Is Agent Guild MCP server safe?

Findings (2)

• highWrite-action tools reachable without authenticationauth.open-write
• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool guild_paid_operations: …FREE. Returns every paid operation with its CURRENT price, exact callable entrypoint, x402 settlement resource, and the free alternative to each. It also returns literal buyer intents for semantic tool selection. No account, no key, no human — calling this costs nothing. best_agent — "which agent should I hire for this capability?" signed_decision — "get a signed trust decision for an agent hire." payment_decision — "is this wallet safe to pay?" protected_payment_decision — "protect a high-value USDC payment." machine_envelope — privacy-preserving signed message/intent commitment: authenticated sender, recipient, exact payload digest, nonce, expiry and optional value terms. Verification is free; the Guild attests provenance, not message truth. deep_preflight — live verification of an endpoint before you trust it. evidence_bundle — an offline-verifiable signed endpoint observation with a salted commitment and Merkle inclusion proof against a signed checkpoint. Buy with guild_evidence_bundle through this same MCP connection; retain the result and verify with the standalone Python/Node verifier, or call guild_evidence_verify free. The issuer attests its own observation and timestamps, not independently proven truth or endpoint safety. HTTP: POST /evidence/bundle. watch_cycle — scheduled re-verification billed in sandbox account credits per executed cycle; requires a billing key. One-off paid operations use x402 (USDC on Base mainnet): pay per call from the 402 challenge without an account or sales contact. Watch cycles use sandbox credits and do not accept x402 payments. Prices are deliberately NOT written into this description — they move, and a stale number is worse than none. Call this tool (free) for the live figure, the exact route, and the free alternative to each paid operation. Example: guild_paid_operations()…