Hamravesh MCP Server
hamravesh-mcp
npm
v0.1.6
Published by bakhtarimohammad — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
MCP server for the Hamravesh / Darkube console API — manage apps, deploys, databases, registries and billing from any MCP client (Claude, etc.).
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 15.3 = 85. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −15.3 | Hidden zero-width / joiner character in description ×28 MTC-UNI-005 | injection |
2. Client adoption risk — 85 − 4 = 81. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 28
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 2 zero-width / joiner character character(s) in the description of tool "hamravesh_whoami". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 2× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_whoami · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_list_apps". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_list_apps · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_app_logs". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_app_logs · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_app_manifests". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_app_manifests · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_app_builds". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_app_builds · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 2 zero-width / joiner character character(s) in the description of tool "hamravesh_list_databases". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 2× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_list_databases · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_get_database". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_get_database · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_database_credentials". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_database_credentials · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_create_database". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_create_database · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_delete_database". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_delete_database · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 2 zero-width / joiner character character(s) in the description of tool "hamravesh_list_registries". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 2× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_list_registries · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_list_loadbalancers". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_list_loadbalancers · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 2 zero-width / joiner character character(s) in the description of tool "hamravesh_list_marketplace_products". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 2× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_list_marketplace_products · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 3 zero-width / joiner character character(s) in the description of tool "hamravesh_list_saas". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 3× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_list_saas · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_get_saas". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_get_saas · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_create_saas". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_create_saas · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 2 zero-width / joiner character character(s) in the description of tool "hamravesh_billing". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 2× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_billing · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 2 zero-width / joiner character character(s) in the description of tool "hamravesh_invoices". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 2× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_invoices · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 3 zero-width / joiner character character(s) in the description of tool "hamravesh_restart_app". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 3× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_restart_app · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_scale_app". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_scale_app · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_set_hpa". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_set_hpa · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_update_app_envs". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_update_app_envs · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_update_app". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_update_app · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_create_app". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_create_app · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_delete_app". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_delete_app · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_create_apikey". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_create_apikey · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_delete_apikey". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_delete_apikey · description
medium Hidden zero-width / joiner character in descriptionMTC-UNI-005
Found 1 zero-width / joiner character character(s) in the description of tool "hamravesh_request". These are invisible to a human reviewer but are read verbatim by the model.
Evidence: 1× zero-width
Fix: Reject or normalize server metadata containing invisible/smuggling characters. Legitimate tool descriptions do not need them.
Location: tool hamravesh_request · description
Tools 37
Each tool and what it can reach — statically extracted from the published source.
hamravesh_update_app_envsreads sensitive datahamravesh_app_buildsno sensitive capabilityhamravesh_app_containersno sensitive capabilityhamravesh_app_logsno sensitive capabilityhamravesh_app_manifestsno sensitive capabilityhamravesh_app_metricsno sensitive capabilityhamravesh_billingno sensitive capabilityhamravesh_create_apikeyno sensitive capabilityhamravesh_create_appno sensitive capabilityhamravesh_create_databaseno sensitive capability
Show 27 more tools ↓
hamravesh_create_saasno sensitive capabilityhamravesh_database_credentialsno sensitive capabilityhamravesh_database_insightno sensitive capabilityhamravesh_database_powerno sensitive capabilityhamravesh_delete_apikeyno sensitive capabilityhamravesh_delete_appno sensitive capabilityhamravesh_delete_databaseno sensitive capabilityhamravesh_get_appno sensitive capabilityhamravesh_get_databaseno sensitive capabilityhamravesh_get_saasno sensitive capabilityhamravesh_invoicesno sensitive capabilityhamravesh_list_apikeysno sensitive capabilityhamravesh_list_appsno sensitive capabilityhamravesh_list_databasesno sensitive capabilityhamravesh_list_loadbalancersno sensitive capabilityhamravesh_list_marketplace_productsno sensitive capabilityhamravesh_list_registriesno sensitive capabilityhamravesh_list_saasno sensitive capabilityhamravesh_redeploy_appno sensitive capabilityhamravesh_requestno sensitive capabilityhamravesh_restart_appno sensitive capabilityhamravesh_scale_appno sensitive capabilityhamravesh_set_app_enabledno sensitive capabilityhamravesh_set_basic_authno sensitive capabilityhamravesh_set_hpano sensitive capabilityhamravesh_update_appno sensitive capabilityhamravesh_whoamino sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (37 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.1.6 latest |
B 81/100 | 28 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan hamravesh-mcp --onlineMore in Cloud & DevOps
Operator control CLI for AdGuard Home with an MCP adapter
interacting with Aliyun (Alibaba Cloud) services through This MCP server provides tools.
MCP server for the Aspro.Cloud REST API
MCP server for Atlassian Confluence and Jira Cloud APIs
AuroraCloud-first MCP server that exposes AuroraDocs workspace data to Claude Desktop and other AI agents
The official AWS Knowledge Base retrieval server using Bedrock Agent Runtime.