MCP server for Local Falcon's local SEO and AI visibility platform: geo-grid rank tracking, campaign management, and competitor analysis via Model Context Protocol
Drift inferred · capture-to-capture
- HIGH code analysis flagged hidden prompt content in local-falcon/mcp
- HIGH code analysis flagged hidden prompt content in local-falcon/mcp
- HIGH code analysis flagged hidden prompt content in local-falcon/mcp
tool count over time
06-01 12:37 now
37t
37t
transport stdio · streamable-http · http · sse counts 38 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
addLocationsToFalconGuard
-
createLocalFalconCampaign
-
getLocalFalconCampaignReport
-
getLocalFalconCompetitorReport
-
getLocalFalconCompetitorReports
-
getLocalFalconGoogleBusinessLocations
-
getLocalFalconGrid
-
getLocalFalconGuardReport
-
getLocalFalconKeywordAtCoordinate
-
getLocalFalconKeywordReport
-
getLocalFalconKnowledgeBaseArticle
-
getLocalFalconLocationReport
-
getLocalFalconRankingAtCoordinate
-
getLocalFalconReviewsAnalysisReport
-
getLocalFalconTrendReport
-
listAllLocalFalconLocations
-
listLocalFalconAutoScans
-
listLocalFalconCampaignReports
-
listLocalFalconGuardReports
-
listLocalFalconKeywordReports
-
listLocalFalconLocationGroups
-
listLocalFalconLocationReports
-
listLocalFalconReviewsAnalysisReports
-
listLocalFalconScanReports
-
listLocalFalconTrendReports
-
pauseFalconGuardProtection
-
pauseLocalFalconCampaign
-
reactivateLocalFalconCampaign
-
removeFalconGuardProtection
-
resumeFalconGuardProtection
-
resumeLocalFalconCampaign
-
runLocalFalconCampaign
-
runLocalFalconScan
-
saveLocalFalconBusinessLocationToAccount
-
searchForLocalFalconBusinessLocation
-
searchLocalFalconKnowledgeBase
-
updateLocalFalconCampaign
-
viewLocalFalconAccountInformation
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 0090997 · analyzer v33 · 13h ago
skills & prompt files 4
- hidden: agent-rules: skill-exfil local-falcon-mcp-0090997/CLAUDE.md :27
secret→sink: - **FormData (v2):** `new FormData()` → `form.append()` → POST with form body
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 14
filesystem 2
- fs local-falcon-mcp-0090997/server.ts :4
import fs from "fs"; - fs local-falcon-mcp-0090997/vite.ui.config.ts :4
import { readdirSync } from "fs";
network 2
- net local-falcon-mcp-0090997/localfalcon.ts :1
import fetch from "node-fetch"; - net local-falcon-mcp-0090997/oauth/oauthClient.ts :98
const response = await fetch(OAUTH_CONFIG.tokenUrl, {
secrets 4
- secrets local-falcon-mcp-0090997/index.ts :462
client_secret: process.env.OAUTH_CLIENT_SECRET || '', - secrets local-falcon-mcp-0090997/oauth/config.ts :11
clientSecret: process.env.OAUTH_CLIENT_SECRET || '', - secrets local-falcon-mcp-0090997/server.ts :45
return process.env.LOCAL_FALCON_API_KEY; - secrets local-falcon-mcp-0090997/vite.ui.config.ts :24
'__GOOGLE_MAPS_API_KEY__': JSON.stringify(process.env.GOOGLE_MAPS_API_KEY || ''),
tool registrations 38
- listLocalFalconScanReports local-falcon-mcp-0090997/server.ts :362
- listAllLocalFalconLocations local-falcon-mcp-0090997/server.ts :443
- listLocalFalconLocationGroups local-falcon-mcp-0090997/server.ts :461
- getLocalFalconGoogleBusinessLocations local-falcon-mcp-0090997/server.ts :482
- runLocalFalconScan local-falcon-mcp-0090997/server.ts :503
- listLocalFalconCampaignReports local-falcon-mcp-0090997/server.ts :529
- getLocalFalconCampaignReport local-falcon-mcp-0090997/server.ts :553
- createLocalFalconCampaign local-falcon-mcp-0090997/server.ts :573
- updateLocalFalconCampaign local-falcon-mcp-0090997/server.ts :625
- runLocalFalconCampaign local-falcon-mcp-0090997/server.ts :704
- pauseLocalFalconCampaign local-falcon-mcp-0090997/server.ts :722
- resumeLocalFalconCampaign local-falcon-mcp-0090997/server.ts :740
- reactivateLocalFalconCampaign local-falcon-mcp-0090997/server.ts :760
- listLocalFalconReviewsAnalysisReports local-falcon-mcp-0090997/server.ts :778
- getLocalFalconReviewsAnalysisReport local-falcon-mcp-0090997/server.ts :809
- listLocalFalconGuardReports local-falcon-mcp-0090997/server.ts :828
- getLocalFalconGuardReport local-falcon-mcp-0090997/server.ts :851
- addLocationsToFalconGuard local-falcon-mcp-0090997/server.ts :872
- pauseFalconGuardProtection local-falcon-mcp-0090997/server.ts :890
- resumeFalconGuardProtection local-falcon-mcp-0090997/server.ts :912
- removeFalconGuardProtection local-falcon-mcp-0090997/server.ts :934
- listLocalFalconTrendReports local-falcon-mcp-0090997/server.ts :956
- getLocalFalconTrendReport local-falcon-mcp-0090997/server.ts :981
- listLocalFalconAutoScans local-falcon-mcp-0090997/server.ts :1009
- listLocalFalconLocationReports local-falcon-mcp-0090997/server.ts :1034
- getLocalFalconLocationReport local-falcon-mcp-0090997/server.ts :1058
- listLocalFalconKeywordReports local-falcon-mcp-0090997/server.ts :1077
- getLocalFalconKeywordReport local-falcon-mcp-0090997/server.ts :1100
- getLocalFalconCompetitorReports local-falcon-mcp-0090997/server.ts :1119
- getLocalFalconCompetitorReport local-falcon-mcp-0090997/server.ts :1144
- getLocalFalconGrid local-falcon-mcp-0090997/server.ts :1169
- getLocalFalconRankingAtCoordinate local-falcon-mcp-0090997/server.ts :1191
- getLocalFalconKeywordAtCoordinate local-falcon-mcp-0090997/server.ts :1213
- searchForLocalFalconBusinessLocation local-falcon-mcp-0090997/server.ts :1234
- saveLocalFalconBusinessLocationToAccount local-falcon-mcp-0090997/server.ts :1254
- viewLocalFalconAccountInformation local-falcon-mcp-0090997/server.ts :1304
- searchLocalFalconKnowledgeBase local-falcon-mcp-0090997/server.ts :1340
- getLocalFalconKnowledgeBaseArticle local-falcon-mcp-0090997/server.ts :1361
declared dependencies 18
- @modelcontextprotocol/sdk@^1.26.0
- @modelcontextprotocol/ext-apps@^1.2.2
- abort-controller@^3.0.0
- cors@^2.8.5
- dotenv@^16.5.0
- express@^5.1.0
- express-rate-limit@^8.2.2
- node-fetch@^3.3.2
- uuid@^11.1.0
- zod@^3.25.0
- marked@^17.0.4
- vite@^8.0.0
- vite-plugin-singlefile@^2.3.2
- @types/cors@^2.8.18
- @types/express@^5.0.1
- @types/marked@^6.0.0
- ts-node@^10.9.2
- typescript@^5.8.3