# com.teppek/teppek Agent-accessible map of global supply & demand: jobs, homes, cars & services your AI can act on - **Type:** MCP server - **Trust:** 30/100 (D), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.3.0 - **Author:** com.teppek - **License:** Unknown - **Endpoints:** streamable-http https://mcp.teppek.com/mcp, sse https://mcp.teppek.com/sse - **Source:** https://www.teppek.com - **Endpoint health:** degraded (last checked 2026-09-05T20:43:29.270Z, 3 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 30/100 (D), scored on the content rubric - Publisher verified: no - Install scripts: suspicious script found - Prompt-injection scan: findings present - Obfuscation scan: clean - Evidence age: 0 days ## Security scan - **Status:** warnings - **Scanned:** 2026-09-05T20:43:29.270Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. **Findings** - injection-shaped content (warning) in the `update_listing_images` tool: Exfiltration-shaped instruction ## Tools 16 declared. Observed from a live `tools/list` probe. - `search_listings` — Find live jobs, homes/rentals, vehicles, or local services NEAR a place or in a city/country on Teppek — use this for natural requests like "jobs near me", "apa - `semantic_search` — Semantic (meaning-based) search over Teppek's live listings, backed by a multilingual embedding index. Use it when the user describes what they want in natural - `get_listing` — Fetch the full detail of ONE Teppek listing by id — title, description, price/salary, location and the Teppek contact route. Use after search_listings to show, - `send_message` — START contact with the owner of a Teppek LISTING on the user's behalf (identified by the listing) — the primary FIRST-CONTACT path (there is no price-offer/acce - `create_listing` — Publish a listing on behalf of the user across any of the 4 verticals and 12 roles. `location` must be coordinates ({ lat, lon }) — a free-text address is not a - `request_image_upload` — Get a short-lived upload grant to attach a photo to a listing you're about to publish (any vertical/role). Returns { key, upload_url, upload_token, headers_requ - `list_my_listings` — List the user's OWN listings (any status), newest first. Resolved from the authenticated agent key — only ever returns this user's listings. Use status='pending - `list_conversations` — List the user's OWN listing-message conversations (threads they started, or received as a listing owner), newest first. Resolved from the authenticated agent ke - `get_conversation` — Read one of the user's OWN message conversations by thread_id, including its messages (marks incoming messages read). Only threads the authenticated user partic - `get_entitlements` — Check the user's publishing entitlements BEFORE attempting to publish: membership tier, max vs current active listings, remaining slots, wallet credit balance, - `update_listing` — Edit fields (title, description, price, currency, location) on one of the USER'S OWN listings, identified by listing_id. Only the owner can edit; vertical/inten - `delete_listing` — Delete (soft-delete) one of the USER'S OWN listings by listing_id. Only the owner can delete. No credit is refunded — the listing was already published. - `set_listing_status` — Change the lifecycle status of one of the USER'S OWN listings: mark it sold, hide it (take it offline), or re-activate a hidden one. Free — no credit charge. Ca - `renew_listing` — Renew one of the USER'S OWN listings — extend its expiry another 30 days (native listings lapse ~30 days after posting). Free — no credit charge. Renewing an ex - `reply_to_conversation` — Continue an EXISTING message thread by thread_id — the message goes to the other participant. Use this to follow up in a conversation that already exists, wheth - `update_listing_images` — Add and/or remove photos on one of the USER'S OWN existing listings (max 6 total). First call request_image_upload for each new image and upload the bytes, then ## Install **Verdict: do-not-install** — Do not install: 1 injection-shaped pattern found in this entry's own text — it may try to steer the model that loads it. **Blocking** - 1 injection-shaped pattern found in this entry's own text — it may try to steer the model that loads it. — tool:update_listing_images: Exfiltration-shaped instruction **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Client configuration withheld.** Client configs are withheld because this entry has a blocking finding. Show the warnings below to the person installing it. If they have seen the findings and still want to proceed, request the plan again with acknowledge_warnings=true. ## Blast radius Moderate to extensive — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on someone else's infrastructure. - Floor 33, ceiling 57 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/com.teppek%2Fteppek - Install plan: https://forgeregistry.com/api/v1/packages/com.teppek%2Fteppek/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/com.teppek%2Fteppek - HTML page: https://forgeregistry.com/registry/com.teppek%2Fteppek - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.