Is Kapruka MCP server safe?

Findings (2)

• highWrite-action tools reachable without authenticationauth.open-write
• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool kapruka_get_product: …Fetch full details for a single Kapruka product by its product ID. Returns name, description, price (with optional currency conversion), stock status, images, variants, shipping info, delivery scope, and a direct product URL. Delivery scope: most gifts ship island-wide, but restaurant food, hotel cakes and liquor only reach a limited city set (typically the Colombo area). The `delivery` object is the authority — search results do NOT carry it. When `delivery.island_wide` is false, tell the customer up front that the item is delivered only to selected cities, and confirm their city with kapruka_check_delivery(city, product_id) before promising anything. If `deliverable_city_count` exceeds the returned list, the list is truncated — say "and more", don't treat it as complete. Note: Some IDs starting with 'CATSYM' are category landing pages, not purchasable products — this tool will flag those clearly. Args: params (GetProductInput): - product_id (str): Kapruka product ID (e.g. 'cakeXX000000') - currency (str): Price currency — LKR (default), USD, GBP, AUD, CAD, EUR - type (Optional[str]): Optional type hint (e.g. 'specialgifts') - response_format (str): 'markdown' (default) or 'json' Returns: str: Product details in the requested format. JSON schema: { "id": str, "name": str, "description": str, "summary": str, "price": {"amount": float, "currency": str}, "compare_at_price": {"amount": float, "currency": str} | null, "in_stock": bool, "stock_level": str, # "low" | "medium" | "high" "category": {"id": str, "name": str, "slug": str, "path": str}, "variants": [{"id": str, "name": str, "sku": str, "price": {...}, "in_stock": bool, "stock_level": str, "attributes": {...}}], "images": [str], # list of full-resolution image URLs "attributes": {"type": str, "subtype": str, "weight": str, "vendor": str}, "shipping": {"ships_from": str, "ships_internationally": bool, "restricted_countries": [str]}, "delivery": { "island_wide": bool, "deliverable_city_count": int, # only when island_wide=false; TRUE total "deliverable_cities": [str] # only when island_wide=false; capped at 60 }, "rating": null, "url": str } Error: "Error: <message>" on failure. …