mcp-server-trello

Security Findings (180)

• HighExcessive Permission Surface ×50

  • TRELLO_ADD_CARDS:tool declares network permission
  • TRELLO_ADD_CARDS_ATTACHMENTS_BY_ID_CARD:tool declares network permission
  • TRELLO_ADD_MEMBERS_SAVED_SEARCHES_BY_ID_MEMBER:tool declares network permission
  • TRELLO_ADD_TOKENS_WEBHOOKS_BY_TOKEN:tool declares network permission
  • TRELLO_ADD_TOKENS_WEBHOOKS_BY_TOKEN:tool declares exec permission
  • TRELLO_DELETE_MEMBER_SAVED_SEARCH:tool declares network permission
  • TRELLO_GET_ACTIONS_MEMBER_BY_ID_ACTION_BY_FIELD:tool declares network permission
  • TRELLO_GET_ACTIONS_MEMBER_BY_ID_ACTION_BY_FIELD:tool declares exec permission
  • TRELLO_GET_ACTIONS_ORGANIZATION_BY_ID_ACTION:tool declares network permission
  • TRELLO_GET_ACTIONS_ORGANIZATION_BY_ID_ACTION_BY_FIELD:tool declares network permission
  • TRELLO_GET_BATCH:tool declares network permission
  • TRELLO_GET_BATCH:tool declares exec permission
  • TRELLO_GET_BOARDS_BY_ID_BOARD:tool declares network permission
  • TRELLO_GET_BOARDS_LABELS_BY_ID_BOARD:tool declares network permission
  • TRELLO_GET_BOARDS_LABELS_BY_ID_BOARD_BY_ID_LABEL:tool declares network permission
  • TRELLO_GET_BOARDS_LISTS_BY_ID_BOARD_BY_FILTER:tool declares network permission
  • TRELLO_GET_BOARDS_ORGANIZATION_BY_ID_BOARD:tool declares network permission
  • TRELLO_GET_BOARDS_ORGANIZATION_BY_ID_BOARD_BY_FIELD:tool declares network permission
  • TRELLO_GET_CARDS_BOARD_BY_ID_CARD:tool declares network permission
  • TRELLO_GET_CARDS_LIST_BY_ID_CARD_BY_FIELD:tool declares network permission
  • TRELLO_GET_CARDS_MEMBERS_VOTED_BY_ID_CARD:tool declares network permission
  • TRELLO_GET_CHECKLISTS_BY_ID_CHECKLIST:tool declares network permission
  • TRELLO_GET_LABELS_BOARD_BY_ID_LABEL_BY_FIELD:tool declares network permission
  • TRELLO_GET_LISTS_BOARD_BY_ID_LIST_BY_FIELD:tool declares network permission
  • TRELLO_GET_LISTS_BY_ID_LIST_BY_FIELD:tool declares network permission
  • TRELLO_GET_LISTS_CARDS_BY_ID_LIST:tool declares network permission
  • TRELLO_GET_MEMBER_CUSTOM_BG:tool declares network permission
  • TRELLO_GET_MEMBER_SAVED_SEARCH:tool declares network permission
  • TRELLO_GET_MEMBER_SAVED_SEARCH:tool declares exec permission
  • TRELLO_GET_MEMBERS_BOARD_BACKGROUNDS_BY_ID_MEMBER:tool declares network permission
  • TRELLO_GET_MEMBERS_BOARD_STARS_BY_ID_MEMBER:tool declares network permission
  • TRELLO_GET_MEMBERS_BY_ID_MEMBER:tool declares network permission
  • TRELLO_GET_MEMBERS_BY_ID_MEMBER_BY_FIELD:tool declares network permission
  • TRELLO_GET_MEMBERS_ORGANIZATIONS_BY_ID_MEMBER:tool declares network permission
  • TRELLO_GET_MEMBERS_ORGANIZATIONS_BY_ID_MEMBER_BY_FILTER:tool declares network permission
  • TRELLO_GET_MEMBERS_SAVED_SEARCHES_BY_ID_MEMBER:tool declares network permission
  • TRELLO_GET_MEMBERS_SAVED_SEARCHES_BY_ID_MEMBER:tool declares exec permission
  • TRELLO_GET_NOTIF_CREATOR_FIELD:tool declares network permission
  • TRELLO_GET_NOTIFICATIONS_DISPLAY_BY_ID_NOTIFICATION:tool declares network permission
  • TRELLO_GET_NOTIFICATIONS_LIST_BY_ID_NOTIFICATION_BY_FIELD:tool declares network permission
  • TRELLO_GET_NOTIFICATIONS_MEMBER_BY_ID_NOTIFICATION:tool declares network permission
  • TRELLO_GET_NOTIFICATIONS_MEMBER_CREATOR_BY_ID_NOTIFICATION:tool declares network permission
  • TRELLO_GET_ORGANIZATIONS_BOARDS_BY_ID_ORG:tool declares network permission
  • TRELLO_GET_ORGANIZATIONS_BOARDS_BY_ID_ORG_BY_FILTER:tool declares network permission
  • TRELLO_GET_ORGANIZATIONS_BY_ID_ORG_BY_FIELD:tool declares network permission
  • TRELLO_GET_ORGANIZATIONS_DELTAS_BY_ID_ORG:tool declares network permission
  • TRELLO_GET_ORGANIZATIONS_MEMBERS_BY_ID_ORG_BY_FILTER:tool declares network permission
  • TRELLO_GET_ORGANIZATIONS_MEMBERS_CARDS_BY_ID_ORG_BY_ID_MEMBER:tool declares network permission
  • TRELLO_GET_ORGANIZATIONS_MEMBERSHIPS_BY_ID_ORG:tool declares network permission
  • TRELLO_GET_SEARCH:tool declares network permission

  Rule: AS-002Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.
• HighInsecure Secret Handling

  TRELLO_GET_MEMBERS_BY_ID_MEMBER:input parameter "tokens" appears to accept a secret or credential

  Rule: AS-010Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.
• MediumExcessive Permission Surface ×43

  • TRELLO_ADD_CARDS:tool declares fs permission
  • TRELLO_ADD_CARDS_ACTIONS_COMMENTS_BY_ID_CARD:tool declares fs permission
  • TRELLO_ADD_CARDS_ATTACHMENTS_BY_ID_CARD:tool declares fs permission
  • TRELLO_ADD_MEMBERS_AVATAR_BY_ID_MEMBER:tool declares fs permission
  • TRELLO_ADD_MEMBERS_BOARD_BACKGROUNDS_BY_ID_MEMBER:tool declares fs permission
  • TRELLO_ADD_MEMBERS_CUSTOM_BOARD_BACKGROUNDS_BY_ID_MEMBER:tool declares fs permission
  • TRELLO_ADD_MEMBERS_CUSTOM_EMOJI_BY_ID_MEMBER:tool declares fs permission
  • TRELLO_ADD_MEMBERS_CUSTOM_STICKERS_BY_ID_MEMBER:tool declares fs permission
  • TRELLO_ADD_MEMBERS_SAVED_SEARCHES_BY_ID_MEMBER:tool declares db permission
  • TRELLO_ADD_ORGANIZATIONS_LOGO_BY_ID_ORG:tool declares fs permission
  • TRELLO_DELETE_ACTIONS_BY_ID_ACTION:tool declares fs permission
  • TRELLO_DELETE_BOARDS_MEMBERS_BY_ID_BOARD_BY_ID_MEMBER:tool declares fs permission
  • TRELLO_DELETE_BOARDS_POWER_UPS_BY_ID_BOARD_BY_POWER_UP:tool declares fs permission
  • TRELLO_DELETE_CARDS_ACTIONS_COMMENTS_BY_ID_CARD_BY_ID_ACTION:tool declares fs permission
  • TRELLO_DELETE_CARDS_ATTACHMENTS_BY_ID_CARD_BY_ID_ATTACHMENT:tool declares fs permission
  • TRELLO_DELETE_CARDS_BY_ID_CARD:tool declares fs permission
  • TRELLO_DELETE_CARDS_CHECKLISTS_BY_ID_CARD_BY_ID_CHECKLIST:tool declares fs permission
  • TRELLO_DELETE_CARDS_ID_LABELS_BY_ID_CARD_BY_ID_LABEL:tool declares fs permission
  • TRELLO_DELETE_CARDS_ID_MEMBERS_BY_ID_CARD_BY_ID_MEMBER:tool declares fs permission
  • TRELLO_DELETE_CARDS_LABELS_BY_ID_CARD_BY_COLOR:tool declares fs permission
  • TRELLO_DELETE_CARDS_MEMBERS_VOTED_BY_ID_CARD_BY_ID_MEMBER:tool declares fs permission
  • TRELLO_DELETE_CARDS_STICKERS_BY_ID_CARD_BY_ID_STICKER:tool declares fs permission
  • TRELLO_DELETE_CHECKLIST_ITEM:tool declares fs permission
  • TRELLO_DELETE_CHECKLISTS_BY_ID_CHECKLIST:tool declares fs permission
  • TRELLO_DELETE_LABELS_BY_ID_LABEL:tool declares fs permission
  • TRELLO_DELETE_MEMBER_BOARD_BACKGROUND:tool declares fs permission
  • TRELLO_DELETE_MEMBER_CUSTOM_STICKER:tool declares fs permission
  • TRELLO_DELETE_MEMBER_SAVED_SEARCH:tool declares fs permission
  • TRELLO_DELETE_MEMBERS_BOARD_STARS_BY_ID_MEMBER_BY_ID_BOARD_STAR:tool declares fs permission
  • TRELLO_DELETE_ORGANIZATIONS_BY_ID_ORG:tool declares fs permission
  • TRELLO_DELETE_ORGANIZATIONS_LOGO_BY_ID_ORG:tool declares fs permission
  • TRELLO_DELETE_ORGANIZATIONS_MEMBERS_ALL_BY_ID_ORG_BY_ID_MEMBER:tool declares fs permission
  • TRELLO_DELETE_ORGANIZATIONS_MEMBERS_BY_ID_ORG_BY_ID_MEMBER:tool declares fs permission
  • TRELLO_DELETE_ORGANIZATIONS_PREFS_ORG_INVITE_RESTRICT_BY_ID_ORG:tool declares fs permission
  • TRELLO_DELETE_ORG_ASSOCIATED_DOMAIN:tool declares fs permission
  • TRELLO_DELETE_TOKENS_BY_TOKEN:tool declares fs permission
  • TRELLO_DELETE_TOKENS_WEBHOOKS_BY_TOKEN_BY_ID_WEBHOOK:tool declares fs permission
  • TRELLO_DELETE_WEBHOOKS_BY_ID_WEBHOOK:tool declares fs permission
  • TRELLO_GET_ACTIONS_MEMBER_BY_ID_ACTION:tool declares fs permission
  • TRELLO_GET_MEMBER_CUSTOM_BG:tool declares fs permission
  • TRELLO_GET_MEMBERS_BY_ID_MEMBER:tool declares fs permission
  • TRELLO_GET_MEMBERS_BY_ID_MEMBER_BY_FIELD:tool declares fs permission
  • TRELLO_GET_SEARCH:tool declares db permission

  Rule: AS-002Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.
• LowExcessive Permission Surface ×33

  • TRELLO_ADD_BOARDS:input schema exposes 31 properties (threshold: 10)
  • TRELLO_ADD_CARDS:input schema exposes 16 properties (threshold: 10)
  • TRELLO_ADD_LISTS_ARCHIVE_ALL_CARDS_BY_ID_LIST:tool declares http permission
  • TRELLO_ADD_ORGANIZATIONS:tool declares http permission
  • TRELLO_ADD_ORGANIZATIONS:input schema exposes 12 properties (threshold: 10)
  • TRELLO_ADD_ORGANIZATIONS_LOGO_BY_ID_ORG:tool declares http permission
  • TRELLO_ADD_TOKENS_WEBHOOKS_BY_TOKEN:tool declares http permission
  • TRELLO_DELETE_ORGANIZATIONS_LOGO_BY_ID_ORG:tool declares http permission
  • TRELLO_DELETE_ORGANIZATIONS_PREFS_ORG_INVITE_RESTRICT_BY_ID_ORG:tool declares http permission
  • TRELLO_DELETE_ORG_ASSOCIATED_DOMAIN:tool declares http permission
  • TRELLO_DELETE_TOKENS_WEBHOOKS_BY_TOKEN_BY_ID_WEBHOOK:tool declares http permission
  • TRELLO_DELETE_WEBHOOKS_BY_ID_WEBHOOK:tool declares http permission
  • TRELLO_GET_BOARDS_ACTIONS_BY_ID_BOARD:input schema exposes 15 properties (threshold: 10)
  • TRELLO_GET_BOARDS_BY_ID_BOARD:input schema exposes 38 properties (threshold: 10)
  • TRELLO_GET_BOARDS_CARDS_BY_ID_BOARD:input schema exposes 14 properties (threshold: 10)
  • TRELLO_GET_BOARDS_CARDS_BY_ID_BOARD_BY_ID_CARD:input schema exposes 18 properties (threshold: 10)
  • TRELLO_GET_BOARDS_MEMBERS_CARDS_BY_ID_BOARD_BY_ID_MEMBER:input schema exposes 15 properties (threshold: 10)
  • TRELLO_GET_CARDS_ACTIONS_BY_ID_CARD:input schema exposes 15 properties (threshold: 10)
  • TRELLO_GET_CARDS_BY_ID_CARD:input schema exposes 24 properties (threshold: 10)
  • TRELLO_GET_CHECKLISTS_CARDS_BY_ID_CHECKLIST:input schema exposes 14 properties (threshold: 10)
  • TRELLO_GET_LISTS_ACTIONS_BY_ID_LIST:input schema exposes 15 properties (threshold: 10)
  • TRELLO_GET_LISTS_CARDS_BY_ID_LIST:input schema exposes 14 properties (threshold: 10)
  • TRELLO_GET_MEMBERS_ACTIONS_BY_ID_MEMBER:input schema exposes 15 properties (threshold: 10)
  • TRELLO_GET_MEMBERS_BOARDS_BY_ID_MEMBER:input schema exposes 13 properties (threshold: 10)
  • TRELLO_GET_MEMBERS_BY_ID_MEMBER:input schema exposes 53 properties (threshold: 10)
  • TRELLO_GET_MEMBERS_CARDS_BY_ID_MEMBER:input schema exposes 14 properties (threshold: 10)
  • TRELLO_GET_MEMBERS_NOTIFICATIONS_BY_ID_MEMBER:input schema exposes 12 properties (threshold: 10)
  • TRELLO_GET_NOTIFICATIONS_BY_ID_NOTIFICATION:input schema exposes 15 properties (threshold: 10)
  • TRELLO_GET_ORGANIZATIONS_ACTIONS_BY_ID_ORG:input schema exposes 15 properties (threshold: 10)
  • TRELLO_GET_ORGANIZATIONS_BOARDS_BY_ID_ORG:input schema exposes 13 properties (threshold: 10)
  • TRELLO_GET_ORGANIZATIONS_BY_ID_ORG:input schema exposes 26 properties (threshold: 10)
  • TRELLO_GET_ORGANIZATIONS_MEMBERS_CARDS_BY_ID_ORG_BY_ID_MEMBER:input schema exposes 15 properties (threshold: 10)
  • TRELLO_GET_SEARCH:input schema exposes 20 properties (threshold: 10)

  Rule: AS-002Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.
• LowDoS Resilience — Missing Rate Limit / Timeout ×53

  • TRELLO_ADD_CARDS:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_ADD_CARDS_ATTACHMENTS_BY_ID_CARD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_ADD_LISTS_ARCHIVE_ALL_CARDS_BY_ID_LIST:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_ADD_MEMBERS_SAVED_SEARCHES_BY_ID_MEMBER:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_ADD_ORGANIZATIONS:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_ADD_ORGANIZATIONS_LOGO_BY_ID_ORG:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_ADD_TOKENS_WEBHOOKS_BY_TOKEN:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_DELETE_MEMBER_SAVED_SEARCH:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_DELETE_ORGANIZATIONS_LOGO_BY_ID_ORG:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_DELETE_ORGANIZATIONS_PREFS_ORG_INVITE_RESTRICT_BY_ID_ORG:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_DELETE_ORG_ASSOCIATED_DOMAIN:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_DELETE_TOKENS_WEBHOOKS_BY_TOKEN_BY_ID_WEBHOOK:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_DELETE_WEBHOOKS_BY_ID_WEBHOOK:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_ACTIONS_MEMBER_BY_ID_ACTION_BY_FIELD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_ACTIONS_ORGANIZATION_BY_ID_ACTION:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_ACTIONS_ORGANIZATION_BY_ID_ACTION_BY_FIELD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_BATCH:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_BOARDS_BY_ID_BOARD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_BOARDS_LABELS_BY_ID_BOARD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_BOARDS_LABELS_BY_ID_BOARD_BY_ID_LABEL:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_BOARDS_LISTS_BY_ID_BOARD_BY_FILTER:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_BOARDS_ORGANIZATION_BY_ID_BOARD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_BOARDS_ORGANIZATION_BY_ID_BOARD_BY_FIELD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_CARDS_BOARD_BY_ID_CARD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_CARDS_LIST_BY_ID_CARD_BY_FIELD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_CARDS_MEMBERS_VOTED_BY_ID_CARD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_CHECKLISTS_BY_ID_CHECKLIST:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_LABELS_BOARD_BY_ID_LABEL_BY_FIELD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_LISTS_BOARD_BY_ID_LIST_BY_FIELD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_LISTS_BY_ID_LIST_BY_FIELD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_LISTS_CARDS_BY_ID_LIST:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_MEMBER_CUSTOM_BG:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_MEMBER_SAVED_SEARCH:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_MEMBERS_BOARD_BACKGROUNDS_BY_ID_MEMBER:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_MEMBERS_BOARD_STARS_BY_ID_MEMBER:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_MEMBERS_BY_ID_MEMBER:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_MEMBERS_BY_ID_MEMBER_BY_FIELD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_MEMBERS_ORGANIZATIONS_BY_ID_MEMBER:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_MEMBERS_ORGANIZATIONS_BY_ID_MEMBER_BY_FILTER:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_MEMBERS_SAVED_SEARCHES_BY_ID_MEMBER:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_NOTIF_CREATOR_FIELD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_NOTIFICATIONS_DISPLAY_BY_ID_NOTIFICATION:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_NOTIFICATIONS_LIST_BY_ID_NOTIFICATION_BY_FIELD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_NOTIFICATIONS_MEMBER_BY_ID_NOTIFICATION:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_NOTIFICATIONS_MEMBER_CREATOR_BY_ID_NOTIFICATION:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_ORGANIZATIONS_BOARDS_BY_ID_ORG:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_ORGANIZATIONS_BOARDS_BY_ID_ORG_BY_FILTER:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_ORGANIZATIONS_BY_ID_ORG_BY_FIELD:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_ORGANIZATIONS_DELTAS_BY_ID_ORG:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_ORGANIZATIONS_MEMBERS_BY_ID_ORG_BY_FILTER:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_ORGANIZATIONS_MEMBERS_CARDS_BY_ID_ORG_BY_ID_MEMBER:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_ORGANIZATIONS_MEMBERSHIPS_BY_ID_ORG:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • TRELLO_GET_SEARCH:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  Rule: AS-011Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.