Mailchimp — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.13.0",
"methodologyVersion": "mcptrustchecker-1.13"
},
"target": {
"id": "@alien-lifestyles/mailchimp-mcp",
"source": {
"kind": "package",
"origin": "@alien-lifestyles/mailchimp-mcp"
},
"server": {
"name": "@alien-lifestyles/mailchimp-mcp"
}
},
"grade": "A",
"score": {
"score": 93,
"threatScore": 100,
"grade": "A",
"band": "A",
"categorySubtotals": {
"injection": 0,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "client",
"term": "capability-exposure",
"level": "high",
"label": "capability blast radius (high) — client exposure if the model is manipulated",
"appliedPenalty": 6
},
{
"kind": "client",
"term": "verification-discount",
"level": "repo",
"label": "publisher verification (public source) — no provenance, but the source is public and inspectable",
"appliedPenalty": 1
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.13"
},
"capability": {
"level": "high",
"reasons": [
"can send data / act on an external service",
"reads sensitive or local data",
"has a read → egress path (a data-exfiltration surface)",
"can execute shell commands or code"
],
"tags": [
"sensitive-source",
"external-sink",
"code-exec"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (166 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-FLOW-004",
"title": "Sensitive-source and external-sink co-exist",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "Tools that read sensitive data ([mc_listFiles]) and tools that can send data out ([mc_getWebhook, mc_uploadFile, mc_createWebhook, mc_updateWebhook, mc_deleteWebhook]) are exposed together. An agent can move private data to the sink.",
"remediation": "Keep secret-reading and egress capabilities on separate, separately-approved servers.",
"location": {
"kind": "flow",
"name": "mc_listFiles → mc_getWebhook"
},
"evidence": "sources [mc_listFiles] → sinks [mc_getWebhook, mc_uploadFile, mc_createWebhook, mc_updateWebhook, mc_deleteWebhook]",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"references": [],
"data": {
"sources": [
"mc_listFiles"
],
"sinks": [
"mc_getWebhook",
"mc_uploadFile",
"mc_createWebhook",
"mc_updateWebhook",
"mc_deleteWebhook"
]
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/index.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/index.js:1954`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/index.js"
},
"evidence": "spawn } = await import(\"child_process\"); const { platform: platform2 } = await import(\"os\"); const { existsS",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/index.js",
"line": 1954,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/setup/server.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/setup/server.js:82`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/setup/server.js"
},
"evidence": "execSync } = __require(\"child_process\"); try { const listOutput = execSync(\"npm list -g @alien-lifestyles/mail",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/setup/server.js",
"line": 82,
"nonRuntime": false
}
},
{
"ruleId": "MTC-CAP-007",
"title": "Unconstrained URL/host parameter \"url\" on \"mc_createWebhook\"",
"category": "network",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"mc_createWebhook\" takes a URL/host parameter \"url\" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).",
"remediation": "Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.",
"location": {
"kind": "tool",
"name": "mc_createWebhook",
"field": "inputSchema.properties.url"
},
"owasp": "LLM06:2025 Excessive Agency",
"data": {
"param": "url"
}
},
{
"ruleId": "MTC-CAP-007",
"title": "Unconstrained URL/host parameter \"url\" on \"mc_updateWebhook\"",
"category": "network",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"mc_updateWebhook\" takes a URL/host parameter \"url\" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).",
"remediation": "Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.",
"location": {
"kind": "tool",
"name": "mc_updateWebhook",
"field": "inputSchema.properties.url"
},
"owasp": "LLM06:2025 Excessive Agency",
"data": {
"param": "url"
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in packaging/dev tooling (scripts/installer.js)",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/installer.js:14`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "scripts/installer.js"
},
"evidence": "execSync, spawn } from 'child_process'; import { existsSync } from 'fs'; import { join } from 'path'; import { fileURLTo",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "scripts/installer.js",
"line": 14,
"nonRuntime": true
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in packaging/dev tooling (scripts/post-install-sync.js)",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/post-install-sync.js:17`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "scripts/post-install-sync.js"
},
"evidence": "import { spawn } from 'child_process'; import { fileURLToPath } from 'url'; import { dirname } from 'path'; const __fi",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "scripts/post-install-sync.js",
"line": 17,
"nonRuntime": true
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in packaging/dev tooling (scripts/setup-cli.js)",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/setup-cli.js:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "scripts/setup-cli.js"
},
"evidence": "import { spawn } from 'child_process'; const __filename = fileURLToPath(import.meta.url); const __dirname = dirname(__",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "scripts/setup-cli.js",
"line": 11,
"nonRuntime": true
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in packaging/dev tooling (scripts/sync-from-web.js)",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/sync-from-web.js:134`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "scripts/sync-from-web.js"
},
"evidence": "spawn } = await import('child_process'); const { promisify } = await import('util'); // For now, implement",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "scripts/sync-from-web.js",
"line": 134,
"nonRuntime": true
}
}
],
"toxicFlows": [
{
"id": "flow-1",
"severity": "high",
"confidence": "strong",
"untrustedInput": [],
"sensitiveSource": [
"mc_listFiles"
],
"externalSink": [
"mc_getWebhook",
"mc_uploadFile",
"mc_createWebhook",
"mc_updateWebhook",
"mc_deleteWebhook"
],
"selfContained": false,
"path": [
"mc_listFiles",
"mc_createWebhook"
],
"pathWired": true,
"description": "A sensitive-source → external-sink chain exists: mc_listFiles ⇒ mc_createWebhook."
}
],
"capabilities": [
{
"tool": "mc_ping",
"tags": [],
"reasons": {}
},
{
"tool": "mc_openConfig",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listAudiences",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getAudience",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listMembers",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getMember",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listMemberNotes",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getMemberActivity",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listMemberEvents",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listCampaigns",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getCampaign",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getCampaignContent",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getCampaignReport",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getAccount",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listSegments",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getSegment",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listSegmentMembers",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listTags",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getTag",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listMergeFields",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getMergeField",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listInterestCategories",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getInterestCategory",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listInterests",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getInterest",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listTemplates",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getTemplate",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listTemplateFolders",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getTemplateFolder",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listAutomations",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getAutomation",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listAutomationEmails",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getAutomationEmail",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listReports",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listBatchOperations",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getBatchOperation",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listConversations",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getConversation",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listConversationMessages",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listAudienceActivity",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listStores",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getStore",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listStoreProducts",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getStoreProduct",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listStoreOrders",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getStoreOrder",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listStoreCustomers",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getStoreCustomer",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listStoreCarts",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getStoreCart",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listFiles",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"list_files\""
]
}
},
{
"tool": "mc_getFile",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listFileFolders",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getFileFolder",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listVerifiedDomains",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getVerifiedDomain",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listLandingPages",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getLandingPage",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listSurveys",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getSurvey",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listSurveyResponses",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getSurveyResponse",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listWebhooks",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getWebhook",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"keyword \"webhook\""
]
}
},
{
"tool": "mc_getCampaignClickDetails",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listCampaignSubscribers",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getListGrowthHistory",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listAbuseReports",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getAbuseReport",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listLocations",
"tags": [],
"reasons": {}
},
{
"tool": "mc_listConnectedSites",
"tags": [],
"reasons": {}
},
{
"tool": "mc_getConnectedSite",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createCampaign",
"tags": [],
"reasons": {}
},
{
"tool": "mc_setCampaignContent",
"tags": [],
"reasons": {}
},
{
"tool": "mc_sendCampaign",
"tags": [],
"reasons": {}
},
{
"tool": "mc_pauseCampaign",
"tags": [],
"reasons": {}
},
{
"tool": "mc_resumeCampaign",
"tags": [],
"reasons": {}
},
{
"tool": "mc_scheduleCampaign",
"tags": [],
"reasons": {}
},
{
"tool": "mc_cancelCampaign",
"tags": [],
"reasons": {}
},
{
"tool": "mc_unscheduleCampaign",
"tags": [],
"reasons": {}
},
{
"tool": "mc_replicateCampaign",
"tags": [],
"reasons": {}
},
{
"tool": "mc_testCampaign",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createTemplate",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateTemplate",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteTemplate",
"tags": [],
"reasons": {}
},
{
"tool": "mc_uploadFile",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"keyword \"upload_file\""
]
}
},
{
"tool": "mc_createTemplateFolder",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createFileFolder",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createAudience",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateAudience",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createSegment",
"tags": [],
"reasons": {}
},
{
"tool": "mc_addTagToMember",
"tags": [],
"reasons": {}
},
{
"tool": "mc_archiveMember",
"tags": [],
"reasons": {}
},
{
"tool": "mc_unsubscribeMember",
"tags": [],
"reasons": {}
},
{
"tool": "mc_removeTagFromMember",
"tags": [],
"reasons": {}
},
{
"tool": "mc_addNoteToMember",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateNote",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteNote",
"tags": [],
"reasons": {}
},
{
"tool": "mc_addMemberEvent",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createMergeField",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateCampaign",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteCampaign",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createMember",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateMember",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteMember",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteAudience",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateSegment",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteSegment",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createTag",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteTag",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateMergeField",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteMergeField",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateInterestCategory",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteInterestCategory",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createInterest",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateInterest",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteInterest",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteFile",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteTemplateFolder",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteFileFolder",
"tags": [],
"reasons": {}
},
{
"tool": "mc_pauseAutomation",
"tags": [],
"reasons": {}
},
{
"tool": "mc_startAutomation",
"tags": [],
"reasons": {}
},
{
"tool": "mc_archiveAutomation",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateAutomationEmail",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteAutomationEmail",
"tags": [],
"reasons": {}
},
{
"tool": "mc_pauseAutomationEmail",
"tags": [],
"reasons": {}
},
{
"tool": "mc_startAutomationEmail",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createVerifiedDomain",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteVerifiedDomain",
"tags": [],
"reasons": {}
},
{
"tool": "mc_sendDomainVerificationEmail",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createStore",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateStore",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createStoreProduct",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateStoreProduct",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteStoreProduct",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createStoreOrder",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateStoreOrder",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteStoreOrder",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createStoreCustomer",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateStoreCustomer",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteStoreCustomer",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createStoreCart",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateStoreCart",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteStoreCart",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createLandingPage",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateLandingPage",
"tags": [],
"reasons": {}
},
{
"tool": "mc_publishLandingPage",
"tags": [],
"reasons": {}
},
{
"tool": "mc_unpublishLandingPage",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteLandingPage",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createSurvey",
"tags": [],
"reasons": {}
},
{
"tool": "mc_updateSurvey",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteSurvey",
"tags": [],
"reasons": {}
},
{
"tool": "mc_createWebhook",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"keyword \"webhook\""
]
}
},
{
"tool": "mc_updateWebhook",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"keyword \"webhook\""
]
}
},
{
"tool": "mc_deleteWebhook",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"keyword \"webhook\""
]
}
},
{
"tool": "mc_createBatchOperation",
"tags": [],
"reasons": {}
},
{
"tool": "mc_deleteStore",
"tags": [],
"reasons": {}
},
{
"tool": "account-health-check",
"tags": [],
"reasons": {}
},
{
"tool": "churn-risk-analysis",
"tags": [],
"reasons": {}
},
{
"tool": "feature-adoption",
"tags": [],
"reasons": {}
},
{
"tool": "marketer-quarterly-performance",
"tags": [],
"reasons": {}
},
{
"tool": "marketer-campaign-benchmarks",
"tags": [],
"reasons": {}
},
{
"tool": "marketer-content-analysis",
"tags": [],
"reasons": {}
},
{
"tool": "monthly-summary",
"tags": [],
"reasons": {}
},
{
"tool": "roi-assessment",
"tags": [],
"reasons": {}
},
{
"tool": "list-health",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "ed0a6aecc928016916223a50b2a11e88bd303d2136b89d224b89ec6b4a4bb8a6",
"stats": {
"tools": 166,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 3,
"medium": 2,
"low": 4,
"info": 0
}
}
}