Home / MCP registry index / it.marketpilot/marketpilot
MarketPilot
it.marketpilot/marketpilot in the official MCP registry.
Endpoint https://api.marketpilot.it/mcp.
The registry describes it as: Korean SMB marketing: browse, pay by card link, track orders. No login to start; OAuth to link.
We read its 24 tools on 2026-10-22. Nothing in them matched our tool-poisoning rules. It also sets server instructions, text a client puts in front of the model on connect; those were read too.
A clean read means these rules found nothing, not that the server is harmless. A server can change its tools at any time, which is why the index reads it again every week.
Tools it advertises
whoami list_products get_product search_places create_checkout get_checkout_status submit_inquiry send_signup_code signup quote_order create_order list_my_orders get_my_order get_point_balance request_point_charge list_charge_requests get_charge_request cancel_charge_request list_support_matches search_support_programs get_support_program list_procurement_matches search_procurement_bids get_procurement_bid
Run this server? Show the check in your README
The badge reflects the latest weekly read: 
[](https://lazaretto.dev/mcp-registry/it-marketpilot-marketpilot)How this was checked
Lazaretto connects to the endpoint the way any MCP client does, asks the server to introduce itself and list its tools, and reads every name, description, parameter schema and server instruction for tool poisoning: hidden directive blocks, orders to read local secrets, parameters built to carry secrets or the conversation out, orders that redirect another server's tools, and invisible characters. It never calls a tool. What we found across the registry.
To run the same check every time Claude Code adds a server, install the free lazaretto-guard plugin. Browse every server in the index.