mcp.hireahelper.com — CLASS_SUSPENDED_CRITICAL

This is the free, redacted sample of a real dated finding. Everything that proves it exists is here; the itemized diff and the reproduce steps are not.

# Tool-surface change observed — mcp.hireahelper.com

**Endpoint:** `https://mcp.hireahelper.com`  
**Version string served, unchanged across both observations:** `1.2.17`  
**Change first observed:** 2026-09-25T07:40:03.721Z  
**Finding:** CLASS_SUSPENDED_CRITICAL

Surface expanded without a version change, and at least one new tool takes an action (writes, sends, moves money, or deletes).

## What we observed

Two anonymous `tools/list` enumerations of the endpoint above, at different times.
The `serverInfo.version` string was byte-identical in both. The tool set was not.

Behind the paywall

the itemized list of added tools
which of them take an action
the exact handshake to reproduce it
the signed notary receipt for the observation dates

See the offer →