Memoir Cli — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.13.0",
"methodologyVersion": "mcptrustchecker-1.13"
},
"target": {
"id": "memoir-cli",
"source": {
"kind": "package",
"origin": "memoir-cli"
},
"server": {
"name": "memoir-cli"
}
},
"grade": "A",
"score": {
"score": 93,
"threatScore": 99,
"grade": "A",
"band": "A",
"categorySubtotals": {
"injection": 0,
"exfiltration": 1.2,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "threat",
"ruleId": "MTC-SRC-008",
"category": "exfiltration",
"severity": "low",
"confidence": "heuristic",
"rawWeight": 3,
"confidenceMult": 0.4,
"diminishingFactor": 1,
"appliedPenalty": 1.2
},
{
"kind": "client",
"term": "capability-exposure",
"level": "high",
"label": "capability blast radius (high) — client exposure if the model is manipulated",
"appliedPenalty": 6
},
{
"kind": "client",
"term": "verification-discount",
"level": "source",
"label": "publisher verification (provenance) — cryptographic build provenance ties the artifact to its source",
"appliedPenalty": 0
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.13"
},
"capability": {
"level": "high",
"reasons": [
"can send data / act on an external service",
"reads sensitive or local data",
"has a read → egress path (a data-exfiltration surface)",
"can execute shell commands or code"
],
"tags": [
"sensitive-source",
"code-exec",
"external-sink"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (20 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (src/work/store.js)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/work/store.js:232`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/work/store.js"
},
"evidence": "\\..*)?|credentials[^/]*|id_rsa|id_ed25519)$|\\.(pem|key)$/i.test(rel)) throw new Error('Private/configuration secrets and",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "src/work/store.js",
"line": 232,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (src/workspace/tracker.js)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/workspace/tracker.js:12`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/workspace/tracker.js"
},
"evidence": "ials[^/]*|secrets?[^/]*|id_rsa|id_ed25519)$|\\.(pem|key|p12|pfx)$/i; // Explicit opt-in captures only the active project",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "src/workspace/tracker.js",
"line": 12,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (bin/memoir.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`bin/memoir.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "bin/memoir.js"
},
"evidence": "} = await import('node:child_process'); const { fileURLToPath } = await import('node:url'); const result = spawnSyn",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "bin/memoir.js",
"line": 4,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (evals/retrieval-performance.mjs)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`evals/retrieval-performance.mjs:9`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "evals/retrieval-performance.mjs"
},
"evidence": "ecFileSync } from 'node:child_process'; const args = process.argv.slice(2); const option = (key, fallback) => { const i",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "evals/retrieval-performance.mjs",
"line": 9,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/commands/autopush.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/commands/autopush.js:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/commands/autopush.js"
},
"evidence": "import { spawn } from 'child_process'; import { withSessionLock } from '../session/lock.js'; const home = os.homedir()",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/commands/autopush.js",
"line": 15,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/commands/diff.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/commands/diff.js:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/commands/diff.js"
},
"evidence": "c, execFileSync } from 'child_process'; import { getConfig } from '../config.js'; import { adapters } from '../adapters/",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/commands/diff.js",
"line": 7,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/commands/doctor.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/commands/doctor.js:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/commands/doctor.js"
},
"evidence": "c, execFileSync } from 'child_process'; import { getConfig } from '../config.js'; import { adapters } from '../adapters/",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/commands/doctor.js",
"line": 8,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/commands/init.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/commands/init.js:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/commands/init.js"
},
"evidence": "{ execFileSync } from 'child_process'; import { saveConfig } from '../config.js'; import { pushCommand } from './push.j",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/commands/init.js",
"line": 5,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/commands/profile.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/commands/profile.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/commands/profile.js"
},
"evidence": "{ execFileSync } from 'child_process'; import { getRawConfig, listProfiles, getActiveProfileName, createProfile, sw",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/commands/profile.js",
"line": 4,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/commands/projects.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/commands/projects.js:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/commands/projects.js"
},
"evidence": "{ execFileSync } from 'child_process'; const home = os.homedir(); const TODOS_PATH = path.join(home, '.config', 'memoi",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/commands/projects.js",
"line": 6,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/commands/push.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/commands/push.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/commands/push.js"
},
"evidence": "{ execFileSync } from 'child_process'; import { getConfig, autoSetup } from '../config.js'; import { extractMemories, a",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/commands/push.js",
"line": 10,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/commands/upgrade.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/commands/upgrade.js:27`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/commands/upgrade.js"
},
"evidence": "{ execFile } = require('child_process'); const platform = process.platform; const [cmd, args] = platform === 'darwin",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/commands/upgrade.js",
"line": 27,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (bin/memoir.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`bin/memoir.js:62`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "bin/memoir.js"
},
"evidence": "; const res = await fetch('https://registry.npmjs.org/memoir-cli/latest', { signal: controller.signal }); clearT",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "bin/memoir.js",
"line": 62,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (src/commands/consolidate.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`src/commands/consolidate.js:183`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/commands/consolidate.js"
},
"evidence": "const response = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent?key=${ap",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "src/commands/consolidate.js",
"line": 183,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (src/commands/snapshot.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`src/commands/snapshot.js:250`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/commands/snapshot.js"
},
"evidence": "const response = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "src/commands/snapshot.js",
"line": 250,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-008",
"title": "Hardcoded JSON Web Token in server code (src/cloud/constants.js)",
"category": "exfiltration",
"severity": "low",
"confidence": "heuristic",
"description": "A hardcoded JSON Web Token (a public-by-design (anon/publishable) key — RLS, not secrecy, protects it) appears in `src/cloud/constants.js:2`. Verify whether this is a real credential; if so, remove and rotate it.",
"remediation": "Remove the secret, rotate it, and load credentials from the environment or a secret store.",
"location": {
"kind": "server",
"name": "src/cloud/constants.js"
},
"evidence": "JSON Web Token: eyJh…(redacted)",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"secretType": "jwt",
"file": "src/cloud/constants.js",
"line": 2
}
}
],
"toxicFlows": [],
"capabilities": [
{
"tool": "memoir_status",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_recall",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_remember",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_list",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_read",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_profiles",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_consolidate",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_set_goal",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_add_next",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_complete_next",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_note",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_ask",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_session",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_why",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_forget",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_resume",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_work_resume",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_work_record",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_work_check",
"tags": [],
"reasons": {}
},
{
"tool": "memoir_work_retract",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "2f67e8bd7b5fc61728bc8dc9557d66e32105bcb604f3a48ebdaa531ae1b408d7",
"stats": {
"tools": 20,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 12,
"medium": 3,
"low": 1,
"info": 0
}
}
}