Midas — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.13.0",
"methodologyVersion": "mcptrustchecker-1.13"
},
"target": {
"id": "midas-mcp",
"source": {
"kind": "package",
"origin": "midas-mcp"
},
"server": {
"name": "midas-mcp"
}
},
"grade": "B",
"score": {
"score": 81,
"threatScore": 88,
"grade": "B",
"band": "B",
"categorySubtotals": {
"injection": 11.66,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 1,
"appliedPenalty": 6.3
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.5,
"appliedPenalty": 3.15
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.25,
"appliedPenalty": 1.58
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "client",
"term": "capability-exposure",
"level": "high",
"label": "capability blast radius (high) — client exposure if the model is manipulated",
"appliedPenalty": 6
},
{
"kind": "client",
"term": "verification-discount",
"level": "repo",
"label": "publisher verification (public source) — no provenance, but the source is public and inspectable",
"appliedPenalty": 1
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.13"
},
"capability": {
"level": "high",
"reasons": [
"can send data / act on an external service",
"can execute shell commands or code"
],
"tags": [
"code-exec",
"external-sink"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (56 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/auth.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/auth.js:242`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/auth.js"
},
"evidence": "exec } = await import('child_process'); const openCmd = process.platform === 'darwin' ? 'open' :",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/auth.js",
"line": 242,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/claude-code.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/claude-code.js:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/claude-code.js"
},
"evidence": "execSync, spawn } from 'child_process'; import { existsSync } from 'fs'; import { homedir } from 'os'; import { join } f",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/claude-code.js",
"line": 7,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/cli.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/cli.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/cli.js"
},
"evidence": "port { execSync } from 'child_process'; import { loadState, setPhase } from './state/phase.js'; import { startProject }",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/cli.js",
"line": 3,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/cursor.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/cursor.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/cursor.js"
},
"evidence": "port { execSync } from 'child_process'; import { logger } from './logger.js'; // =======================================",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/cursor.js",
"line": 4,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/github-integration.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/github-integration.js:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/github-integration.js"
},
"evidence": "import { spawn } from 'child_process'; import { detectPhaseFromArtifacts } from './phase-detector.js'; import { sanitiz",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/github-integration.js",
"line": 12,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/phase-detector.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/phase-detector.js:32`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/phase-detector.js"
},
"evidence": "port { execSync } from 'child_process'; import { discoverDocsSync } from './docs-discovery.js'; import { getGatesStatus",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/phase-detector.js",
"line": 32,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/pilot.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/pilot.js:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/pilot.js"
},
"evidence": "import { spawn } from 'child_process'; import { randomBytes } from 'crypto'; import { isAuthenticated, getAuthenticated",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/pilot.js",
"line": 12,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/tools/cleanup.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/cleanup.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/cleanup.js"
},
"evidence": "port { execSync } from 'child_process'; import { sanitizePath, isShellSafe } from '../security.js'; import { logEvent }",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/tools/cleanup.js",
"line": 4,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/tools/completeness.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/completeness.js:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/completeness.js"
},
"evidence": "port { execSync } from 'child_process'; // ============================================================================",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/tools/completeness.js",
"line": 11,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/tools/grow.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/grow.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/grow.js"
},
"evidence": "port { execSync } from 'child_process'; import { sanitizePath } from '../security.js'; import { loadState, saveState, cr",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/tools/grow.js",
"line": 10,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/auth.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/auth.js:55`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/auth.js"
},
"evidence": "const response = await fetch('https://github.com/login/device/code', { method: 'POST', headers:",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/auth.js",
"line": 55,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/tools/vuln-scan.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/vuln-scan.js:434`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/vuln-scan.js"
},
"evidence": "const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(pkg)}`, { method: 'HEAD',",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/tools/vuln-scan.js",
"line": 434,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/auth.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/auth.js:245`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/auth.js"
},
"evidence": "'xdg-open'; exec(`${openCmd} ${flow.verificationUri}`); } catch { // Silent fail",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/auth.js",
"line": 245,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/cursor.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/cursor.js:109`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/cursor.js"
},
"evidence": "const result = execSync(`sqlite3 \"${dbPath}\" \"${query}\"`, { encoding: 'utf-8', maxBuffer: 50 * 1024 * 1024 } //",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/cursor.js",
"line": 109,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/tools/grow.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/grow.js:206`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/grow.js"
},
"evidence": "to; const log = execSync(`git log ${range} --pretty=format:\"%H|%s|%ai\" --no-merges`, { cwd: projectP",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/tools/grow.js",
"line": 206,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/tools/scope.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/scope.js:183`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/scope.js"
},
"evidence": "const filesAtStart = execSync(`git ls-tree -r --name-only ${firstCommit}`, { cwd: projectPath, encoding: 'utf8' })",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/tools/scope.js",
"line": 183,
"nonRuntime": false
}
}
],
"toxicFlows": [],
"capabilities": [
{
"tool": "midas_start_project",
"tags": [],
"reasons": {}
},
{
"tool": "midas_get_phase",
"tags": [],
"reasons": {}
},
{
"tool": "midas_set_phase",
"tags": [],
"reasons": {}
},
{
"tool": "midas_audit",
"tags": [],
"reasons": {}
},
{
"tool": "midas_check_docs",
"tags": [],
"reasons": {}
},
{
"tool": "midas_oneshot",
"tags": [],
"reasons": {}
},
{
"tool": "midas_tornado",
"tags": [],
"reasons": {}
},
{
"tool": "midas_horizon",
"tags": [],
"reasons": {}
},
{
"tool": "midas_analyze",
"tags": [],
"reasons": {}
},
{
"tool": "midas_suggest_prompt",
"tags": [],
"reasons": {}
},
{
"tool": "midas_advance_phase",
"tags": [],
"reasons": {}
},
{
"tool": "midas_journal_save",
"tags": [],
"reasons": {}
},
{
"tool": "midas_journal_list",
"tags": [],
"reasons": {}
},
{
"tool": "midas_journal_search",
"tags": [],
"reasons": {}
},
{
"tool": "midas_verify",
"tags": [],
"reasons": {}
},
{
"tool": "midas_smart_suggest",
"tags": [],
"reasons": {}
},
{
"tool": "midas_set_task",
"tags": [],
"reasons": {}
},
{
"tool": "midas_update_task",
"tags": [],
"reasons": {}
},
{
"tool": "midas_clear_task",
"tags": [],
"reasons": {}
},
{
"tool": "midas_record_error",
"tags": [],
"reasons": {}
},
{
"tool": "midas_record_fix",
"tags": [],
"reasons": {}
},
{
"tool": "midas_get_stuck",
"tags": [],
"reasons": {}
},
{
"tool": "midas_unstuck",
"tags": [],
"reasons": {}
},
{
"tool": "midas_get_provider",
"tags": [],
"reasons": {}
},
{
"tool": "midas_set_provider",
"tags": [],
"reasons": {}
},
{
"tool": "midas_set_api_key",
"tags": [],
"reasons": {}
},
{
"tool": "midas_list_providers",
"tags": [],
"reasons": {}
},
{
"tool": "midas_verify_deploy",
"tags": [],
"reasons": {}
},
{
"tool": "midas_changelog",
"tags": [],
"reasons": {}
},
{
"tool": "midas_retrospective",
"tags": [],
"reasons": {}
},
{
"tool": "midas_next_cycle",
"tags": [],
"reasons": {}
},
{
"tool": "midas_archive_cycle",
"tags": [],
"reasons": {}
},
{
"tool": "midas_cost_report",
"tags": [],
"reasons": {}
},
{
"tool": "midas_completeness",
"tags": [],
"reasons": {}
},
{
"tool": "midas_validate_gates",
"tags": [],
"reasons": {}
},
{
"tool": "midas_enforce_advance",
"tags": [],
"reasons": {}
},
{
"tool": "midas_show_example",
"tags": [],
"reasons": {}
},
{
"tool": "midas_validate_prd",
"tags": [],
"reasons": {}
},
{
"tool": "midas_validate_gameplan",
"tags": [],
"reasons": {}
},
{
"tool": "midas_validate_planning",
"tags": [],
"reasons": {}
},
{
"tool": "midas_start_hotfix",
"tags": [],
"reasons": {}
},
{
"tool": "midas_complete_hotfix",
"tags": [],
"reasons": {}
},
{
"tool": "midas_cancel_hotfix",
"tags": [],
"reasons": {}
},
{
"tool": "midas_hotfix_status",
"tags": [],
"reasons": {}
},
{
"tool": "midas_scan_debt",
"tags": [],
"reasons": {}
},
{
"tool": "midas_cleanup_suggestion",
"tags": [],
"reasons": {}
},
{
"tool": "midas_detect_project_type",
"tags": [],
"reasons": {}
},
{
"tool": "midas_check_scope_creep",
"tags": [],
"reasons": {}
},
{
"tool": "midas_set_scope_baseline",
"tags": [],
"reasons": {}
},
{
"tool": "midas_preflight",
"tags": [],
"reasons": {}
},
{
"tool": "midas_preflight_update",
"tags": [],
"reasons": {}
},
{
"tool": "midas_gameplan_analyze",
"tags": [],
"reasons": {}
},
{
"tool": "midas_gameplan_progress",
"tags": [],
"reasons": {}
},
{
"tool": "midas_complexity",
"tags": [],
"reasons": {}
},
{
"tool": "midas_simplify",
"tags": [],
"reasons": {}
},
{
"tool": "midas_vuln_scan",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "463a75db65053f641c0aa63904c2a73ee4c20a935d151c93bf24e7423067c1cb",
"stats": {
"tools": 56,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 10,
"medium": 6,
"low": 0,
"info": 0
}
}
}