Security of trivago MCP

Every rescan is logged, even when nothing changed.

1. 1Ask the live serverWe connect the way your agent does and list its tools. We never call one.
2. 2Pin every toolEach tool’s name, description and input schema is hashed, so any change shows up as a diff.
3. 3Read it like an attackerRules look for hidden instructions, invisible text, credential grabs, download-and-run and data leaving.
4. 4Hold what failsFlagged listings are taken down until a person reviews them, new versions included.

Scanned on every change, and again when our rules improve.