hubspot-update-engagement
on npm:@hubspot/mcp-server@0.4.0
Severity
1 finding on this tool
- highexcessive agencyf-r3-hubspot_update_engagement
Tool `hubspot-update-engagement` name implies a side effect that is not declared
`hubspot-update-engagement` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.
fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).
OWASP LLM08NIST MEASURE-2.6ATLAS T0051
About this tool
hubspot-update-engagement is one of 21 tools exposed by HubSpot MCP. The server scored 40/100 overall against the capframe rule engine (source: sandbox). Last scanned 2026-06-05.
The findings above are emitted by the public capframe.findings.v1 schema. Disagree with one? Open an issue.