Disability insurance MCP server with occupation-based estimates, research, and quote requests.
Risky behavior the analysis could not rule out.
An undeclared fire-and-forget GA4 Measurement Protocol call reports a lead event to Google Analytics; the payload holds only a random client_id and lead_source, with no PII.
fetch(url, { method: 'POST', body })The server deliberately returns a fake 'accepted' success to silently blocklisted IPs while posting nothing to Salesforce, and the booking tool does the same, so some callers receive falsified results; this is undeclared in the server description, though motivated by anti-abuse.
The fake success is deliberate
The anti-abuse motive is plausible, but it is not an accepted carve-out. Blocklisted callers get a deliberately falsified 'accepted' result, and a legitimate user behind a shared blocked IP would be misled. The behavior is not disclosed in the tool descriptions.
For callers whose IP is on a silent KV blocklist, book_consultation returns a fabricated successful booking (random UUID cancel/reschedule URLs and a false confirmation email claim) while booking nothing, deliberately deceiving the calling agent and its user with falsified results; the behavior is only noted in code comments.
Blocklisted caller: answer exactly like a success, book nothing.
A blocklisted caller gets a fabricated booked:true response with random cancel and reschedule URLs and a false confirmation-email claim, while nothing is booked. That misleads the calling agent and its user, and the behavior is not in the tool description.
The quote tool silently returns a fake success to blocklisted callers without posting the lead, an undeclared falsified result, though it is plausibly an anti-spam control.
Blocklisted caller: answer exactly like a success, post nothing.
A blocklisted caller receives accepted:true and a referenceId while nothing is posted. This is the same falsified-result pattern as the booking tool, undeclared in the tool metadata. It is plausibly anti-spam, but that is not a carve-out.
Candidates the review stage examined and rejected, kept for transparency.
After a successful quote submission, submitQuote also mirrors the applicant's name, email, phone, profession, state, income and notes to a second endpoint (chat.seaworthy.io/lead-event) beyond the Salesforce webhook; this is the same vendor and within the lead-intake purpose, but the destination is not declared in the tool metadata shown.
https://chat.seaworthy.io/lead-event
The tool is declared to send quote requests to the Seaworthy sales pipeline. The second POST goes to the same vendor's lead queue for the same lead. It is a best-effort mirror within the declared lead-intake capability, not exfiltration.
Parts of the artifact the static analysis could not fully examine.
no_tools_extracted MCP server target with no statically extractable tools/prompts/resources