ai.aarna/atars-mcp

http:https://mcp.aarna.ai/mcp

scanned 2026-08-28T20:48:59.857Z rulepack rulepack-2026.08.1 transport http tools 18

crit 1 high 0 med 1 low 0 info 0

critical remote-no-auth LLM08 deterministic

Remote server returns mutating tools without authentication

We enumerated 1 state-changing tool(s) over an unauthenticated connection. Anyone who can reach the endpoint can drive them.

at tool get_data_info · field endpoint

1 mutating tools, no auth header

reproduce: mcpaudit-scan --http https://mcp.aarna.ai/mcp --check remote-no-auth

medium missing-annotations LLM08 deterministic

Mutating tool ships without readOnlyHint

Tool "get_data_info" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

at tool get_data_info · field annotations

{}

reproduce: mcpaudit-scan --http https://mcp.aarna.ai/mcp --check missing-annotations

This is an automated, point-in-time report from passive metadata analysis (the server's own initialize and tools/list advertisement). No tools were invoked. The grade reflects deterministic checks only; findings marked "llm" are triage signals for human review and do not affect the grade. Verify any finding with its reproduce command. Rulepack rulepack-2026.08.1.