LeashIndex Get the report

Index / data

Damper

com-usedamper-mcp declares 141 capabilities across 141 tools, with 2 critical issues. One of them, no-revocation, is recorded for every server in the index because MCP has no field in which to declare a way to switch a tool off; a missing declaration is not evidence that the control is missing.

100/100 exposureHigh exposure

Manifest recorded 2026-11-08 from tools/list on https://api.usedamper.com/mcp, published in the official MCP registry as com.usedamper/mcp 0.6.0. The date changes only when the manifest does. Not verified by a maintainer.

Issues

These describe what this server's manifest declares. A product can provide controls that MCP has no way to express — token revocation, an admin console, audit logs — and this page cannot see them. The absence of a declaration is not evidence that a control is absent.

critical · no-revocation · All 141 tools

141 of 141 tools declare no way for the customer to switch them off once granted. This applies to every tool because MCP has no field in which to declare a revocation mechanism; the product may provide one outside MCP that a manifest cannot show.

critical · irreversible-uncapped · 20 of 141 tools

20 tools are classified as irreversible or destructive and declare no limit. 19 of them are counted only because the server annotated them destructiveHint. In MCP that annotation marks a tool that may make destructive changes rather than only additive ones; it does not say the change cannot be undone.

high · no-expiry · All 141 tools

141 of 141 tools declare no expiry. This applies to every tool because MCP has no field in which to declare an expiry; the product may provide one outside MCP that a manifest cannot show.

high · no-audit-trail · All 141 tools

141 of 141 tools declare no record of their actions that the customer can read. This applies to every tool because MCP has no field in which to declare an audit requirement; the product may provide one outside MCP that a manifest cannot show.

high · uncapped-write · 62 of 141 tools

62 tools can modify data and declare no limit.

low · uncapped-read · 59 of 141 tools

59 tools can read data and declare no limit.

Declared capabilities

How each tool was read. declared means the server's own annotation said so — self-reported and unverified. inferred is from the tool's name. assumed means nothing indicated either way.

ToolRead asBasis
list_projectsread declared
get_agent_instructionsread declared
list_tasksread declared
get_taskread declared
list_self_assessmentsread declared
update_taskwrite inferred
create_taskwrite inferred
add_notewrite inferred
add_commitwrite inferred
link_prwrite inferred
create_subtaskwrite inferred
update_subtaskwrite inferred
delete_subtaskdestructive declared
delete_taskdestructive declared
add_task_dependencywrite inferred
remove_task_dependencydestructive declared
add_api_examplewrite inferred
add_screenshotwrite inferred
add_diagramwrite inferred
list_review_artifactsread declared
remove_review_artifactdestructive declared
start_taskwrite assumed
review_taskwrite assumed
complete_taskwrite assumed
request_reviewwrite inferred
abandon_taskwrite assumed
list_context_sectionsread declared
resolve_contextread declared
get_context_sectionread declared
update_context_sectionwrite inferred
delete_context_sectiondestructive declared
sync_project_contextwrite inferred
get_project_contextread declared
get_section_blocksread declared
get_section_block_contentread declared
prepare_workread declared
audit_context_healthread declared
get_context_graphread declared
resolve_context_graphread declared
list_context_relationsread declared
upsert_context_relationwrite inferred
delete_context_relationdestructive declared
list_context_routesread declared
upsert_context_routeread inferred
delete_context_routedestructive declared
preview_context_route_migrationread declared
validate_context_routingread declared
compare_context_resolutionread declared
list_context_bundlesread declared
upsert_context_bundlewrite inferred
get_context_bundleread declared
delete_context_bundledestructive declared
list_context_fixturesread declared
upsert_context_fixturewrite inferred
report_context_feedbackwrite assumed
delete_context_fixturedestructive declared
prepare_completionread declared
preview_context_updateread declared
patch_context_sectionwrite inferred
upsert_context_blockwrite assumed
verify_context_sectionread inferred
render_context_routes_markdownread declared
list_context_maintenance_candidatesread declared
refresh_context_maintenance_candidateswrite assumed
convert_context_maintenance_candidatewrite assumed
list_feedbackread declared
get_feedbackread declared
get_feedback_attachmentread declared
update_feedbackwrite inferred
reply_to_feedbackwrite assumed
report_issuewrite assumed
link_feedback_to_taskwrite assumed
list_pagesread declared
search_pagesread declared
get_pageread declared
create_pagewrite inferred
update_pagewrite inferred
move_pagewrite inferred
duplicate_pagewrite assumed
archive_pagedestructive declared
get_page_databaseread declared
get_page_database_schemaread declared
query_page_databaseread declared
upsert_database_rowwrite inferred
create_task_from_pagewrite inferred
create_database_propertywrite inferred
update_database_propertywrite inferred
update_database_row_valueswrite inferred
update_database_viewread inferred
create_database_viewread inferred
delete_database_viewdestructive declared
create_database_templatewrite inferred
get_page_backlinksread declared
list_templatesread declared
get_templateread declared
update_templatewrite inferred
sync_templateswrite inferred
list_modulesread declared
get_moduleread declared
update_modulewrite inferred
sync_modulesdestructive declared
delete_moduledestructive declared
list_changelogsread declared
create_changelogwrite inferred
update_changelogwrite inferred
add_to_changelogwrite inferred
publish_changelogsend inferred
delete_changelogdestructive declared
get_completion_checklistread declared
patch_completion_checklistwrite inferred
preview_completion_checklist_migrationread declared
get_project_settingsread declared
update_project_settingswrite inferred
open_public_pageread declared
list_status_maintenance_targetsread declared
list_status_maintenanceread declared
create_status_maintenancewrite inferred
update_status_maintenancewrite inferred
delete_status_maintenancedestructive declared
add_status_maintenance_updatewrite inferred
edit_status_maintenance_updatewrite inferred
get_status_summaryread declared
get_status_historyread declared
list_status_groupsread declared
create_status_groupwrite inferred
update_status_groupwrite inferred
delete_status_groupdestructive declared
list_status_checksread declared
create_status_checkwrite inferred
update_status_checkwrite inferred
delete_status_checkdestructive declared
run_status_checkwrite assumed
list_status_incidentsread declared
create_status_incidentwrite inferred
update_status_incidentwrite inferred
delete_status_incidentdestructive declared
add_status_incident_updatewrite inferred
list_status_alert_recipientsread declared
create_status_alert_recipientwrite inferred
update_status_alert_recipientwrite inferred
delete_status_alert_recipientdestructive declared
Answering this question about your own agent? The self-serve stack report applies the same reading to your own stack or server and gives you a dated document you can hand to a customer's security review. It is generated in your browser, with nobody to wait for. Buying one does not change this page, its score or its place in the index — see Independence.
Maintain this server? If this page misreads your manifest, or your server has changed, submit its current tools/list response and it will be re-scored and dated. Corrections are published alongside the original, not in place of it.