their promo code with its own discount and optional commission. Requires event_id + affiliate_id + ticket_class_id + discount; you must be
Remove a ticket tier from an affiliate (disables their code if it was the last tier). Requires event_id + affiliate_id + ticket_class_id; you must be a host.
Reconfigure an affiliate open link (anyone-can-claim) — set each tier's discount + commission, the profile name, and the affiliate cap. Re-stamps EVERY existing affiliate on the link (large blast radi
Create a discount (coupon) profile on a live event — a reusable per-tier discount config (tiers: ticket_class_id → percent/fixed) that promo codes attach to, with optional max uses + schedule. Counts
List the discount (coupon) profiles on a live event — name, per-tier config, schedule, code count, enabled state. Requires event_id; you must be a host. Read-only.
Attach or auto-generate promo codes under a discount profile — each code inherits the profile's discount and becomes immediately redeemable. Give explicit codes and/or auto_generate a count (optional
Reassign existing standalone promo codes into a discount profile — each adopted code takes the profile's discount but keeps its prior usage count. Codes already in a profile or linked to an affiliate
Remove promo codes from a discount profile — 'detach' (default) keeps each code standalone; 'delete' removes unused codes but disables any with redemptions. Requires event_id + profile_id + code_ids;
Edit a discount profile — change tiers, name, max uses, schedule, or enabled state. When a discount-config field changes, every linked promo code is re-stamped to match. Requires event_id + profile_id
Delete a discount profile and resolve its codes — 'detach' (default) keeps each code standalone; 'delete_codes' deletes unused codes but disables any with redemptions. Requires event_id + profile_id;
Invite a staff/team member to a live event by email with a role — host (Producer), manager, guest_list, door_person, or promoter (Co-Host). Sends an invite email; they join on accept. Requires a Pro p
List the pending team/staff invites on a live event — email, role, and when invited. Accepted staff appear in list_event_staff. Requires event_id; you must be a host. Read-only.
Cancel a pending team/staff invite (before it's accepted). To remove an accepted member, use demote_staff_to_guest. Requires event_id + invite_id; you must be a host.
Add a vendor (supplier) to a live event's production graph — name, service, pipeline status, contact info, itemized list, notes, tags, linked projects. Requires event_id + name; you must be a host.
Add talent (performer, artist, DJ, speaker) to a live event's roster — name, bio, booking status, categories, act title, duration, contact, rider. Requires event_id + name; you must be a host.
Add a production task to a live event — title, priority, and phase (pre_production/build/event/strike/post). Requires event_id + title; you must be a host.
Create a production project on a live event — the container for tasks, roles, vendors, and budget. Name, description, category, priority, status, deliverable, dates. Requires event_id + name; you must
Record an expense (receipt) against a live event's budget — item, cost ($), amount paid, status, type, optional linked vendor/project. Editable via update_production_item (entity 'receipts'). Requires
Record a bank-side ledger row — actual money moving (income/expense/transfer): name, amount ($), optional fee, category, phase, date, banking references, and links to a receipt/project/vendor/place/te
Add a run-of-show cue / schedule item to a live event — a time-blocked moment (lighting/sound/performance/transition/safety/…) with start (and optional end), lane, cue number, project, talent. Require
Add a production role to a live event — an accountable role (Stage Manager, Catering Lead) that tasks/vendors/receipts reference. Name, description, category, notes. Requires event_id + name; you must
Add a physical asset / gear item to a live event's inventory — name, category, status (wish_list … in_use), priority, quantity + quantity needed, unit cost ($), location, project/place links. Requires
Add a programming item (curated experience — workshop, performance, DJ set, ritual) to a live event — title, status (ideation … ready), types, duration, start time, linked talent/places, rider, produc
Add a meal to a live event's culinary plan — kind (breakfast/lunch/dinner/snack/special), serve time (required), title, status (planning … served), expected diners, stations, shopping list, estimated
Add a place / location to a live event — a build site, zone, or venue area (name, structure, sector, lifecycle + build status, parent place, budgets, start date). Requires event_id + name; you must be
Set a place's build status (not_started → surveyed → staged → built → systemized → designed → complete, or null to clear) — the build axis, separate from lifecycle status. Requires event_id + place_id
Add a sponsor to your sponsor book — company, tier (platinum/gold/silver/bronze), total committed ($), deliverables, optional contact. Spans all your events. Requires a connected account.
List your sponsors — company, tier, total committed ($), deliverables, contact, plus the grand total (highest first). Optional tier filter. Requires a connected account. Read-only.
Create a production item in ANY area of a live event — entity is one of: milestones, timeline, schedule_items, tasks, projects, vendors, talent, roles, inventory, programming, meals, places, modes (ev
Update a production item in ANY area of a live event (entity: milestones, timeline, schedule_items, tasks, projects, vendors, talent, roles, inventory, programming, meals, places, modes, transactions,
Permanently delete a production item (any entity: milestones, timeline, schedule_items, tasks, projects, vendors, talent, roles, inventory, programming, meals, places, modes, transactions, invoices, t
List production items on a live event — entity is any of milestones, timeline, schedule_items, tasks, projects, vendors, talent, roles, inventory, programming, meals, places, modes, transactions, invo
Interconnect production items on a live event — link an item to others across the graph (task→project, project→teams/places/milestones, vendor→projects, programming→talent/places, inventory→team/place
Assign a role (by role_id) to a production item — entity tasks/receipts/vendors/inventory/schedule_items (single) or projects (multiple). Stored as a name snapshot. op set/add/remove. Requires event_i
Assign a person to a production item — teams→members/leads, milestones→owner/watchers, schedule_items→lead/assigned, cues→caller/owner, tasks→designated, places→build_lead, vendors→admin/leads, projec
Set a meal's menu — array of {name, servings?, description?, dietary_tags?, tags? (allergens)}. Replaces the whole list. Requires event_id + item_id (the meal); host.
Set an invoice's line items — array of {description, amount} (dollars). Recomputes the invoice total. Replaces the whole list. Requires event_id + item_id; host.
Set an inventory item's typed details — kind vehicle/housing/bike/structure/power + that variant's fields (vehicle: plate/makeModel/vin/fuelType; housing: sleepCapacity/powerNeeds; power: rating/phase
Create a registration/intake form on a live event — name + questions (text/textarea/select/multiSelect/email/phone/url/number, with options/required/placeholder). Starts as draft; activate with set_fo
Edit a form on a live event — rename and/or replace its questions. Pass questions with their ids (from list_forms) to keep responses mapped. Requires event_id + form_id; you must be a host.
Activate or deactivate a form on a live event (activating makes it the event's live form, deactivating any other). Requires event_id + form_id + active; you must be a host.
List the forms on a live event — name, status, response count, and every question (with ids). Requires event_id; you must be a host. Read-only.
Read the responses submitted to a form — each submission's answers and when it arrived, newest first. Requires event_id + form_id; you must be a host. Read-only.
Export a form's submitted responses as a downloadable CSV — one row per submission, one column per question, plus Submitted At — and return a download link. Requires event_id + form_id; you must be a
Get a live event's revenue — net actually paid (cents), tickets sold, per-tier breakdown, an unattributed bucket, and each affiliate's reported revenue/commission (the same 'Earned' figure the Revenue
List the paid ticket sales on a live event — buyer name/email, tier, amount paid (cents), discount, promo code, date (newest first). Skips free/guest-list and cancelled tickets. Requires event_id; you
Create a community you own — name, description, category, privacy (open/private), tags, icon/cover. Counts against your community plan cap. Requires a connected account.
Edit a community you own — name, description, category, privacy, tags, icon, cover. Requires community_id; you must be its creator.
List the communities you belong to — name, icon, your role, status. owned_only true for just the ones you created. Requires a connected account. Read-only.
List the active members of a community you run — name, role (creator/admin/member), join date. Optional role filter. Requires community_id; you must be its creator or admin. Read-only.
List the pending requests to join a community you run — who asked and when. Approve/reject with approve_join_request / reject_join_request. Requires community_id; you must be its creator or admin. Rea
Approve a pending request to join a community you run (adds them as a member). Requires community_id + user_id; you must be its creator or admin.
Reject a pending request to join a community you run. Requires community_id + user_id; you must be its creator or admin.
Remove a member from a community you run (tears down their membership). The creator cannot be removed. Requires community_id + user_id; you must be its creator or admin.
Reject an event's request to be listed in a community you run (optional reason). Denies any Space booking request riding it — optionally suggest up to 5 alternative slots, each vetted against confirme
List events awaiting approval in a community you run — who submitted, when, whether they asked for your community payout, and any requested venue Space slot with its conflicts (hard = confirmed overla
Trace the consequential decisions in a community you run — the approval audit log, newest-first. Each entry names WHO acted, WHEN, to WHICH event, and — for approvals — at WHAT deal terms (producer%/c
Approve a pending event submission in a community you run — listing, pre-consented deal terms, and any venue Space booking confirm in ONE atomic action. REFUSES payout-routing submissions (money appro
List a community's bookable venue Spaces (rooms/floors) — name, Location (the named place grouping Spaces, when used), floor, capacity, status, weekly hours, per-booking hour cap, photo count. Sorted
Add a bookable venue Space (room/floor) to a community you run — name, optional location_name (the Location grouping Spaces: campus building, city site, festival zone; skip for a single place), floor,
Edit a venue Space's fields (name, location_name, floor, capacity, photos, rules, hours, address, hour cap, timezone; null clears). Renames fan out to future bookings automatically; status changes go
Archive or re-activate a venue Space. Archiving hides it from pickers and fails future booking confirms closed; existing confirmed bookings are honored, but pending requests will strand. Admin-only. R
Check whether a venue Space is free for a specific slot: available (no confirmed overlap), every overlapping booking labeled hard (taken) or soft (pending request — first approval wins), and a soft li
Find open bookable gaps across a community's venue Spaces for a duration (minutes) within a date range (max 31 days) — clears confirmed bookings AND each Space's listed hours. Optional space_id, locat
Submit an event you host to a community's calendar, optionally requesting a venue Space slot in the same motion (booking: space_id + ISO times — find one via find_open_slots). Consents to the communit
Release a venue booking — frees the Space's slot. Community creator/admin/moderator releases any booking; the booking's own host withdraws their slot (listing kept). Terminal; a re-request is a new bo
As a community you run, ASSIGN an approved event to a venue Space + slot (space_id + ISO start_time/end_time) — confirms the booking on the same conflict lock so it can never double-book. If the event
As a community you run, UNASSIGN an event from its venue Space here — frees the Space's calendar slot (recorded admin_released) and clears the event's venue link; the event keeps its listing and venue
List a community's venue bookings — space (with its Location/floor as booked), slot, status, event, host. Optional space_id / day (UTC YYYY-MM-DD, live bookings only) / status filters; ordered by star
Record agreed ticket-split terms as a deal proposal (the receipt of an agreement already reached). community_standing: community_id + producer_id + both legs' % terms. event_coproduction: event_id + p
Confirm a recorded deal's pending terms as a party (or community admin). Activates on unanimity — an ACTIVE deal auto-stamps its ticket split when the event attaches (deal = pre-approval), so this is
Decline a deal's pending terms (optional reason). First-proposal declines close the thread; renegotiation declines keep the deal active on current terms. Requires deal_id.
End an ACTIVE deal prospectively — sold tickets keep their stamped terms, attached events are untouched, only NEW attachments stop. Terminal for the thread. Requires deal_id.
List your ticket-split deals with an awaiting_your_confirmation flag, or ALL of a community's deals via community_id (admin-only). Optional event_id/status filters. Read-only.
Set a community's standing ticket-split offer per member role (e.g. staff events run 70/30; "__member__" = the member's leg). Becomes a real deal only when a member confirms the shown terms at event s
Set a member's producer setup in a community you run: submit permission, optionally with split terms (they keep 70% / community 30%). Activates immediately — community-set, the member sees it but does
Edit a member setup's split terms (terms: null = permission-only). Prospective — future attaches use the new terms, attached events keep theirs. Requires deal_id.
Adjust the split for ONE event only (setup 80/20, this event 90/10). Re-stamps the attached event immediately; sold tickets keep their terms; the standing setup is untouched; expires with the event. C
End a member's producer setup in one tap (prospective — sold tickets and attached events keep their terms; its event exceptions end with it). Requires deal_id.
Create a partner profile — a named terms-group ('Resident DJs · keep 75%'). Members added or invited into it get its split terms automatically. Needs the community's Stripe connected. Requires communi
Rename a partner profile or set new terms — new terms roll to ALL members' future events (past sales unchanged). Requires community_id + profile_id.
Archive a partner profile — ends every member's terms prospectively. Terminal. Requires community_id + profile_id.
Add a community member to a partner profile — its split terms apply to them immediately (community-set, no confirmation step). Refuses over existing terms unless replace_existing: true. Requires commu
Remove a member from a partner profile — ends their terms prospectively. Requires community_id + profile_id + member_uid.
List a community's partner profiles with terms and member counts (admin-only). Requires community_id. Read-only.
List the people in your network — everyone who has attended your events, with how many events each attended and when last seen (most frequent first). Optional name/username search. Requires a connecte
List events shared with you — where you're added as staff (producer/manager/guest-list/door) or as an affiliate/promoter — with each event's name and your role. Requires a connected account. Read-only
Get your account status — plan + subscription, Stripe connected + payouts/charges enabled (can you get paid out), weekly-invite add-on, and your plan caps (staff, promo codes, affiliates, tiers, commu
Get a Stripe Connect onboarding link the host opens to connect their account and enable payouts for ticket sales. Creates their Stripe account and returns the onboarding URL. Check get_account_status
List your custom email-sending domains — domain, verification status, verified-at, DNS record count. Shows whether you can send from your own domain. Requires a connected account. Read-only.
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: create_event_draft
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "cover_image_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_event_draft
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
until the user opens the claim link and confirms. For a user connected via 'ConnectRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: update_event_draft
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "cover_image_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_event
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "cover_image_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: set_event_image
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "image_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: refine_event_cover
A tool description tries to alter the model’s use of another tool.
y have a cover (generate_event_cover first). Counts against the monthly AI-image limRecommendationDescriptions must describe only their own tool.
tool: add_ticket_tier
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: update_ticket_tier
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: list_guest_requests
A tool description tries to alter the model’s use of another tool.
list. Pair with approve_guest_request / deny_guest_request. Requires event_id; you muRecommendationDescriptions must describe only their own tool.
tool: approve_guest_request
A tool description tries to alter the model’s use of another tool.
t_class_id from list_guest_requests. Requires event_id + those ids; you must be a hRecommendationDescriptions must describe only their own tool.
tool: deny_guest_request
A tool description tries to alter the model’s use of another tool.
request_id from list_guest_requests. Requires event_id + request_id; you must be aRecommendationDescriptions must describe only their own tool.
tool: list_distribution_lists
A tool description tries to alter the model’s use of another tool.
nvite from with send_invitations. Requires a connected account. Read-only.RecommendationDescriptions must describe only their own tool.
tool: create_affiliate_profile
A tool description tries to alter the model’s use of another tool.
amed email; use add_affiliate for a specific person). Set per-tier discount,RecommendationDescriptions must describe only their own tool.
tool: invite_team_member
A tool description tries to alter the model’s use of another tool.
te_staff_role / demote_staff_to_guest. Requires event_id + email + role; you must beRecommendationDescriptions must describe only their own tool.
tool: list_team_invites
A tool description tries to alter the model’s use of another tool.
staff appear in list_event_staff. Requires event_id; you must be a host. Read-onRecommendationDescriptions must describe only their own tool.
tool: cancel_team_invite
A tool description tries to alter the model’s use of another tool.
ted member, use demote_staff_to_guest. Requires event_id + invite_id; you must be a hRecommendationDescriptions must describe only their own tool.
tool: add_vendor
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: add_talent
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "portfolio_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: add_project
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: record_expense
A tool description tries to alter the model’s use of another tool.
t. Editable via update_production_item (entity 'receipts'). Requires event_id + item +RecommendationDescriptions must describe only their own tool.
tool: add_schedule_item
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: add_role
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: add_inventory_item
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: add_meal
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: add_sponsor
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_production_item
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_production_item
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: delete_production_item
A tool description tries to alter the model’s use of another tool.
ly hide it, use update_production_item active:false instead. Requires event_id + entitRecommendationDescriptions must describe only their own tool.
tool: create_form
A tool description tries to alter the model’s use of another tool.
; activate with set_form_active. Requires event_id + name; you must be a host.RecommendationDescriptions must describe only their own tool.
tool: update_form
A tool description tries to alter the model’s use of another tool.
their ids (from list_forms) to keep responses mapped. Requires event_id +RecommendationDescriptions must describe only their own tool.
tool: create_community
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "icon_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_community
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "icon_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: list_join_requests
A tool description tries to alter the model’s use of another tool.
ove/reject with approve_join_request / reject_join_request. Requires community_id; yRecommendationDescriptions must describe only their own tool.
tool: list_pending_community_events
A tool description tries to alter the model’s use of another tool.
); decline with reject_community_event. Requires community_id. Read-only.RecommendationDescriptions must describe only their own tool.
tool: update_space
A tool description tries to alter the model’s use of another tool.
nges go through set_space_status. Admin-only. Requires community_id + space_id.RecommendationDescriptions must describe only their own tool.
tool: submit_event_to_community
A tool description tries to alter the model’s use of another tool.
— find one via find_open_slots). Consents to the community's standing deal terRecommendationDescriptions must describe only their own tool.
tool: propose_deal
A tool description tries to alter the model’s use of another tool.
e confirms with accept_deal. Recording auto-accepts YOUR side of the termsRecommendationDescriptions must describe only their own tool.
tool: grant_member_setup
A tool description tries to alter the model’s use of another tool.
y (partners use propose_deal). Requires community_id + member_uid.RecommendationDescriptions must describe only their own tool.
tool: connect_stripe
A tool description tries to alter the model’s use of another tool.
ding URL. Check get_account_status first. Requires a connected account.RecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: manage_event_series
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: set_event_image
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: cancel_event
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: archive_ticket_tier
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_ticket_tier
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: remove_guest
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: demote_staff_to_guest
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: approve_guest_request
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: deny_guest_request
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: send_invitations
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: cancel_invitation_job
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: add_affiliate
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: bulk_invite_affiliates
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: revoke_affiliate_access
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: remove_affiliate_code
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: remove_codes_from_profile
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_promo_profile
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: invite_team_member
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: cancel_team_invite
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_production_item
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: set_form_active
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: reject_join_request
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: remove_community_member
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: reject_community_event
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: release_booking
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: remove_member_setup
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: archive_partner_profile
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: remove_profile_member
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: connect_stripe
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.