Is Sendraven MCP server safe?

Findings (2)

• highWrite-action tools reachable without authenticationauth.open-write
• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool send_broadcast: …Send a draft or scheduled campaign now, or schedule it with scheduled_at. This mails every contact in the segment and cannot be undone once started; preview_broadcast shows the count beforehand. Marketing mail must carry a postal address: a workspace without one is refused with 422 no_postal_address (a person adds it in Settings), and a suspended workspace with 422 workspace_suspended, whether sending now or scheduling. Calling this on an already-scheduled campaign with a new scheduled_at moves it; with no scheduled_at it starts now. Any other status answers 409 invalid_state, and a malformed scheduled_at 422 invalid_request. Returns the campaign object, as get_broadcast does: its status and scheduled_at are where the campaign now stands. The calling API key's guardrails apply: a key that holds its sends for approval (requires_approval) or has allowed_recipients gets 403 forbidden, because a campaign cannot be held for approval or kept to an allowlist. A retry answers the same; the campaign is sent by a person from the dashboard, or with a key without those guardrails. A key with a daily_send_limit is charged once for each campaign it puts on its way: sending or scheduling a draft counts its recipients, and starting a scheduled campaign now, moving it earlier, resuming it or deciding its winner counts what it still has to send, unless this key already paid for that campaign. When that does not fit what is left of the limit today the call answers 429 daily_limit and nothing changes; a retry the same day answers the same. The campaign's topic_key was checked against existing topics when it was created. A campaign bigger than the day's remaining quota or its domain's warm-up allowance is not rejected: it sends what it can and stops as 'paused', then continues later. That is expected, not an error, and retrying does not change it. An A/B test sends its sample, goes to 'testing', and sends the rest to the winner after decide_after_minutes or when pick_broadcast_winner is called. A send-time test is scheduled by its variants' send_at and does not accept scheduled_at.…