Is MovingPlace Moving Services MCP server safe?

Findings (3)

• highWrite-action tools reachable without authenticationauth.open-write
• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool list_service_providers: …Lists moving-labor service providers serving a 5-digit US ZIP code on a given date, factoring in availability. This is the primary way to discover which providers serve an area. Resolve any city/state the user gives you to a single 5-digit ZIP yourself before calling; if the location is ambiguous, ask the user to confirm which ZIP. Results include providers that cannot currently be booked (canBook=false with reasonsCantShow) and are ordered per sortOrder: best price -> PriceLowToHigh, most expensive -> PriceHighToLow, best quality/highest rated -> QualityRating, most reviews -> MostReviewed, soonest available -> Availability, best match (marketplace default) -> BestMatch. When serviceType is MoversPlusTruck, unloadingZipCode (the destination ZIP) is required or the request is rejected by the Partner API. resultFormat controls the shape: Compact (default) returns a trimmed list where startingPrice is a flat estimated starting total for the quoted job size, not an hourly rate; Full returns the complete raw provider list and pricing breakdown. Interpreting pricing (labor-only / Standard): there is NO single "$X per hour" rate. Do NOT compute one by dividing price by hours, or by crew x hours. In the Compact (default) shape the only price field is startingPrice: present it as a flat estimated starting total for the job size you passed (laborHours/crewSize), and call again with resultFormat=Full when you need the per-hour breakdown. In the Full shape, price is a flat estimated starting total for actualNumHours hours with actualCrewSize crew -- it is not an hourly rate; the only true per-hour figure is extraHourRate (the cost of each additional hour of labor beyond the base). In the Full shape state pricing as: "$<price> for <actualCrewSize> movers for <actualNumHours> hours, plus $<extraHourRate>/hr for any additional time." Prefer serviceMiniDescription and publicNotices verbatim when present. Never present a single blended hourly rate. Review scope: in the Compact shape, reviewCount and averageRating -- and in the Full shape, the raw numberOfReviews and ratingAverage fields -- are for the single provider location serving the searched ZIP, not the provider overall. This per-location figure can legitimately differ from the provider-wide review total returned by get_provider_reviews; never present the two as contradictory.…

• lowNo source repository listedmaint.no-repo