Every change Wellknown observed on this MCP server, newest first, with what it was before and what it became. Tool-surface changes carry the definition diff. Nothing here is edited after the fact.
Certificate changed, valid to 2027-01-04
Changed the definition of "claim_mcp_server", "deep_scan_app" and "my_server_report"
⟨117 unchanged words⟩ is in place, call again to confirm. The first verification returns an owner secret, shown once: keep it, because later changes to an already verified server (note, alerts) need it as owner_secret. If it is lost, call with recover true, put the one-time code on the host, then call with recover_check. Verifying does not change how the server is ⟨5 unchanged words⟩
⟨94 unchanged words⟩ "maxLength":280,"type":"string"},"owner_secret":{"description":"The owner secret returned once at the first verification. Needed to change an already verified server.","maxLength":80,"type":"string"},"recover":{"description":"Lost the owner secret: true returns a one-time code to put on the host, and a check value","type":"boolean"},"recover_check":{"description":"The check value from the recover step, once its code is on the host","maxLength":700,"type":"string"},"server":{"description":"The MCP server address ⟨17 unchanged words⟩
⟨148 unchanged words⟩ value. Because it probes an app directly,iteach scan runs only after ownership is proven now: call it once to receiveanainertone-timeverificationcodetokenand a check id, addthatthetokencode to the app (a meta tag on the home page, or a/7it-verify.txtlinefilein /7it-verify.txt), then call again with the check id and the scan runs.
⟨26 unchanged words⟩ key returned to the verified owner by claim_mcp_server (the newest one; each verification issues a new key)","maxLength":64,"type":"string"} ⟨28 unchanged words⟩
Changed the definition of "find_tool" and "route"
⟨102 unchanged words⟩ change","any"],"type":"string"},"payment":{"description":"Payment terms: any (default); free_only = only servers that declare no payment; paid_ok = servers that charge are fine, servers whose payment terms are unknown are left out. Paid servers show their declared price per call.","enum":["any","free_only","paid_ok"],"type":"string"}},"required":["job"],"type":"object"}
⟨258 unchanged words⟩ ,"high_risk"],"type":"string"},"payment":{"description":"Payment terms: any (default); free_only = only servers that declare no payment; paid_ok = servers that charge are fine, servers whose payment terms are unknown are left out. Paid servers show their declared price per call.","enum":["any","free_only","paid_ok"],"type":"string"},"task":{"description":"What you need to
Certificate recorded, valid to 2026-11-02
Authorization not required
Changed the definition of "deep_scan_app"
⟨14 unchanged words⟩ an app they control for exposed files andopenleakeddatabasessecret keys before launch. A deeper security scan than check_app_security, ⟨34 unchanged words⟩ , or a published source map. It alsofindsreads theSupabaseapp'sorownFirebasepublicbackendcode (theapp
Unknown → Live
First tool surface recorded: 34 tools (server version 1.2.0)
https://7it.co.il/mcp/pro (mcp_streamable_http) — from ard_catalog, with the record
Showing the latest 9 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed
{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"check":{"description":"The check id the first call returned, after the one-time code is on the app","maxLength":500,"type":"string"},"url":{"description":"The app’s public web ⟨7 unchanged words⟩ You must be able to add a verificationtokencode to this app.","maxLength":300,"minLength ⟨7 unchanged words⟩
⟨27 unchanged words⟩ properties":{},"type":"object"},"check":{"description":"The check id to pass on the next call, once the code is on the app","type":"string"},"clean":{"description":"True when no exposed file was found","type":"boolean"},"code":{"description":"One-time verification code to place on the app (30 minutes)","type":"string"},"findings":{"description":"Exposed paths, plus ⟨67 unchanged words⟩ when ownership is not proven yet; add thetokencode and call again with the check id","type":"boolean"},"report_url":{"type":"string"},"token":{"description":"InertTheverificationsite's ownership tokento(forplacetheon7ITtheGuardappwatch; it no longer unlocks a scan by itself)","type":"string"},"verified":{ ⟨4 unchanged words⟩
⟨5 unchanged words⟩ backend":{"additionalProperties":{},"description":"What wasThefoundSupabasebehindproject theapp:publicsupabase/firebasecodepresencenames, and how manytablessecretankeysanonymousitvisitorcarriescould(thereaddatabase is never contacted)","properties":{},"type":"object" ⟨11 unchanged words⟩ findings":{"description":"Exposed paths, plusopensecretbackendkeystables/bucketsinwiththeapublicrowcodecount;by kind; file contents and key values are neverread orreturned","items":{"additionalProperties":{}, ⟨83 unchanged words⟩