Skills/Glama/b2b-quant-mcp-n8n-suite

b2b-quant-mcp-n8n-suite@2.1.0

CAUTION· not started

Publisher claims: "Standalone Python 3.11 MCP stdio server exposing 31 read-only B2B regulatory compliance, KYB/AML sanctions, GLEIF LEI, US SEC EDGAR, openFDA, NHTSA, CISA KEV, ICANN RDAP, and Brazil fiscal audit tools." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher jesleytassili-glitch · publishing for 7 daysInstalls 0Last detonated 7d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

Code inventory arrives with this version's next honeypot run.
It will ask for
unknown until the next run
Where it talks to
unknown until the next run
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Not enough was observed to say yet. Not started: dependency install failed; the server itself was not observed. This version's code has not been inventoried for credentials and hosts either; both arrive with its next honeypot run (popular servers first). `vet-skills try b2b-quant-mcp-n8n-suite` runs it now and prints the full answer.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-07 and scored it 66/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Credential pass-through configuration; Credential pass-through configuration; Credential pass-through configuration. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 1 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1
0.1sprocessexec /usr/bin/date
0.1sprocessexec /usr/bin/timeout
0.1sprocessexec .venv/bin/b2b-quant-mcp-server
0.1sclaimedno tools/list reply (exit 0)
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

HIGH
Credential pass-through configuration.well-known/apis.json:41 · Credential pass-through configuration — agent relays sensitive credentials"description": "Extracts, filters, and enriches live Brazilian government public tenders (Pregão Eletrônico, Dispensa - Lei 14.133) from the official PNCP API with item-level pricing, ME/EPP flags, anFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configuration.well-known/apis.json:122 · Credential pass-through configuration — agent relays sensitive credentials"description": "Maps Brazilian NCM product catalogs and audits NF-e XML invoices for the 2026 Tax Reform (LC 214/2025 - IBS, CBS, and Imposto Seletivo). Returns cClassTrib, CST, reduction percentages,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/apis.json:122 · Credential pass-through configuration — agent relays sensitive credentials"description": "Maps Brazilian NCM product catalogs and audits NF-e XML invoices for the 2026 Tax Reform (LC 214/2025 - IBS, CBS, and Imposto Seletivo). Returns cClassTrib, CST, reduction percentages,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsrapidapi_zyla_hub_suite/pricing_plans_manifest.json:2229 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"3. Se RAPIDAPI_API_KEY estiver no .env, executar: python rapidapi_zyla_hub_suite/rapidapi_provider_deployer.py --deploy",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsrapidapi_zyla_hub_suite/openapi_syndicator_2026.py:392 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configuration.well-known/apis.json:284 · Credential pass-through configuration — agent relays sensitive credentials"description": "Calculates the mandatory Brazilian ANTT minimum road freight floor (Lei 13.703/2018 - CCD x km + CC) and audits CT-e 4.00 XML invoices in batch to prevent automatic ANTT/SEFAZ fines.\nFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/apis.json:41 · Credential pass-through configuration — agent relays sensitive credentials"description": "Extracts, filters, and enriches live Brazilian government public tenders (Pregão Eletrônico, Dispensa - Lei 14.133) from the official PNCP API with item-level pricing, ME/EPP flags, anFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationapis.json:203 · Credential pass-through configuration — agent relays sensitive credentials"description": "Stateless (100% LGPD compliant) ANS TISS 4.03.00 XML medical billing validator, automatic MD5 hash recalculator, and TUSS 8-digit procedure code auditor to prevent health insurance bilFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationapis.json:365 · Credential pass-through configuration — agent relays sensitive credentials"description": "B2B healthcare lead extractor and enricher for US doctors, dentists, clinics, and hospitals using the official CMS NPPES NPI Registry API v2.1. Extracts NPI-1 and NPI-2 records, practiFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configuration.well-known/apis.json:203 · Credential pass-through configuration — agent relays sensitive credentials"description": "Stateless (100% LGPD compliant) ANS TISS 4.03.00 XML medical billing validator, automatic MD5 hash recalculator, and TUSS 8-digit procedure code auditor to prevent health insurance bilFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/cloudflare_worker_proxy.js:60 · Credential pass-through configuration — agent relays sensitive credentials* Segredos individuais de proxy (`rapidapiProxySecret`) NÃO ficam hardcoded em código-fonte público.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/apis.json:365 · Credential pass-through configuration — agent relays sensitive credentials"description": "B2B healthcare lead extractor and enricher for US doctors, dentists, clinics, and hospitals using the official CMS NPPES NPI Registry API v2.1. Extracts NPI-1 and NPI-2 records, practiFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/cloudflare_worker_proxy.js:275 · Credential pass-through configuration — agent relays sensitive credentials"CRO Security Gate: Rotate all 31 rapidapiProxySecrets in RapidAPI Studio and set RAPIDAPI_SECRETS_ROTATED_20261103=true before production Worker deploy.",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/apis.json:203 · Credential pass-through configuration — agent relays sensitive credentials"description": "Stateless (100% LGPD compliant) ANS TISS 4.03.00 XML medical billing validator, automatic MD5 hash recalculator, and TUSS 8-digit procedure code auditor to prevent health insurance bilFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/cloudflare_worker_proxy.js:71 · Credential pass-through configuration — agent relays sensitive credentials* Digests SHA-256 dos 31 rapidapiProxySecrets historicos revogados apos expurgo do commit 59410428.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/apis.json:284 · Credential pass-through configuration — agent relays sensitive credentials"description": "Calculates the mandatory Brazilian ANTT minimum road freight floor (Lei 13.703/2018 - CCD x km + CC) and audits CT-e 4.00 XML invoices in batch to prevent automatic ANTT/SEFAZ fines.\nFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationapis.json:284 · Credential pass-through configuration — agent relays sensitive credentials"description": "Calculates the mandatory Brazilian ANTT minimum road freight floor (Lei 13.703/2018 - CCD x km + CC) and audits CT-e 4.00 XML invoices in batch to prevent automatic ANTT/SEFAZ fines.\nFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathspricing_plans_manifest.json:2229 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"3. Se RAPIDAPI_API_KEY estiver no .env, executar: python rapidapi_zyla_hub_suite/rapidapi_provider_deployer.py --deploy",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configuration.well-known/apis.json:365 · Credential pass-through configuration — agent relays sensitive credentials"description": "B2B healthcare lead extractor and enricher for US doctors, dentists, clinics, and hospitals using the official CMS NPPES NPI Registry API v2.1. Extracts NPI-1 and NPI-2 records, practiFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationapis.json:122 · Credential pass-through configuration — agent relays sensitive credentials"description": "Maps Brazilian NCM product catalogs and audits NF-e XML invoices for the 2026 Tax Reform (LC 214/2025 - IBS, CBS, and Imposto Seletivo). Returns cClassTrib, CST, reduction percentages,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File type combined with upload actionrapidapi_zyla_hub_suite/openapi_syndicator_2026.py:10 · File type combined with upload action — agent may exfiltrate local data fileso `pricing_plans_manifest.json`, a coleção `postman_public_network_collection.json` e oFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
URL with embedded credentialsrapidapi_zyla_hub_suite/openapi_syndicator_2026.py:422 · URL with embedded credentials — may be phishing or credential leakingremote_url = f"https://x-access-token:{gh_token}@github.com/{GITHUB_OWNER}/{GITHUB_REPO}.git"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Credential pass-through configurationapis.json:41 · Credential pass-through configuration — agent relays sensitive credentials"description": "Extracts, filters, and enriches live Brazilian government public tenders (Pregão Eletrônico, Dispensa - Lei 14.133) from the official PNCP API with item-level pricing, ME/EPP flags, anFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/cloudflare_worker_proxy.js:407 · Credential pass-through configuration — agent relays sensitive credentials"Blocked: historical RapidAPI proxy secret from purged commit 59410428 is permanently revoked. Rotate rapidapiProxySecret in RapidAPI Studio before deploying Worker.",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationspecs_openapi_31/b2b-quant-mcp-server.json:147 · Credential pass-through configuration — agent relays sensitive credentials"ZylaProxySecret": []Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationspecs_openapi_31/healthcare-tiss-xml-validator.json:719 · Credential pass-through configuration — agent relays sensitive credentials"description": "RapidAPI Hub shared proxy secret verified in constant time via hmac.compare_digest."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationspecs_openapi_31/b2b-quant-mcp-server.json:144 · Credential pass-through configuration — agent relays sensitive credentials"RapidAPIProxySecret": []Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/rapidapi_zyla_gateway.py:586 · Credential pass-through configuration — agent relays sensitive credentials"BLOQUEIO CRO: Rotacione os 31 rapidapiProxySecrets no RapidAPI Studio e defina "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/rapidapi_zyla_gateway.py:83 · Credential pass-through configuration — agent relays sensitive credentialssec = str((node.get("security") or {}).get("rapidapiProxySecret") or "").strip()Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/rapidapi_zyla_gateway.py:74 · Credential pass-through configuration — agent relays sensitive credentialsCarrega os 31 `rapidapiProxySecret`s individuais atribuídos pelo RapidAPI StudioFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationspecs_openapi_31/healthcare-tiss-xml-validator.json:715 · Credential pass-through configuration — agent relays sensitive credentials"RapidAPIProxySecret": {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/rapidapi_zyla_gateway.py:93 · Credential pass-through configuration — agent relays sensitive credentials# Digests SHA-256 dos 31 rapidapiProxySecrets historicos expostos no commit expurgado 59410428.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationspecs_openapi_31/us-fda-recalls-safety-monitor.json:6 · Credential pass-through configuration — agent relays sensitive credentials"description": "Monitors and enriches official U.S. FDA enforcement recall reports across Food, Drugs, and Medical Devices via openFDA. Calculates hazard severity scores (0-100) and generates MarkdownFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationspecs_openapi_31/b2b-quant-mcp-server.json:773 · Credential pass-through configuration — agent relays sensitive credentials"RapidAPIProxySecret": {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationrapidapi_zyla_hub_suite/rapidapi_zyla_gateway.py:201 · Credential pass-through configuration — agent relays sensitive credentialsos 31 `rapidapiProxySecret`s individuais do RapidAPI Studio) ou `X-Zyla-Proxy-Secret`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationspecs_openapi_31/healthcare-tiss-xml-validator.json:6 · Credential pass-through configuration — agent relays sensitive credentials"description": "Stateless (100% LGPD compliant) ANS TISS 4.03.00 XML medical billing validator, automatic MD5 hash recalculator, and TUSS 8-digit procedure code auditor to prevent health insurance bilFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationspecs_openapi_31/b2b-quant-mcp-server.json:6 · Credential pass-through configuration — agent relays sensitive credentials"description": "Official Master Model Context Protocol (MCP) Server & Tool Router for all 30 B2B Regulatory, KYB, Sanctions AML, SEC EDGAR, SAM.gov, EU TED, UK FCA, Brazil BCB/PIX/Tax, Healthcare & SeFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationspecs_openapi_31/healthcare-tiss-xml-validator.json:147 · Credential pass-through configuration — agent relays sensitive credentials"ZylaProxySecret": []Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationspecs_openapi_31/healthcare-tiss-xml-validator.json:144 · Credential pass-through configuration — agent relays sensitive credentials"RapidAPIProxySecret": []Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationspecs_openapi_31/b2b-quant-mcp-server.json:777 · Credential pass-through configuration — agent relays sensitive credentials"description": "RapidAPI Hub shared proxy secret verified in constant time via hmac.compare_digest."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
MCP server using network transport (SSE/HTTP)specs_openapi_31/b2b-quant-mcp-server.json:176 · MCP server using network transport (SSE/HTTP) — data sent over network"source": "import httpx\n\n# Primary Synchronous Endpoint (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/b2b-quant-mcp-server)\nurl = \"https://b2b-quant-mcp-server.p.Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actionrapidapi_zyla_hub_suite/openapi_syndicator_2026.py:192 · File type combined with upload action — agent may exfiltrate local data files# 3. Copia pricing_plans_manifest.json e postman_public_network_collection.jsonFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionpricing_plans_manifest.json:2230 · File type combined with upload action — agent may exfiltrate local data files"4. Ou importar em 1 clique por URL (https://jesleytassili-glitch.github.io/specs_openapi_31/<slug>.json) no RapidAPI Studio, Zyla Hub e Postman apontando payout para Wise #890361113"Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionrapidapi_zyla_hub_suite/openapi_syndicator_2026.py:305 · File type combined with upload action — agent may exfiltrate local data files"apis.json": APIS_JSON_OUTPUT_PATH.read_text(encoding="utf-8"),Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedrapidapi_zyla_hub_suite/openapi_syndicator_2026.py:425 · Python subprocess execution detectedstatus = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Credential pass-through configurationspecs_openapi_31/us-fda-recalls-safety-monitor.json:689 · Credential pass-through configuration — agent relays sensitive credentials"RapidAPIProxySecret": {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
MCP server using network transport (SSE/HTTP)specs_openapi_31/b2b-quant-mcp-server.json:67 · MCP server using network transport (SSE/HTTP) — data sent over network"Node.js": "// Primary Synchronous Endpoint (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/b2b-quant-mcp-server)\nconst url = \"https://b2b-quant-mcp-server.p.rapidapiFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)mcp_server.py:8 · MCP server using network transport (SSE/HTTP) — data sent over networkTOOLS = json.loads('[{"name": "b2b_gov_procurement_pncp_radar", "actor_slug": "b2b-quant-apis/b2b-gov-procurement-pncp-radar", "description": "Extracts, filters, and enriches live Brazilian governmentFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)specs_openapi_31/b2b-quant-mcp-server.json:66 · MCP server using network transport (SSE/HTTP) — data sent over network"Python": "import httpx\n\n# Primary Synchronous Endpoint (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/b2b-quant-mcp-server)\nurl = \"https://b2b-quant-mcp-server.p.Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Credential pass-through configurationspecs_openapi_31/us-fda-recalls-safety-monitor.json:147 · Credential pass-through configuration — agent relays sensitive credentials"ZylaProxySecret": []Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File type combined with upload actionrapidapi_zyla_hub_suite/openapi_syndicator_2026.py:289 · File type combined with upload action — agent may exfiltrate local data files`pricing_plans_manifest.json`, `postman_public_network_collection.json` e `index.html` no repositórioFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionrapidapi_zyla_hub_suite/openapi_syndicator_2026.py:269 · File type combined with upload action — agent may exfiltrate local data files"<a href='/postman_public_network_collection.json'>Postman v2.1 Collection (31 APIs)</a> | "Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionrapidapi_zyla_hub_suite/pricing_plans_manifest.json:2230 · File type combined with upload action — agent may exfiltrate local data files"4. Ou importar em 1 clique por URL (https://jesleytassili-glitch.github.io/specs_openapi_31/<slug>.json) no RapidAPI Studio, Zyla Hub e Postman apontando payout para Wise #890361113"Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Credential pass-through configurationspecs_openapi_31/us-fda-recalls-safety-monitor.json:693 · Credential pass-through configuration — agent relays sensitive credentials"description": "RapidAPI Hub shared proxy secret verified in constant time via hmac.compare_digest."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Python subprocess execution detectedtests/test_mcp_server.py:35 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrapidapi_zyla_hub_suite/openapi_syndicator_2026.py:445 · Python subprocess execution detectedsubprocess.run(["git", "push", remote_url, "HEAD:main", "--force"], cwd=str(repo_dir), check=True, env=git_env)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrapidapi_zyla_hub_suite/openapi_syndicator_2026.py:424 · Python subprocess execution detectedsubprocess.run(["git", "add", "-A"], cwd=str(repo_dir), check=True, env=git_env)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Credential pass-through configurationspecs_openapi_31/us-fda-recalls-safety-monitor.json:144 · Credential pass-through configuration — agent relays sensitive credentials"RapidAPIProxySecret": []Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
MCP server using network transport (SSE/HTTP)specs_openapi_31/b2b-quant-mcp-server.json:65 · MCP server using network transport (SSE/HTTP) — data sent over network"cURL": "# Primary Synchronous Endpoint: https://b2b-quant-mcp-server.p.rapidapi.com/v2/acts/b2b-quant-apis~b2b-quant-mcp-server/run-sync-get-dataset-items (Gateway Route: https://b2b-quant-rapidapi-gFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)postman_public_network_collection.json:4407 · MCP server using network transport (SSE/HTTP) — data sent over network"description": "Synchronous execution of `b2b-quant-mcp-server` on Apify Cloud (`https://api.apify.com/v2/acts/b2b-quant-apis~b2b-quant-mcp-server/run-sync-get-dataset-items`)."Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)postman_public_network_collection.json:4473 · MCP server using network transport (SSE/HTTP) — data sent over network"description": "Synchronous execution of `b2b-quant-mcp-server` via Stateless Gateway (OpenAPI 3.0.3: https://jesleytassili-glitch.github.io/specs_openapi_31/b2b-quant-mcp-server.json)."Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedrapidapi_zyla_hub_suite/openapi_syndicator_2026.py:446 · Python subprocess execution detectedrev = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrapidapi_zyla_hub_suite/openapi_syndicator_2026.py:434 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)specs_openapi_31/b2b-quant-mcp-server.json:171 · MCP server using network transport (SSE/HTTP) — data sent over network"source": "# Primary Synchronous Endpoint: https://b2b-quant-mcp-server.p.rapidapi.com/v2/acts/b2b-quant-apis~b2b-quant-mcp-server/run-sync-get-dataset-items (Gateway Route: https://b2b-quant-rapidapiFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04

Cost to the agent

Instructions loaded
≈3,990 tok
1 file · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

14 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim jesleytassili-glitch: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim jesleytassili-glitchPropose a patch to the maintainer