Launchfast — the complete, unedited output of the deterministic mcptrustchecker engine v1.5.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.5.0",
"methodologyVersion": "mcptrustchecker-1.4"
},
"target": {
"id": "@launchfast/mcp",
"source": {
"kind": "package",
"origin": "@launchfast/mcp"
},
"server": {
"name": "@launchfast/mcp"
}
},
"grade": "A",
"score": {
"score": 100,
"grade": "A",
"band": "A",
"categorySubtotals": {
"injection": 0,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.4"
},
"capability": {
"level": "minimal",
"reasons": [],
"tags": []
},
"coverage": {
"level": "metadata",
"inputs": {
"toolSurface": false,
"implementationSource": false,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"No tools were enumerated, so prompt-injection, capability and toxic-flow analysis had no tool surface to inspect. To grade a package’s real runtime tools, scan the running server: --command \"npx -y <package>\".",
"The implementation source was not read — this reflects registry metadata only. Add --online to fetch and analyze the published package source."
]
},
"findings": [
{
"ruleId": "MTC-TOFU-004",
"title": "Published-source byte check did not run",
"category": "supply-chain",
"severity": "info",
"confidence": "heuristic",
"description": "An online scan was requested but the published artifact could not be downloaded, so the implementation source was NOT read and the byte-level integrity pin was NOT recorded. This scan reflects registry metadata only — treat it as incomplete, not as a clean bill of health.\n • artifact is 125 MB — over the 50 MB safety cap",
"remediation": "Re-run the scan when the registry/network is reachable to complete the source-level analysis.",
"location": {
"kind": "package",
"name": "@launchfast/mcp"
},
"evidence": "artifact is 125 MB — over the 50 MB safety cap"
}
],
"toxicFlows": [],
"capabilities": [],
"surfaceDigest": "07f03efc9eeee4887043af0fd6be65c2c7a165ea69c788ab7c96c01aaaebb41a",
"stats": {
"tools": 0,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"info": 1
}
}
}