Ituran MCP Server
ituran-mcp
npm
v4.2.0
Published by ituranlabs — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
Stdio MCP server exposing the Ituran Global V2 API as MCP tools. Mints and refreshes its own access tokens via identity-server-v1 from credentials in env vars; tokens never reach the LLM.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 7 = 93. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 1
high Shell/command execution in server code (start.js)MTC-SRC-002
In the server's implementation (`start.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: rt { spawn } from "node:child_process"; import { existsSync } from "node:fs"; import { dirname, join } from "node:path";
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server start.js
Tools 152
Each tool and what it can reach — statically extracted from the published source.
ituran_alerts_getingests untrusted inputituran_commands_sendingests untrusted inputituran_drive_permission_groups_deleteingests untrusted inputituran_drive_permission_groups_updateingests untrusted inputituran_drivers_listingests untrusted inputituran_drivers_searchingests untrusted inputituran_exports_status_listingests untrusted inputituran_groups_combineingests untrusted inputituran_groups_listingests untrusted inputituran_places_deleteingests untrusted input
Show 142 more tools ↓
ituran_places_updateingests untrusted inputituran_select_topingests untrusted inputituran_vehicle_groups_deleteingests untrusted inputituran_vehicle_groups_listingests untrusted inputituran_vehicles_listingests untrusted inputituran_advanced_alerts_listno sensitive capabilityituran_advanced_relations_entitiesno sensitive capabilityituran_alerts_createno sensitive capabilityituran_alerts_custom_listno sensitive capabilityituran_alerts_custom_updateno sensitive capabilityituran_alerts_deleteno sensitive capabilityituran_alerts_listno sensitive capabilityituran_alerts_updateno sensitive capabilityituran_anti_idling_zonesno sensitive capabilityituran_battery_voltage_motion_reportno sensitive capabilityituran_bi_groupsno sensitive capabilityituran_claim_evidenceno sensitive capabilityituran_commands_listno sensitive capabilityituran_commands_start_trackingno sensitive capabilityituran_commands_statusno sensitive capabilityituran_commands_update_keyboardno sensitive capabilityituran_contacts_createno sensitive capabilityituran_contacts_deleteno sensitive capabilityituran_contacts_listno sensitive capabilityituran_contacts_searchno sensitive capabilityituran_contacts_updateno sensitive capabilityituran_cost_center_usage_reportno sensitive capabilityituran_diagnostics_historyno sensitive capabilityituran_diagnostics_lastno sensitive capabilityituran_drive_permission_groups_createno sensitive capabilityituran_drive_permission_groups_listno sensitive capabilityituran_driver_attributionno sensitive capabilityituran_driver_coaching_briefno sensitive capabilityituran_driver_registry_auditno sensitive capabilityituran_driver_workforce_screenno sensitive capabilityituran_drivers_getno sensitive capabilityituran_ev_overnight_charge_boardno sensitive capabilityituran_event_definition_typesno sensitive capabilityituran_event_definitions_listno sensitive capabilityituran_events_listno sensitive capabilityituran_events_over_speedingno sensitive capabilityituran_events_statsno sensitive capabilityituran_events_vehiclesno sensitive capabilityituran_exports_status_getno sensitive capabilityituran_find_vehicleno sensitive capabilityituran_fleet_activity_reportno sensitive capabilityituran_fleet_summaryno sensitive capabilityituran_fleet_trendsno sensitive capabilityituran_fuel_efficiency_reportno sensitive capabilityituran_fuel_guardno sensitive capabilityituran_group_getno sensitive capabilityituran_guard_tour_reportno sensitive capabilityituran_inactivity_explanation_reportno sensitive capabilityituran_info_distributor_service_centersno sensitive capabilityituran_info_ituran_service_centersno sensitive capabilityituran_itc_exception_statsno sensitive capabilityituran_itc_sensor_settingsno sensitive capabilityituran_itc_temperature_exceptionsno sensitive capabilityituran_itc_temperature_reportno sensitive capabilityituran_itc_temperatures_currentno sensitive capabilityituran_maintenance_dueno sensitive capabilityituran_maintenance_treatmentsno sensitive capabilityituran_maintenance_typesno sensitive capabilityituran_motor_pool_balanceno sensitive capabilityituran_place_dwell_evidenceno sensitive capabilityituran_place_visitorsno sensitive capabilityituran_places_createno sensitive capabilityituran_places_listno sensitive capabilityituran_places_statsno sensitive capabilityituran_places_vehicles_insideno sensitive capabilityituran_preparation_time_reportno sensitive capabilityituran_pto_billing_reportno sensitive capabilityituran_push_alerts_searchno sensitive capabilityituran_recurring_stop_candidatesno sensitive capabilityituran_reports_bi_daily_driversno sensitive capabilityituran_reports_bi_daily_vehiclesno sensitive capabilityituran_reports_bi_driver_timesheet_crosscheckno sensitive capabilityituran_reports_bi_idle_driversno sensitive capabilityituran_reports_bi_idle_vehiclesno sensitive capabilityituran_reports_bi_periodic_driversno sensitive capabilityituran_reports_bi_periodic_vehiclesno sensitive capabilityituran_reports_diagnosticsno sensitive capabilityituran_reports_engine_activityno sensitive capabilityituran_reports_eventsno sensitive capabilityituran_reports_fullno sensitive capabilityituran_reports_heatmapno sensitive capabilityituran_reports_overnight_parkingno sensitive capabilityituran_reports_speedno sensitive capabilityituran_reports_stop_productivityno sensitive capabilityituran_return_to_base_reportno sensitive capabilityituran_safety_driversno sensitive capabilityituran_safety_eco_driver_scoreboardno sensitive capabilityituran_safety_exposure_rankno sensitive capabilityituran_safety_groupsno sensitive capabilityituran_safety_hotspotsno sensitive capabilityituran_safety_periodicno sensitive capabilityituran_safety_rank_driversno sensitive capabilityituran_safety_risk_exposureno sensitive capabilityituran_safety_totalsno sensitive capabilityituran_safety_ubi_driversno sensitive capabilityituran_safety_ubi_vehiclesno sensitive capabilityituran_safety_vehiclesno sensitive capabilityituran_saved_place_vehicle_overlapno sensitive capabilityituran_select_by_diagnosticno sensitive capabilityituran_select_vehiclesno sensitive capabilityituran_select_vehicles_in_placeno sensitive capabilityituran_service_territory_reportno sensitive capabilityituran_service_visit_reportno sensitive capabilityituran_site_speedingno sensitive capabilityituran_speed_offendersno sensitive capabilityituran_trips_getno sensitive capabilityituran_trips_longest_forensicsno sensitive capabilityituran_trips_over_speedingno sensitive capabilityituran_trips_pointsno sensitive capabilityituran_trips_safetyno sensitive capabilityituran_trips_searchno sensitive capabilityituran_trips_statsno sensitive capabilityituran_trips_totalsno sensitive capabilityituran_users_meno sensitive capabilityituran_utilization_reportno sensitive capabilityituran_vehicle_alerts_createno sensitive capabilityituran_vehicle_alerts_deleteno sensitive capabilityituran_vehicle_alerts_listno sensitive capabilityituran_vehicle_alerts_updateno sensitive capabilityituran_vehicle_groups_createno sensitive capabilityituran_vehicle_groups_getno sensitive capabilityituran_vehicle_groups_patchno sensitive capabilityituran_vehicle_groups_updateno sensitive capabilityituran_vehicle_maintenanceno sensitive capabilityituran_vehicle_saved_place_visitsno sensitive capabilityituran_vehicle_snapshotno sensitive capabilityituran_vehicles_getno sensitive capabilityituran_vehicles_get_current_driverno sensitive capabilityituran_vehicles_get_locationno sensitive capabilityituran_vehicles_locate_manyno sensitive capabilityituran_vehicles_maintenanceno sensitive capabilityituran_vehicles_over_speedingno sensitive capabilityituran_vehicles_searchno sensitive capabilityituran_vehicles_share_driveno sensitive capabilityituran_virtual_odometerno sensitive capabilityituran_wear_sensor_boardno sensitive capabilityituran_working_hours_screenno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (152 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 3
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v4.2.0 latest |
A 93/100 | 1 | 1.13.0 | 2026-09-07 |
v4.1.0 |
A 93/100 | 1 | 1.12.1 | 2026-07-27 |
v4.0.0 |
C 78/100 | 2 | 1.10.0 | 2026-07-25 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan ituran-mcp --onlineMore in Other
A Model Context Protocol server implementation for AdGuard Home that enables AI agents to query and manage DNS records, filtering rules and more
Identity oracle and trust layer for autonomous AI agents. Bidirectional KYA and trust scoring.
MCP server with Airtable integration
A free one-minute reset for people, delivered by AI, with no account or personal data.
Access SEC filings efficiently, save time and tokens, and get cited answers.
A smart [MCP](https://modelcontextprotocol.io) server for [AniList](https://anilist.co) that gets your anime/manga taste - not just API calls.