LeashIndex Get the report

Index / calendar

FactLot

io-github-9mp96ygnbk-alt-factlot declares 59 capabilities across 59 tools, with 1 critical issue. One of them, no-revocation, is recorded for every server in the index because MCP has no field in which to declare a way to switch a tool off; a missing declaration is not evidence that the control is missing.

68/100 exposureElevated

Manifest recorded 2026-11-08 from tools/list on https://api.factlot.com/mcp, published in the official MCP registry as io.github.9mp96ygnbk-alt/factlot 0.5.0. The date changes only when the manifest does. Not verified by a maintainer.

Issues

These describe what this server's manifest declares. A product can provide controls that MCP has no way to express — token revocation, an admin console, audit logs — and this page cannot see them. The absence of a declaration is not evidence that a control is absent.

critical · no-revocation · All 59 tools

59 of 59 tools declare no way for the customer to switch them off once granted. This applies to every tool because MCP has no field in which to declare a revocation mechanism; the product may provide one outside MCP that a manifest cannot show.

high · no-expiry · All 59 tools

59 of 59 tools declare no expiry. This applies to every tool because MCP has no field in which to declare an expiry; the product may provide one outside MCP that a manifest cannot show.

high · no-audit-trail · All 59 tools

59 of 59 tools declare no record of their actions that the customer can read. This applies to every tool because MCP has no field in which to declare an audit requirement; the product may provide one outside MCP that a manifest cannot show.

high · uncapped-write · 1 of 59 tools

1 tool can modify data and declares no limit.

low · uncapped-read · 58 of 59 tools

58 tools can read data and declare no limit.

Declared capabilities

How each tool was read. declared means the server's own annotation said so — self-reported and unverified. inferred is from the tool's name. assumed means nothing indicated either way.

ToolRead asBasis
calc_rent_scheduleread declared
calc_net_effective_rentread declared
calc_compare_proposalsread declared
calc_multifamily_rent_rollread declared
calc_percentage_rentread declared
calc_cam_reconciliationread declared
calc_cam_reconciliation_batchread declared
calc_capex_recoveryread declared
calc_debt_sizingread declared
calc_lease_remeasurement_asc842read declared
calc_prepayment_and_defeasanceread declared
calc_waltread declared
calc_npvread declared
calc_irrread declared
calc_lease_vs_ownread declared
calc_renew_vs_relocateread declared
calc_hotel_metricsread declared
calc_dcf_pro_formaread declared
calc_direct_capread declared
calc_amortization_scheduleread declared
calc_equity_waterfallread declared
calc_exchange_1031read declared
calc_critical_datesread declared
calc_reconcile_dcfread declared
calc_reconcile_camread declared
calc_tx_unequal_appraisalread declared
rules_tx_property_tax_protest_deadlineread declared
rules_tx_property_tax_protest_deadline_batchread declared
id_parcelread declared
id_entityread declared
id_spaceread declared
id_buildingread declared
id_documentread declared
id_parseread declared
fact_validateread declared
doc_verify_factsread declared
doc_abstract_leaseread declared
doc_compareread declared
doc_verify_claimread declared
doc_spread_statementread declared
doc_check_use_conflictread declared
doc_predicatesread declared
fact_package_createread declared
fact_package_verifyread declared
lease_comp_validateread declared
lease_comp_searchread declared
registry_getread declared
registry_resolve_parcelread declared
registry_resolve_externalread declared
registry_search_addressread declared
registry_search_entitiesread declared
registry_owned_byread declared
registry_coverageread declared
registry_tx_equity_candidatesread declared
registry_tx_equity_candidates_batchread declared
searchread declared
fetchread declared
schema_getread declared
report_createwrite inferred
Answering this question about your own agent? The self-serve stack report applies the same reading to your own stack or server and gives you a dated document you can hand to a customer's security review. It is generated in your browser, with nobody to wait for. Buying one does not change this page, its score or its place in the index — see Independence.
Maintain this server? If this page misreads your manifest, or your server has changed, submit its current tools/list response and it will be re-scored and dated. Corrections are published alongside the original, not in place of it.