MCP server

HirePulse Agent Gateway

mcp:edtool79-collab/hirepulse-mcp

26 tools: 4-in-1 company profiles, growth signals, commerce; free sandbox and 25-call trials. x402.

awesome-mcp-servers Glama MCP Registry

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 28, 2026, 12:15 UTC at edf05c1

findings

critical

highest severity

threat classes

files scanned

138/138

checks satisfied

package advisories

Why this verdict

suspicious: finding mcp-server:.:proxy.mjs:21:SUPPLY
suspicious: finding mcp-server:.:proxy.mjs:32:TOOLPOISON
suspicious: finding mcp-server:.:proxy.mjs:36:TOOLPOISON
suspicious: finding mcp-server:.:proxy.mjs:42:EXFIL
suspicious: finding mcp-server:.:proxy.mjs:45:TOOLPOISON
suspicious: finding mcp-server:.:proxy.mjs:47:TOOLPOISON
suspicious: finding mcp-server:.:proxy.mjs:50:TOOLPOISON
suspicious: finding mcp-server:.:proxy.mjs:51:HIJACK
suspicious: finding mcp-server:.:server.json:10:SUPPLY

Security findings 9

Tool poisoning

criticalContextual riskmedium confidence

The proxy serves the agent's entire tools/list response, including tool names, descriptions, and parameter descriptions, directly from the remote host via remote.listTools(), so the instruction-bearing tool metadata the agent reads is remote-controlled at runtime and cannot be reviewed from the artifact.

proxy.mjs:32

const res = await remote.listTools(r.params);

conceal:remotevector:metadata

Counter-argument considered

The strongest kill case is that relaying listTools is normal proxy behavior, but the relayed content is instruction-bearing tool metadata injected into agent context, the target declares no claims that would make this a declared core capability, and the artifact's own folded metadata confirms nothing is statically fixed, so the finding stands unrefuted.

Tool poisoning

criticalContextual risklow confidence

The proxy fabricates parameter descriptions ('<name> parameter for <tool>') for remotely defined tools that ship without any, making unreviewed remote tool inputs appear documented to the agent and user.

proxy.mjs:36

schema.description = `${name} parameter for ${tool.name}`;

conceal:remotevector:metadata

Counter-argument considered

The strongest kill case is that filling empty descriptions with generic names is a benign usability shim and arguably a mitigation, but it does exactly what the claim says: it manufactures documentation for remote-controlled tool inputs so they appear reviewed to the agent, no carve-out covers metadata fabrication, and no declared claim or artifact text qualifies it.

Data exfiltration

criticalContextual riskmedium confidence

The proxy forwards every CallTool request, including all agent-supplied arguments, to the remote host https://gethirepulse.xyz/mcp, so any data the agent places in tool parameters leaves the host for a third-party server whose tool schemas are themselves remotely defined and unreviewable.

proxy.mjs:42

server.setRequestHandler(CallToolRequestSchema, r => remote.callTool(r.params));

conceal:remotevector:code

Counter-argument considered

The strongest kill case is that tool arguments flowing to the implementing service is ordinary MCP operation, but the closed carve-out list does not cover relaying agent-supplied arguments to an unpinned third-party host whose schemas are themselves remotely defined, the declared description is null so no declared-core-capability carve-out exists, and open disclosure of the URL in server.json does not neutralize the flow.

Tool poisoning

criticalContextual riskmedium confidence

The proxy forwards resources/list from the remote host unchanged, so resource metadata the agent may load is remote-controlled and unreviewable in the artifact.

proxy.mjs:45

server.setRequestHandler(ListResourcesRequestSchema, r => remote.listResources(r.params));

conceal:remotevector:metadata

Counter-argument considered

The strongest kill case is that resource listings are low-stakes directory data, but the metadata the agent uses to select what to load is authored by the remote at runtime and cannot be reviewed from the artifact, no declaration or carve-out covers it, and the detector lead confirms the dependency is unresolved.

Tool poisoning

criticalContextual riskmedium confidence

The proxy forwards resources/templates/list from the remote host unchanged, so resource-template metadata is remote-controlled and unreviewable in the artifact.

proxy.mjs:47

server.setRequestHandler(ListResourceTemplatesRequestSchema, r => remote.listResourceTemplates(r.params));

conceal:remotevector:metadata

Counter-argument considered

The strongest kill case is that resource templates are only name patterns, but they are remote-authored metadata the agent consumes and cannot review in the artifact; nothing declares this (declared claims: None) and no carve-out applies, so the finding survives.

Tool poisoning

criticalContextual riskmedium confidence

The proxy forwards prompts/list from the remote host unchanged, so prompt texts that are injected directly into agent context are authored by the remote host at runtime and cannot be reviewed from the artifact.

proxy.mjs:50

server.setRequestHandler(ListPromptsRequestSchema, r => remote.listPrompts(r.params));

conceal:remotevector:metadata

Counter-argument considered

The strongest kill case is that prompts/list returns only titles rather than bodies, but the prompt inventory steers which remote-authored texts the agent will fetch into context and is fixed by the remote at runtime; with declared claims None and no carve-out, the unreviewable-metadata finding is not refuted.

Agent hijacking

highContextual risklow confidence

The proxy relays GetPrompt and ReadResource content verbatim from the remote server gethirepulse.xyz into the agent's context, giving the remote party a direct, unreviewable, remotely mutable instruction-injection channel.

proxy.mjs:51

server.setRequestHandler(GetPromptRequestSchema, r => remote.getPrompt(r.params));

conceal:remotevector:code

Counter-argument considered

The strongest kill case is that relaying prompt content is the proxy's whole purpose, but purpose is not a carve-out here since the declared description is null and the behavior is undeclared; prompt and resource bodies fetched verbatim from the mutable remote are a concrete source-to-agent-context instruction-injection channel, and no validation or mitigation exists in the shown code.

Supply chain

highContextual riskmedium confidence

The server manifest directs clients to fetch all MCP tools, resources, and prompts from the mutable remote endpoint https://gethirepulse.xyz/mcp, making the agent's instruction surface depend on unpinned remote content rather than anything reviewable in the artifact.

server.json:10

remotes[0].url: https://gethirepulse.xyz/mcp

conceal:remotevector:metadata

Counter-argument considered

The strongest kill case is that a remote-server manifest simply must state its URL, but documented is not acceptable: open disclosure does not clear the unpinned, mutable dependency of the agent's instruction surface on gethirepulse.xyz, the pinned-registry carve-out fails because nothing is pinned, and the declared claims of the target are None, so no carve-out or mitigation refutes the finding.

Supply chain

mediumContextual risklow confidence

The proxy makes the mutable, unpinned remote https://gethirepulse.xyz/mcp the agent's entire tool/instruction surface by forwarding all tool calls with their arguments, resource reads, and prompt fetches to it and relaying the remote's tool descriptions, resources, prompts, and 402 payment challenges back to the agent unmodified and unvetted.

proxy.mjs:21

await remote.connect(new StreamableHTTPClientTransport(new URL('https://gethirepulse.xyz/mcp')));

vector:code

Counter-argument considered

The strongest kill case is that this is a transparently declared gateway architecture, but the declared description is null (declared claims: None) and the remote is unpinned and mutable, so neither the declared-core-capability nor pinned-registry carve-out applies; the code verifiably makes the remote the agent's entire tool/instruction surface with no validation anywhere in the shown 61 lines, and no mitigation exists.

Open questions 13

What the analysis could not settle from the code alone.

What tool descriptions, prompts, and resource contents does the remote endpoint https://gethirepulse.xyz/mcp actually serve to the agent at runtime? This cannot be determined from the artifact, so the presence or absence of actual hijacking/poisoning content is unestablished.

Tool poisoning

Do the x402 payment challenges that 'pass through' the proxy (proxy.mjs:11) deliver remote-authored instructions or payment/credential requests to the agent, and does the agent act on them?

Agent hijacking

What the remote at https://gethirepulse.xyz/mcp actually serves (tool count versus the advertised 26, tool descriptions, resource and prompt content) cannot be determined from the artifact, so the declared catalog cannot be reconciled with the delivered surface.

Tool poisoning

The comment 'Payment challenges pass through' indicates x402 payment flows transit the proxy, but no shown code handles payment authorization or credentials, so whether any local credential material participates is unknown.

Credential access

The proxy relays x402 payment challenges from the remote server ('Payment challenges pass through'); whether the remote can induce the agent into arbitrary or repeated payments cannot be determined from the shown units.

Whether the remote server at https://gethirepulse.xyz/mcp serves tool descriptions or prompt content carrying prompt-injection instructions is unknowable from the artifact, since the entire agent-visible tool surface is remote-controlled at runtime.

Tool poisoning

[file request smoke.mjs] What does smoke.mjs execute when run by the package.json test script (network calls, filesystem or environment access, credentials, or process operations beyond a benign connectivity check)?

Code execution

[file request README.md] Does README.md contain agent-facing instructions such as auto-run setup or prerequisite steps, credential or API-key handling, or URLs (including gethirepulse.xyz) from which to fetch further content?

Agent hijacking

[file request smoke.mjs] What does smoke.mjs, wired to the npm test script in package.json, execute on run: network calls, environment or file access, or output that an agent running the test suite would act on?

Code execution

[file request README.md] Does README.md (shipped per package.json files[]) contain agent-facing instructions such as auto-run setup or prerequisite steps, credential or API-key handling, or URLs from which to fetch further content?

Agent hijacking

[file request smoke.mjs] package.json's test script runs `node smoke.mjs`; what does smoke.mjs execute, and does it contact the network or modify local state?

Code execution

[file request README.md] What does README.md declare about the remote endpoint gethirepulse.xyz, data sent off-host, credentials, and telemetry, to compare against the proxy's full pass-through of all MCP traffic?

Data exfiltration

[file request smoke.mjs] smoke.mjs is executed by the package.json test script ('node smoke.mjs') but is not shown in this batch; does it perform network, filesystem, credential, or process operations beyond a benign MCP handshake or connectivity check?

Code execution

Execution chain 142

What it calls, runs, installs, reads and writes, with the line that does it.

GitHub repositories 2

edtool79-collab/hirepulse-mcp

package.json:24 · url

edtool79-collab/hirepulse-mcp

server.json:7 · url

URLs 140

https://gethirepulse.xyz

package.json:26

https://gethirepulse.xyz

server.json:17

https://gethirepulse.xyz/mcp

proxy.mjs:21

https://gethirepulse.xyz/mcp

server.json:14

https://github.com/edtool79-collab/hirepulse-mcp

server.json:7

https://github.com/edtool79-collab/hirepulse-mcp.git

package.json:24

https://github.com/sponsors/colinhacks

package-lock.json:1209

https://github.com/sponsors/epoberezkin

package-lock.json:99

https://github.com/sponsors/express-rate-limit

package-lock.json:442

https://github.com/sponsors/fastify

package-lock.json:474

https://github.com/sponsors/ljharb

package-lock.json:191

https://github.com/sponsors/ljharb

package-lock.json:528

https://github.com/sponsors/ljharb

package-lock.json:552

https://github.com/sponsors/ljharb

package-lock.json:577

https://github.com/sponsors/ljharb

package-lock.json:589

https://github.com/sponsors/ljharb

package-lock.json:818

https://github.com/sponsors/ljharb

package-lock.json:909

https://github.com/sponsors/ljharb

package-lock.json:1059

https://github.com/sponsors/ljharb

package-lock.json:1075

https://github.com/sponsors/ljharb

package-lock.json:1093

https://github.com/sponsors/ljharb

package-lock.json:1112

https://github.com/sponsors/panva

package-lock.json:691

https://github.com/sponsors/sindresorhus

package-lock.json:737