Edgegate MCP Server
edgegate-mcp
npm
v0.18.0
Published by an unidentified publisher — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 8 = 92. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −2 | publisher verification (unlinked) — no provenance/repo link, but the shipped source was fully read |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 13
high Tool "edgegate_list_eval_packs" exposes command/code executionMTC-CAP-001
Tool "edgegate_list_eval_packs" appears to run shell commands or evaluate code (keyword "eval" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool edgegate_list_eval_packs
high Tool "edgegate_create_eval_set" exposes command/code executionMTC-CAP-001
Tool "edgegate_create_eval_set" appears to run shell commands or evaluate code (keyword "eval" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool edgegate_create_eval_set
high Tool "edgegate_list_eval_sets" exposes command/code executionMTC-CAP-001
Tool "edgegate_list_eval_sets" appears to run shell commands or evaluate code (keyword "eval" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool edgegate_list_eval_sets
high Tool "edgegate_update_eval_set" exposes command/code executionMTC-CAP-001
Tool "edgegate_update_eval_set" appears to run shell commands or evaluate code (keyword "eval" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool edgegate_update_eval_set
high Tool "edgegate_publish_eval_set" exposes command/code executionMTC-CAP-001
Tool "edgegate_publish_eval_set" appears to run shell commands or evaluate code (keyword "eval" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool edgegate_publish_eval_set
high Tool "edgegate_new_eval_set_version" exposes command/code executionMTC-CAP-001
Tool "edgegate_new_eval_set_version" appears to run shell commands or evaluate code (keyword "eval" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool edgegate_new_eval_set_version
medium Untrusted input can drive an external actionMTC-FLOW-005
Untrusted-input tools ([edgegate_export_run_report, edgegate_get_byo_audit]) co-exist with external-action tools ([edgegate_list_eval_packs, edgegate_create_eval_set, edgegate_list_eval_sets, edgegate_update_eval_set, edgegate_publish_eval_set, edgegate_new_eval_set_version]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.
Evidence: untrusted [edgegate_export_run_report, edgegate_get_byo_audit] → sinks [edgegate_list_eval_packs, edgegate_create_eval_set, edgegate_list_eval_sets, edgegate_up
Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.
Location: flow edgegate_export_run_report → edgegate_list_eval_packs
low Mutating tool "edgegate_list_eval_packs" declares no destructiveHintMTC-CAP-005
Tool "edgegate_list_eval_packs" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool edgegate_list_eval_packs
low Mutating tool "edgegate_create_eval_set" declares no destructiveHintMTC-CAP-005
Tool "edgegate_create_eval_set" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool edgegate_create_eval_set
low Mutating tool "edgegate_list_eval_sets" declares no destructiveHintMTC-CAP-005
Tool "edgegate_list_eval_sets" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool edgegate_list_eval_sets
low Mutating tool "edgegate_update_eval_set" declares no destructiveHintMTC-CAP-005
Tool "edgegate_update_eval_set" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool edgegate_update_eval_set
low Mutating tool "edgegate_publish_eval_set" declares no destructiveHintMTC-CAP-005
Tool "edgegate_publish_eval_set" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool edgegate_publish_eval_set
low Mutating tool "edgegate_new_eval_set_version" declares no destructiveHintMTC-CAP-005
Tool "edgegate_new_eval_set_version" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool edgegate_new_eval_set_version
Tools 58
Each tool and what it can reach — statically extracted from the published source.
edgegate_create_eval_setruns code / shelledgegate_export_run_reportingests untrusted inputedgegate_get_byo_auditingests untrusted inputedgegate_list_eval_packsruns code / shelledgegate_list_eval_setsruns code / shelledgegate_new_eval_set_versionruns code / shelledgegate_publish_eval_setruns code / shelledgegate_update_eval_setruns code / shelledgegate_attach_byo_roleno sensitive capabilityedgegate_cancel_runno sensitive capability
Show 48 more tools ↓
edgegate_capture_referenceno sensitive capabilityedgegate_change_member_roleno sensitive capabilityedgegate_check_byo_bucketno sensitive capabilityedgegate_check_genie_compile_statusno sensitive capabilityedgegate_check_llm_compile_statusno sensitive capabilityedgegate_check_reference_capture_statusno sensitive capabilityedgegate_check_statusno sensitive capabilityedgegate_compare_runsno sensitive capabilityedgegate_compile_genieno sensitive capabilityedgegate_connect_huggingfaceno sensitive capabilityedgegate_connect_qaihubno sensitive capabilityedgegate_create_api_keyno sensitive capabilityedgegate_create_bg_runno sensitive capabilityedgegate_create_pipelineno sensitive capabilityedgegate_create_promptpackno sensitive capabilityedgegate_create_workspaceno sensitive capabilityedgegate_disconnect_byo_bucketno sensitive capabilityedgegate_disconnect_huggingfaceno sensitive capabilityedgegate_disconnect_qaihubno sensitive capabilityedgegate_export_compliance_reportno sensitive capabilityedgegate_export_field_recorder_reportno sensitive capabilityedgegate_get_audit_reportno sensitive capabilityedgegate_get_huggingface_integrationno sensitive capabilityedgegate_get_qaihub_integrationno sensitive capabilityedgegate_get_reportno sensitive capabilityedgegate_import_huggingface_modelno sensitive capabilityedgegate_invite_memberno sensitive capabilityedgegate_list_api_keysno sensitive capabilityedgegate_list_device_targetsno sensitive capabilityedgegate_list_devicesno sensitive capabilityedgegate_list_membersno sensitive capabilityedgegate_list_promptpacksno sensitive capabilityedgegate_llm_compileno sensitive capabilityedgegate_predict_npu_coverageno sensitive capabilityedgegate_publish_promptpackno sensitive capabilityedgegate_recorder_statusno sensitive capabilityedgegate_register_byo_artifactno sensitive capabilityedgegate_register_byo_bucketno sensitive capabilityedgegate_remove_memberno sensitive capabilityedgegate_rerun_bgno sensitive capabilityedgegate_revoke_api_keyno sensitive capabilityedgegate_run_device_benchmarkno sensitive capabilityedgegate_run_gateno sensitive capabilityedgegate_setup_bg_github_actionno sensitive capabilityedgegate_setup_byo_storageno sensitive capabilityedgegate_setup_github_actionno sensitive capabilityedgegate_setup_workspaceno sensitive capabilityedgegate_trigger_replayno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (58 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.18.0 latest |
A 92/100 | 13 | 1.9.0 | 2026-07-24 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan edgegate-mcp --onlineMore in Developer Tools
Security scan results for the 1stay MCP server.
Security scan results for the Adguard Home MCP server.
Security scan results for the Ado Browser MCP server.
Security scan results for the Adobe Experience Dev MCP server.
Security scan results for the Aemet MCP server.
Security scan results for the Affinity Mcp Bridge MCP server.