Is SalesMap MCP server safe?

Findings (1)

• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool playbook: …Price in paid mode: $7.50 on a discover for the same seller from the last 7 days, $25.00 when it has to run its own sweep. Never more than max_usd. Mode: `paid` (the default when the balance covers one result) runs SalesMap's own search, models and paid data sources, free sources first, at the price above. `free` (the default otherwise) is $0: the calling agent runs the searches and judgments returned as `work`, and SalesMap reads and checks every source. `mode` overrides the default. Finds the accounts a seller should sell to now, writes the sales playbook, and lists the relevant events coming up that fit the seller's buyers, in one call. From the seller's website (or the user's own list of companies in `companies`, up to 50) it runs discover: drafts the ICP from the site (or takes one), finds candidate companies from free sources (competitors' customer pages, web search, Hacker News, YC, press wires, ATS boards, SEC Form D), reads each one's job board, news, tools and AI-adoption signals, checks every signal against its source page and ranks (prioritizes) them, fresh signal clusters and warm ways in first. `ranked` is the rest of the researched list beyond the ones written up, in order with each one's rank, compact: per account its fit, buyer role, signal families with the strongest signal, `readyNow` and `checkFirst` (the gaps: unknown or out-of-band size, no checked signal or none showing a need, no fit shown in its facts, no way in). `listed` is every other company it found, by tier (screened: home page read for fit; listed: ranked only on where it was found) then score: never researched, checked or charged, 25 inline. Then it writes up the accounts that qualified, up to five (at least the top three), highest ranked first, as a Markdown playbook (`moreQualified` names any qualified past the five): per company its fit, why now (the signals that passed their check, with links and dates), who to reach (a warm path from the user's network, else the buyer role), the angle, Check first, its checked ties to upcoming events (sponsor, speaker, host or exhibitor) and a first-email draft. Under the accounts: relevant events coming up that fit the seller's buyers (each page and date checked; nobody is confirmed to attend). The write-up is checked claim by claim against the signals and the seller's offer; after one whole-write-up repair, an email that still fails is withheld in full. Returns the Markdown with a short summary per company; locally it is also saved to a file at `path`. Takes minutes; research is cached, so a rerun is fast. It writes up the user's discover for the same seller and criteria from the last 7 days when there is one (`reusedDiscover`); otherwise `reuse` says why it searched again. Use when: "find accounts for <seller site>", "who should I sell to", "who should <seller site> sell to right now", "which accounts are in market", "rank my list of target accounts", "which of my own accounts should I work first", "who in my network can introduce me to a buyer", "who do I know at <company>", "write me a playbook for <seller site>", "give me a sales playbook for <seller>", "top 3 accounts with openers", "who should I email this week and what do I say", "draft outreach for my best accounts". Skip when: the question is one fact about one company (what software or vendors it runs, its DNS records or certificate logs, whether it ships an MCP server or is serious about LLMs), one news item, quote, claim or row to verify or fact-check, a draft of the user's own to check, whether an address is valid or deliverable, a mobile or phone number, LinkedIn profiles pulled or scraped, mutuals found by browsing LinkedIn, an RSVP or registration, events, conferences or meetups to attend on their own (the playbook lists them only beside its accounts), a watchlist of lost deals, facts about the user's own company to save or remember, or anything sent or written into a CRM (Salesforce, HubSpot) as leads: this never contacts anyone or writes anywhere but its own file. Each account also returns its fit, watch-outs, Check first gaps, evidence and complete checked opener in structured fields, and `delivered` when it has a sourced in-band size, a checked signal or warm path and a complete checked email. Observed (checked signals), Inferred (fit, objections, angle, roles) and drafts are labelled apart in the file. Openers are drafts for the user to edit, not facts about the people. `evidence`: passages the user found on a public page (its URL, the quote verbatim, the date as printed); each is checked against its page before it counts as a signal on that company, and is never what makes an account charged. Each failed passage comes back under `evidence` with the rule it failed. Paid mode, with `context.user.linkedinUrl` saved: who to reach also lists up to 3 buyers per account (9 in all) whose past employer (overlapping years) or school matches the user's own, read through treg's hosted BlitzAPI under the budget hold and matched in code. Without connections or shared history, the result says it is cold outreach. `context` takes the user's own facts about their company; the saved seller profile fills fields left out. With the ICP or buyer roles still unknown, the server asks the user for them (MCP elicitation) or returns the questions without running. On the hosted server a finished playbook also returns `link`: its page on salesmap.site, the same layout for every seller, which only signed-in members of the user's workspace can open (a member can make a public copy there that names no one). Give the user the link. In paid mode: charged per result returned from the user's credits, never for a miss (the paid data sources it uses, TheirStack and Monid, are our cost): at most `max_usd` (default: the quote tool's figure) and within their monthly limit, reserved before it runs. If the next step would pass its budget, it stops and returns what it has, with `stopped: "budget"`, charged only for that; `budget` says what was reserved and charged. A call quoted over max_usd is refused. A call quoted over the user's ask-before-spending threshold (default $1) asks the user first through the client (MCP elicitation); a client without that gets a `confirm` result with the cost and a one-use token, and a repeat call with the same arguments and `confirm_token` runs it. On the hosted server it runs as a background job: a round that takes longer than about 25 seconds returns `job` (its id and status) instead, and the free `job` tool returns its status and, once done, this call's result. In paid mode one call does it all, with no rounds. In free mode each round returns `work` and continuation.input until there is none. While SalesMap's models or search are unavailable, a paid call carries on as a free one, says so in `notice` and charges nothing. Quoted page text is normalized; a quote that reads like an instruction keeps its text and is flagged in <field>Flags with the attack family.…