Dke Forge MCP Server
dke-forge
PyPI
v0.25.0
Published by an unidentified publisher — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 5 = 95. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −2 | publisher verification (unlinked) — no provenance/repo link, but the shipped source was fully read |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 0
Tools 63
Each tool and what it can reach — statically extracted from the published source.
forge_get_graphingests untrusted inputforge_abstractionsno sensitive capabilityforge_amend_ruleno sensitive capabilityforge_api_surfaceno sensitive capabilityforge_architecture_mapno sensitive capabilityforge_audit_changesno sensitive capabilityforge_auth_verifyno sensitive capabilityforge_breaking_changeno sensitive capabilityforge_callees_ofno sensitive capabilityforge_callers_ofno sensitive capability
Show 53 more tools ↓
forge_callgraph_reachableno sensitive capabilityforge_check_rulesno sensitive capabilityforge_circular_depsno sensitive capabilityforge_classify_effectsno sensitive capabilityforge_commit_impactno sensitive capabilityforge_contract_checkno sensitive capabilityforge_contradictionsno sensitive capabilityforge_contradictions_hypotheticalno sensitive capabilityforge_create_graphno sensitive capabilityforge_dead_codeno sensitive capabilityforge_declareno sensitive capabilityforge_declare_ruleno sensitive capabilityforge_delete_graphno sensitive capabilityforge_depends_onno sensitive capabilityforge_deprecation_pathno sensitive capabilityforge_effect_behavioralno sensitive capabilityforge_effectsno sensitive capabilityforge_effects_classificationno sensitive capabilityforge_envelopeno sensitive capabilityforge_find_implementersno sensitive capabilityforge_god_classesno sensitive capabilityforge_graph_statsno sensitive capabilityforge_healthno sensitive capabilityforge_impact_analysisno sensitive capabilityforge_invitation_previewno sensitive capabilityforge_invitation_resendno sensitive capabilityforge_last_modifiedno sensitive capabilityforge_learn_patternsno sensitive capabilityforge_list_graphsno sensitive capabilityforge_live_varsno sensitive capabilityforge_module_topologyno sensitive capabilityforge_pattern_catalogno sensitive capabilityforge_pattern_detailno sensitive capabilityforge_patternsno sensitive capabilityforge_promote_default_graphno sensitive capabilityforge_provenanceno sensitive capabilityforge_query_functionno sensitive capabilityforge_reach_coneno sensitive capabilityforge_reach_fromno sensitive capabilityforge_reaching_defsno sensitive capabilityforge_reason_chainno sensitive capabilityforge_reasoning_traceno sensitive capabilityforge_refactor_previewno sensitive capabilityforge_refineno sensitive capabilityforge_rename_graphno sensitive capabilityforge_retire_ruleno sensitive capabilityforge_reviewno sensitive capabilityforge_risky_changeno sensitive capabilityforge_rulesno sensitive capabilityforge_subgraphno sensitive capabilityforge_taintno sensitive capabilityforge_type_flowno sensitive capabilityforge_use_defno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (63 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.25.0 latest |
A 95/100 | 0 | 1.9.0 | 2026-07-23 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan dke-forge --online --registry pypiMore in Developer Tools
Security scan results for the 1stay MCP server.
Security scan results for the Adguard Home MCP server.
Security scan results for the Ado Browser MCP server.
Security scan results for the Adobe Experience Dev MCP server.
Security scan results for the Aemet MCP server.
Security scan results for the Affinity Mcp Bridge MCP server.