FHI MCP Server Security Audit

1. Tool surface changed

   2026-10-07 14:30 UTC · 3 d ago

   Changed the definition of "mcp_change_evidence" and "package_install_preflight"

   mcp_change_evidencechanged

   description

    ⟨43 unchanged words⟩  live endpoint and retains the prior observation. ($0.01$0.003 USDC on Base)

   2 words differ · removed · added

   package_install_preflightchanged

   description

    ⟨14 unchanged words⟩ name is supplied, and checks OSV advisories. ($0.01$0.003 USDC on Base)

   2 words differ · removed · added
2. Tool surface changed

   2026-10-06 19:30 UTC · 4 d ago

   Changed the definition of "mcp_change_evidence"

   mcp_change_evidencechanged

   title

   MCPRemote SecurityMCP ChangeTool-Rug-Pull Monitor

   6 words differ · removed · added

   description

   Stateful MCPlive securityremote-MCP changemonitor monitor.for tool-rug-pull and tool-poisoning risk. 

3. Tool surface changed

   2026-10-06 13:28 UTC · 4 d ago

   Added "mcp_change_evidence" (6 tools before, 7 now)

   mcp_change_evidenceadded

   MCP Security Change Monitor — Stateful MCP security change monitor. Establishes a live baseline, then detects added or removed tools, changed tool descriptions, risk-score changes, and new high-risk capability signals before an agent reconnects or pays. ($0.01 USDC on Base)

4. TLS

   2026-10-04 10:26 UTC · 6 d ago

   Certificate recorded, valid to 2026-12-28

5. Authorization

   2026-10-04 10:26 UTC · 6 d ago

   Authorization not required

6. Status

   2026-10-03 20:34 UTC · 7 d ago

   Unknown → Live

7. Tool surface

   2026-10-03 20:33 UTC · 7 d ago

   First tool surface recorded: 6 tools (server version 1.4.0)

8. Endpoint

   2026-10-03 20:21 UTC · 7 d ago

   https://polished-truth-c514.fhi-llc-1118.workers.dev/mcp (mcp_streamable_http) — from mcp_registry, with the record

Showing the latest 8 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed