LeashIndex Get the report

Index / messaging

Lordevo Shop (x402 website checks)

com-lordevo-shop declares 64 capabilities across 64 tools, with 1 critical issue. One of them, no-revocation, is recorded for every server in the index because MCP has no field in which to declare a way to switch a tool off; a missing declaration is not evidence that the control is missing.

71/100 exposureHigh exposure

Manifest recorded 2026-11-08 from tools/list on https://shop.lordevo.com/mcp, published in the official MCP registry as com.lordevo/shop 1.1.1. The date changes only when the manifest does. Not verified by a maintainer.

Issues

These describe what this server's manifest declares. A product can provide controls that MCP has no way to express — token revocation, an admin console, audit logs — and this page cannot see them. The absence of a declaration is not evidence that a control is absent.

critical · no-revocation · All 64 tools

64 of 64 tools declare no way for the customer to switch them off once granted. This applies to every tool because MCP has no field in which to declare a revocation mechanism; the product may provide one outside MCP that a manifest cannot show.

high · no-expiry · All 64 tools

64 of 64 tools declare no expiry. This applies to every tool because MCP has no field in which to declare an expiry; the product may provide one outside MCP that a manifest cannot show.

high · no-audit-trail · All 64 tools

64 of 64 tools declare no record of their actions that the customer can read. This applies to every tool because MCP has no field in which to declare an audit requirement; the product may provide one outside MCP that a manifest cannot show.

high · uncapped-write · 1 of 64 tools

1 tool can modify data and declares no limit.

low · uncapped-read · 63 of 64 tools

63 tools can read data and declare no limit.

Declared capabilities

How each tool was read. declared means the server's own annotation said so — self-reported and unverified. inferred is from the tool's name. assumed means nothing indicated either way.

ToolRead asBasis
try_freeread declared
site_reportread declared
site_report_statusread declared
site_checkread declared
list_servicesread declared
get_sample_outputread declared
preflightread declared
agent_readinessread declared
url_trustread declared
can_fetchread declared
link_checkread declared
dns_lookupread declared
email_validateread declared
ssl_certread declared
domain_rdapread declared
ip_inforead declared
links_batchread declared
broken_linksread declared
sitemap_urlsread declared
link_previewread declared
readabilityread declared
structured_dataread declared
canonical_checkread declared
cors_checkread declared
http_pingread declared
domain_lookalikeread declared
myr_ratesread declared
domain_intelread declared
redirect_chainread declared
text_chunkread declared
token_countread declared
json_validateread declared
json_repairread declared
time_convertread declared
cron_nextread declared
url_cleanread declared
feed_parseread declared
page_diffread declared
pdf_textread declared
math_evalread declared
date_calcread declared
regex_testread declared
text_diffread declared
csv_parseread declared
json_queryread declared
json_schema_inferread declared
unit_convertread declared
text_extractread declared
prompt_injection_scanread declared
federal_registerread declared
sec_filingsread declared
verdict_cardwrite assumed
page_markdownread declared
page_markdown_batchread declared
page_metaread declared
email_authread declared
security_headersread declared
tech_stackread declared
seo_pageread declared
site_snapshotread declared
page_qualityread declared
site_verdictread declared
seo_audit_literead declared
security_scan_literead declared

Record history

Earlier records for this server. A correction is added here, never written over the record it corrects.

RecordedExposureSource
2026-10-2848 tools/list on https://shop.lordevo.com/mcp, published in the official MCP registry as com.lordevo/shop 1.1.1
Answering this question about your own agent? The self-serve stack report applies the same reading to your own stack or server and gives you a dated document you can hand to a customer's security review. It is generated in your browser, with nobody to wait for. Buying one does not change this page, its score or its place in the index — see Independence.
Maintain this server? If this page misreads your manifest, or your server has changed, submit its current tools/list response and it will be re-scored and dated. Corrections are published alongside the original, not in place of it.