Is GoodLeads MCP server safe?

Findings (3)

• highWrite-action tools reachable without authenticationauth.open-write
• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool data_quality_scorecard: …How clean is the data a buyer would receive in a state — numbers, not adjectives. The scorecard grades the records a buyer would receive on mechanical conformance across four dimensions — format (state/phone/email/zip), completeness (a name for who filed it, an address present), consistency (names in CRM-ready Title Case, not ALL-CAPS), and standardization (how much of the state's raw status / entity-type vocabulary is mapped into the canonical cross-state values that `status` / `entity_type` filters match on — an unmapped row is one a canonical filter silently misses). It returns an overall 0–100 score, the per-dimension breakdown, and per-check pass rates with sample offenders you can click through. Use it to answer "how clean is the data we're selling in {state}?" and to track data-quality work the way classification is tracked. The payload also carries a fifth, record-centric **coverage** dimension (the `coverage` block + `dimensions.coverage`): per pipeline stage, how many records that brain has NEVER stamped (`gap`), plus a stale-version count where the brain persists one. Free-chain checks are scored; paid stages (skip trace / gap-fill / validation / LLM passes) are reported but unscored — enrichment is spent per order, so an un-enriched set of records is posture, not a defect. Coverage deliberately does not move the headline `score`. Each check includes `browse_filters` (a `missing_stage` filter): the exact set of records works on `browse_leads` and scopes a surgical repair run on the pipeline trigger. Stages whose brains leave no per-record mark are listed under `coverage.unmeasured` with reasons rather than pretended into numbers. Args: state: Two-letter state code (e.g. `FL`, `CO`). Omit to get every state, worst score first. The all-states form evaluates the full book (~800k records, ~40s) — when you only need one state, pass it: per-state responses return in seconds. sample_limit: Max sample offenders to return per check (0–50, default 8). Returns: A scorecard dict for one state, or `{"states": [...]}` for all states. Either shape carries a `_meta` provenance block (schema_version, freshness, source, score_versions, access_level). …

• lowNo source repository listedmaint.no-repo