B10cks — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.13.0",
"methodologyVersion": "mcptrustchecker-1.13"
},
"target": {
"id": "@b10cks/mcp-server",
"source": {
"kind": "package",
"origin": "@b10cks/mcp-server"
},
"server": {
"name": "@b10cks/mcp-server"
}
},
"grade": "A",
"score": {
"score": 97,
"threatScore": 100,
"grade": "A",
"band": "A",
"categorySubtotals": {
"injection": 0,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "client",
"term": "capability-exposure",
"level": "moderate",
"label": "capability blast radius (moderate) — client exposure if the model is manipulated",
"appliedPenalty": 3
},
{
"kind": "client",
"term": "verification-discount",
"level": "source",
"label": "publisher verification (provenance) — cryptographic build provenance ties the artifact to its source",
"appliedPenalty": 0
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.13"
},
"capability": {
"level": "moderate",
"reasons": [
"ingests untrusted external content (a prompt-injection entry point)",
"reads sensitive or local data"
],
"tags": [
"sensitive-source",
"untrusted-input"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (dist/server-2IxEwton.js)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/server-2IxEwton.js:24`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/server-2IxEwton.js"
},
"evidence": "\"HOME\"], i = t.join(r, \".netrc\"), a = e.readFileSync(i, \"utf8\"), o = null, s; for (let e of a.split(/\\r?\\n/)) { le",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "dist/server-2IxEwton.js",
"line": 24,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (dist/server-BTdNl8rr.cjs)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/server-BTdNl8rr.cjs:2`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/server-BTdNl8rr.cjs"
},
"evidence": "ME`],n=l.default.join(t,`.netrc`),r=c.default.readFileSync(n,`utf8`),i=null,a;for(let t of r.split(/\\r?\\n/)){let n=t.tri",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "dist/server-BTdNl8rr.cjs",
"line": 2,
"nonRuntime": false
}
}
],
"toxicFlows": [],
"capabilities": [
{
"tool": "system.health",
"tags": [],
"reasons": {}
},
{
"tool": "system.config",
"tags": [],
"reasons": {}
},
{
"tool": "users.me",
"tags": [],
"reasons": {}
},
{
"tool": "users.updateMe",
"tags": [],
"reasons": {}
},
{
"tool": "teams.list",
"tags": [],
"reasons": {}
},
{
"tool": "teams.create",
"tags": [],
"reasons": {}
},
{
"tool": "teams.get",
"tags": [],
"reasons": {}
},
{
"tool": "teams.update",
"tags": [],
"reasons": {}
},
{
"tool": "teams.delete",
"tags": [],
"reasons": {}
},
{
"tool": "teams.hierarchy",
"tags": [],
"reasons": {}
},
{
"tool": "teams.addUser",
"tags": [],
"reasons": {}
},
{
"tool": "teams.removeUser",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.list",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.create",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.get",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.update",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.delete",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.updateIcon",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.archive",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.aiUsage",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.stats",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.contentMenu",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.listMembers",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.updateMember",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.removeMember",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.listInvites",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.createInvite",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.deleteInvite",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.resendInvite",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.updateSearch",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.reindexSearch",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.listSubscriptions",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.getCurrentSubscription",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.checkoutSubscription",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.reinitSubscription",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.cancelSubscription",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.getAiSettings",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.updateAiSettings",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.listAiConfigs",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.createAiConfig",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.getAiConfig",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.updateAiConfig",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.deleteAiConfig",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.getAuditLogs",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.listBackups",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.createBackup",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.getBackup",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.updateBackup",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.deleteBackup",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.listMigrations",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.createMigration",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.list",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.create",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.get",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.update",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.delete",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.sync",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.listTemplates",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.createTemplate",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.getTemplate",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.updateTemplate",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.deleteTemplate",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.listVersions",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.getVersion",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.updateVersion",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.deleteVersion",
"tags": [],
"reasons": {}
},
{
"tool": "blocks.restoreVersion",
"tags": [],
"reasons": {}
},
{
"tool": "contents.list",
"tags": [],
"reasons": {}
},
{
"tool": "contents.create",
"tags": [],
"reasons": {}
},
{
"tool": "contents.get",
"tags": [],
"reasons": {}
},
{
"tool": "contents.update",
"tags": [],
"reasons": {}
},
{
"tool": "contents.delete",
"tags": [],
"reasons": {}
},
{
"tool": "contents.bulkCreate",
"tags": [],
"reasons": {}
},
{
"tool": "contents.treeOperations",
"tags": [],
"reasons": {}
},
{
"tool": "contents.move",
"tags": [],
"reasons": {}
},
{
"tool": "contents.publish",
"tags": [],
"reasons": {}
},
{
"tool": "contents.unpublish",
"tags": [],
"reasons": {}
},
{
"tool": "contents.schedule",
"tags": [],
"reasons": {}
},
{
"tool": "contents.listVersions",
"tags": [],
"reasons": {}
},
{
"tool": "contents.getVersion",
"tags": [],
"reasons": {}
},
{
"tool": "contents.updateVersion",
"tags": [],
"reasons": {}
},
{
"tool": "contents.publishVersion",
"tags": [],
"reasons": {}
},
{
"tool": "contents.setVersionAsCurrent",
"tags": [],
"reasons": {}
},
{
"tool": "comments.list",
"tags": [],
"reasons": {}
},
{
"tool": "comments.create",
"tags": [],
"reasons": {}
},
{
"tool": "comments.get",
"tags": [],
"reasons": {}
},
{
"tool": "comments.update",
"tags": [],
"reasons": {}
},
{
"tool": "comments.delete",
"tags": [],
"reasons": {}
},
{
"tool": "comments.resolve",
"tags": [],
"reasons": {}
},
{
"tool": "comments.unresolve",
"tags": [],
"reasons": {}
},
{
"tool": "comments.listReactions",
"tags": [],
"reasons": {}
},
{
"tool": "comments.addReaction",
"tags": [],
"reasons": {}
},
{
"tool": "comments.removeReaction",
"tags": [],
"reasons": {}
},
{
"tool": "redirects.exportData",
"tags": [],
"reasons": {}
},
{
"tool": "redirects.importData",
"tags": [],
"reasons": {}
},
{
"tool": "dataSources.exportEntries",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"export_data\""
]
}
},
{
"tool": "dataSources.importEntries",
"tags": [],
"reasons": {}
},
{
"tool": "dataSources.translateMissingDimensions",
"tags": [],
"reasons": {}
},
{
"tool": "automations.listActions",
"tags": [],
"reasons": {}
},
{
"tool": "automations.createAction",
"tags": [],
"reasons": {}
},
{
"tool": "automations.getAction",
"tags": [],
"reasons": {}
},
{
"tool": "automations.updateAction",
"tags": [],
"reasons": {}
},
{
"tool": "automations.deleteAction",
"tags": [],
"reasons": {}
},
{
"tool": "automations.getTriggerCatalog",
"tags": [],
"reasons": {}
},
{
"tool": "automations.list",
"tags": [],
"reasons": {}
},
{
"tool": "automations.create",
"tags": [],
"reasons": {}
},
{
"tool": "automations.get",
"tags": [],
"reasons": {}
},
{
"tool": "automations.update",
"tags": [],
"reasons": {}
},
{
"tool": "automations.delete",
"tags": [],
"reasons": {}
},
{
"tool": "automations.trigger",
"tags": [],
"reasons": {}
},
{
"tool": "automations.statsExecutions",
"tags": [],
"reasons": {}
},
{
"tool": "automations.statsTrends",
"tags": [],
"reasons": {}
},
{
"tool": "automations.statsStatistics",
"tags": [],
"reasons": {}
},
{
"tool": "automations.statsSummary",
"tags": [],
"reasons": {}
},
{
"tool": "automations.listExecutions",
"tags": [],
"reasons": {}
},
{
"tool": "automations.replayExecution",
"tags": [],
"reasons": {}
},
{
"tool": "releases.list",
"tags": [],
"reasons": {}
},
{
"tool": "releases.create",
"tags": [],
"reasons": {}
},
{
"tool": "releases.get",
"tags": [],
"reasons": {}
},
{
"tool": "releases.update",
"tags": [],
"reasons": {}
},
{
"tool": "releases.delete",
"tags": [],
"reasons": {}
},
{
"tool": "releases.commit",
"tags": [],
"reasons": {}
},
{
"tool": "releases.cancel",
"tags": [],
"reasons": {}
},
{
"tool": "releases.publish",
"tags": [],
"reasons": {}
},
{
"tool": "releases.assignVersion",
"tags": [],
"reasons": {}
},
{
"tool": "releases.removeVersion",
"tags": [],
"reasons": {}
},
{
"tool": "ai.availableModels",
"tags": [],
"reasons": {}
},
{
"tool": "ai.metaTags",
"tags": [],
"reasons": {}
},
{
"tool": "ai.translate",
"tags": [],
"reasons": {}
},
{
"tool": "provider.getStats",
"tags": [],
"reasons": {}
},
{
"tool": "provider.listNotes",
"tags": [],
"reasons": {}
},
{
"tool": "provider.createNote",
"tags": [],
"reasons": {}
},
{
"tool": "provider.getNote",
"tags": [],
"reasons": {}
},
{
"tool": "provider.updateNote",
"tags": [],
"reasons": {}
},
{
"tool": "provider.deleteNote",
"tags": [],
"reasons": {}
},
{
"tool": "icons.tags",
"tags": [],
"reasons": {}
},
{
"tool": "assetTags.assign",
"tags": [],
"reasons": {}
},
{
"tool": "redirects.reset",
"tags": [],
"reasons": {}
},
{
"tool": "tokens.list",
"tags": [],
"reasons": {}
},
{
"tool": "tokens.create",
"tags": [],
"reasons": {}
},
{
"tool": "tokens.delete",
"tags": [],
"reasons": {}
},
{
"tool": "dataSources.entries.list",
"tags": [],
"reasons": {}
},
{
"tool": "dataSources.entries.create",
"tags": [],
"reasons": {}
},
{
"tool": "dataSources.entries.get",
"tags": [],
"reasons": {}
},
{
"tool": "dataSources.entries.update",
"tags": [],
"reasons": {}
},
{
"tool": "dataSources.entries.delete",
"tags": [],
"reasons": {}
},
{
"tool": "assetCollections.list",
"tags": [],
"reasons": {}
},
{
"tool": "assetCollections.create",
"tags": [],
"reasons": {}
},
{
"tool": "assetCollections.get",
"tags": [],
"reasons": {}
},
{
"tool": "assetCollections.update",
"tags": [],
"reasons": {}
},
{
"tool": "assetCollections.delete",
"tags": [],
"reasons": {}
},
{
"tool": "assetCollections.listAssets",
"tags": [],
"reasons": {}
},
{
"tool": "assetCollections.addAssets",
"tags": [],
"reasons": {}
},
{
"tool": "assetCollections.removeAssets",
"tags": [],
"reasons": {}
},
{
"tool": "assetCollections.reorderAssets",
"tags": [],
"reasons": {}
},
{
"tool": "assetShares.list",
"tags": [],
"reasons": {}
},
{
"tool": "assetShares.create",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"download\""
]
}
},
{
"tool": "assetShares.get",
"tags": [],
"reasons": {}
},
{
"tool": "assetShares.update",
"tags": [],
"reasons": {}
},
{
"tool": "assetShares.delete",
"tags": [],
"reasons": {}
},
{
"tool": "assetShares.revoke",
"tags": [],
"reasons": {}
},
{
"tool": "assetPackages.list",
"tags": [],
"reasons": {}
},
{
"tool": "assetPackages.create",
"tags": [],
"reasons": {}
},
{
"tool": "assetPackages.get",
"tags": [],
"reasons": {}
},
{
"tool": "assetPackages.delete",
"tags": [],
"reasons": {}
},
{
"tool": "assetPackages.download",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"download\""
]
}
},
{
"tool": "shares.get",
"tags": [],
"reasons": {}
},
{
"tool": "shares.unlock",
"tags": [],
"reasons": {}
},
{
"tool": "shares.listAssets",
"tags": [],
"reasons": {}
},
{
"tool": "shares.download",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"download\""
]
}
},
{
"tool": "shares.downloadAsset",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"download\""
]
}
},
{
"tool": "assets.listVersions",
"tags": [],
"reasons": {}
},
{
"tool": "assets.restoreVersion",
"tags": [],
"reasons": {}
},
{
"tool": "assets.linkedContents",
"tags": [],
"reasons": {}
},
{
"tool": "assets.export",
"tags": [],
"reasons": {}
},
{
"tool": "notifications.list",
"tags": [],
"reasons": {}
},
{
"tool": "notifications.unreadCount",
"tags": [],
"reasons": {}
},
{
"tool": "notifications.markRead",
"tags": [],
"reasons": {}
},
{
"tool": "notifications.markUnread",
"tags": [],
"reasons": {}
},
{
"tool": "notifications.markAllRead",
"tags": [],
"reasons": {}
},
{
"tool": "notifications.delete",
"tags": [],
"reasons": {}
},
{
"tool": "notifications.deleteRead",
"tags": [],
"reasons": {}
},
{
"tool": "notifications.deleteAll",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.usage",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.usageHistory",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.usageTimeseries",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.listInvoices",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.updateOnboarding",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.getMigration",
"tags": [],
"reasons": {}
},
{
"tool": "spaces.deleteMigration",
"tags": [],
"reasons": {}
},
{
"tool": "contents.export",
"tags": [],
"reasons": {}
},
{
"tool": "system.plans",
"tags": [],
"reasons": {}
},
{
"tool": "system.authorization",
"tags": [],
"reasons": {}
},
{
"tool": "system.spaceBlueprints",
"tags": [],
"reasons": {}
},
{
"tool": "system.getInvite",
"tags": [],
"reasons": {}
},
{
"tool": "ai.models",
"tags": [],
"reasons": {}
},
{
"tool": "ai.contentInteraction",
"tags": [],
"reasons": {}
},
{
"tool": "ai.contentTreeInteraction",
"tags": [],
"reasons": {}
},
{
"tool": "teams.listMembers",
"tags": [],
"reasons": {}
},
{
"tool": "teams.updateMember",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "0e7ba7f28d3c764d86643b71f0eb899c576274c3926c4988485983db27aadec6",
"stats": {
"tools": 200,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 2,
"medium": 0,
"low": 0,
"info": 0
}
}
}