Publishes what an AI made — a page, a markdown or PDF doc, or a whole site — to a live HTTPS link.
Risky behavior the analysis could not rule out.
The publish_files tool description is computed at runtime from publishFilesDescription(context.surface) rather than a static string, so the exact metadata cannot be reviewed here; it appears to only choose between local and remote wording.
description: publishFilesDescription(context.surface),
What the analysis could not settle from the code alone.
Candidates the review stage examined and rejected, kept for transparency.
publish_dir reads an arbitrary caller-supplied absolute folder path from local disk and uploads its contents to the remote Drop2Run service, so a prompt-injected or mistaken agent could publish sensitive local directories publicly; this is the tool's declared core capability and no sensitive-path restriction is visible here.
const result = await publishDirectory(credentials, path, site, undefined, {publish_dir is the declared core capability of a publishing MCP server: its description openly says it publishes a folder from disk and returns a URL. It is not concealed, and no instruction to the agent directs it at sensitive paths. The finding itself concedes this is the core capability.