E

ai.agenticaffiliate/affiliate-networks-mcp

npm:affiliate-networks-mcp
scanned 2026-08-28T20:49:37.181Z rulepack rulepack-2026.08.1 transport stdio tools 682
crit 0 high 3 med 13 low 0 info 0
high dangerous-capability LLM06 deterministic
Tool advertises a high-risk execution capability

Tool "affiliate_impact-advertiser_get_contract" appears to execute code or shell commands ("execute"). Confirm arguments are strictly validated and the tool requires explicit user consent.

at tool affiliate_impact-advertiser_get_contract · field description
execute
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check dangerous-capability
high intent-mismatch LLM08 deterministic
Destructive-sounding tool is annotated read-only

Tool "affiliate_impact-advertiser_get_contract" mentions "remove" yet sets readOnlyHint:true. If the tool can actually mutate state, the annotation misleads the agent into treating it as safe.

at tool affiliate_impact-advertiser_get_contract · field annotations.readOnlyHint
"remove" + readOnlyHint:true
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check intent-mismatch
high intent-mismatch LLM08 deterministic
Destructive-sounding tool is annotated read-only

Tool "affiliate_impact-advertiser_propose_contract" mentions "remove" yet sets readOnlyHint:true. If the tool can actually mutate state, the annotation misleads the agent into treating it as safe.

at tool affiliate_impact-advertiser_propose_contract · field annotations.readOnlyHint
"remove" + readOnlyHint:true
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check intent-mismatch
medium missing-annotations LLM08 deterministic
Mutating tool ships without readOnlyHint

Tool "affiliate_get_client_strategy" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool affiliate_get_client_strategy · field annotations
{}
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check missing-annotations
medium missing-annotations LLM08 deterministic
Mutating tool ships without readOnlyHint

Tool "affiliate_set_client_strategy" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool affiliate_set_client_strategy · field annotations
{}
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check missing-annotations
medium missing-annotations LLM08 deterministic
Mutating tool ships without readOnlyHint

Tool "affiliate_get_brand_action_bundle" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool affiliate_get_brand_action_bundle · field annotations
{}
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check missing-annotations
medium missing-annotations LLM08 deterministic
Mutating tool ships without readOnlyHint

Tool "affiliate_awin_submit_proof_of_purchase_transaction" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool affiliate_awin_submit_proof_of_purchase_transaction · field annotations
{}
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check missing-annotations
medium missing-annotations LLM08 deterministic
Mutating tool ships without readOnlyHint

Tool "affiliate_post-affiliate-pro_list_programmes" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool affiliate_post-affiliate-pro_list_programmes · field annotations
{}
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check missing-annotations
medium missing-annotations LLM08 deterministic
Mutating tool ships without readOnlyHint

Tool "affiliate_post-affiliate-pro_get_programme" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool affiliate_post-affiliate-pro_get_programme · field annotations
{}
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check missing-annotations
medium missing-annotations LLM08 deterministic
Mutating tool ships without readOnlyHint

Tool "affiliate_post-affiliate-pro_list_transactions" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool affiliate_post-affiliate-pro_list_transactions · field annotations
{}
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check missing-annotations
medium missing-annotations LLM08 deterministic
Mutating tool ships without readOnlyHint

Tool "affiliate_post-affiliate-pro_get_earnings_summary" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool affiliate_post-affiliate-pro_get_earnings_summary · field annotations
{}
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check missing-annotations
medium missing-annotations LLM08 deterministic
Mutating tool ships without readOnlyHint

Tool "affiliate_post-affiliate-pro_list_clicks" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool affiliate_post-affiliate-pro_list_clicks · field annotations
{}
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check missing-annotations
medium missing-annotations LLM08 deterministic
Mutating tool ships without readOnlyHint

Tool "affiliate_post-affiliate-pro_generate_tracking_link" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool affiliate_post-affiliate-pro_generate_tracking_link · field annotations
{}
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check missing-annotations
medium missing-annotations LLM08 deterministic
Mutating tool ships without readOnlyHint

Tool "affiliate_post-affiliate-pro_verify_auth" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool affiliate_post-affiliate-pro_verify_auth · field annotations
{}
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check missing-annotations
medium missing-annotations LLM08 deterministic
Mutating tool ships without readOnlyHint

Tool "affiliate_post-affiliate-pro_list_media_partners" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool affiliate_post-affiliate-pro_list_media_partners · field annotations
{}
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check missing-annotations
medium missing-annotations LLM08 deterministic
Mutating tool ships without readOnlyHint

Tool "affiliate_post-affiliate-pro_get_programme_performance" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool affiliate_post-affiliate-pro_get_programme_performance · field annotations
{}
reproduce: mcpaudit-scan --npm affiliate-networks-mcp --check missing-annotations

This is an automated, point-in-time report from passive metadata analysis (the server's own initialize and tools/list advertisement). No tools were invoked. The grade reflects deterministic checks only; findings marked "llm" are triage signals for human review and do not affect the grade. Verify any finding with its reproduce command. Rulepack rulepack-2026.08.1.