5pu357jdkqc3qynzkjvu3okgqy0ncsiy.lambda-url.us-east-1.on.aws
https://5pu357jdkqc3qynzkjvu3okgqy0ncsiy.lambda-url.us-east-1.on.aws/mcp
61
trust
0.55
confidence
medium
risk
trust-2026-08-12.2
observed 9h ago
Why this score
| tls_present_and_valid | +12 |
| mcp.unauthenticated_consequential_tools | -8 |
| reachable | +6 |
| mcp_capabilities_discoverable | +4 |
| headers.missing_hsts | -3 |
Findings (3)
| medium | Capabilities are listable without authentication, including 2 whose names suggest state change (billing_purchase, storage_quezar_delete) — inferred from tool names, not confirmed mcp.unauthenticated_consequential_tools @ 1.0.0 |
| low | No Strict-Transport-Security header headers.missing_hsts @ 1.0.0 |
| info | CORS allows any origin cors.wildcard_origin @ 1.0.0 |
Evidence (7)
| Type | Observed | SHA-256 |
|---|---|---|
| dns_resolution_observation | 9h ago | 22af529b23248547… |
| http_response_observation | 9h ago | 23163542927977eb… |
| availability_observation | 9h ago | 8040b6296ff5999b… |
| tls_certificate_observation | 9h ago | d8df3d6d78dd5a26… |
| oauth_metadata_observation | 9h ago | aad377c798cbd948… |
| mcp_protocol_observation | 9h ago | 9a7ecb8fdb1897bc… |
| mcp_capability_observation | 9h ago | 558f8eb1cce93bf2… |
Every record is append-only and content-hashed. Corrections supersede; nothing is overwritten.
Operate this service?
Prove control of 5pu357jdkqc3qynzkjvu3okgqy0ncsiy.lambda-url.us-east-1.on.aws to correct the record and request a rescan after fixing a finding. One DNS record — no account needed.