compeller.ai

This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.

This tool sends compel lifecycle event data (and later, potentially sensitive metadata) to an arbitrary HTTPS URL supplied by the caller. While this is a legitimate webhook feature and includes a URL safety check at delivery time, an agent could be induced to register a webhook pointing to an attacker-controlled endpoint, causing account activity data to be exfiltrated. No malicious intent is evident in the description itself, but the capability is broad and worth flagging for review of the URL safety check's robustness.

Allows changing the delivery URL of an already-registered webhook. Combined with register_webhook, this creates a persistent channel for exfiltrating compel/account event data to any HTTPS endpoint if the URL safety check can be bypassed or is incomplete. Not inherently malicious, but a broad capability relative to a simple CRUD webhook manager.