Mipiti MCP Server
mipiti-mcp
PyPI
v0.76.1
Published by mipiti — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
MCP server for Mipiti — AI-powered security posture platform
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 4 = 96. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 0
Tools 139
Each tool and what it can reach — statically extracted from the published source.
get_capabilityingests untrusted inputget_functional_objectivesingests untrusted inputget_groupingests untrusted inputlist_capabilitiesingests untrusted inputaccept_coverage_divergencesno sensitive capabilityadd_assetno sensitive capabilityadd_assumptionno sensitive capabilityadd_attackerno sensitive capabilityadd_componentno sensitive capabilityadd_evidenceno sensitive capability
Show 129 more tools ↓
add_functional_testno sensitive capabilityadd_model_to_groupno sensitive capabilityadd_trust_boundaryno sensitive capabilityapply_certain_reconciliation_matchno sensitive capabilityapply_control_changesetno sensitive capabilityapply_finding_remediationno sensitive capabilityassess_modelno sensitive capabilityassign_to_componentsno sensitive capabilityassociate_functional_testno sensitive capabilityattach_foundationno sensitive capabilityauto_map_controlsno sensitive capabilityauto_remediate_complianceno sensitive capabilitycheck_control_gapsno sensitive capabilitycheck_functional_gapsno sensitive capabilityclassify_model_cweno sensitive capabilitycomplete_setup_stepno sensitive capabilityconfirm_relianceno sensitive capabilityconvert_assumption_to_controlsno sensitive capabilitycreate_co_dispositionno sensitive capabilitycreate_groupno sensitive capabilitycreate_proposalno sensitive capabilitycreate_relianceno sensitive capabilitycreate_risk_acceptanceno sensitive capabilitydecide_proposalno sensitive capabilitydeclare_foundationno sensitive capabilitydelete_assertionno sensitive capabilitydelete_controlno sensitive capabilitydelete_groupno sensitive capabilitydelete_relianceno sensitive capabilitydelete_threat_modelno sensitive capabilitydismiss_verdict_divergencesno sensitive capabilityedit_assetno sensitive capabilityedit_assumptionno sensitive capabilityedit_attackerno sensitive capabilityedit_componentno sensitive capabilityedit_trust_boundaryno sensitive capabilityexport_reportno sensitive capabilitygenerate_functional_objectivesno sensitive capabilitygenerate_threat_modelno sensitive capabilityget_assertion_typesno sensitive capabilityget_compliance_reportno sensitive capabilityget_composition_overviewno sensitive capabilityget_control_assumption_groupsno sensitive capabilityget_control_generation_statusno sensitive capabilityget_control_objectivesno sensitive capabilityget_control_work_orderno sensitive capabilityget_controlsno sensitive capabilityget_cwe_catalogno sensitive capabilityget_design_leverageno sensitive capabilityget_effective_coverageno sensitive capabilityget_entityno sensitive capabilityget_findings_risksno sensitive capabilityget_functional_coverageno sensitive capabilityget_functional_satisfaction_groupsno sensitive capabilityget_functional_test_sufficiencyno sensitive capabilityget_mitigation_groupsno sensitive capabilityget_model_cwe_tagsno sensitive capabilityget_reachability_verdictsno sensitive capabilityget_remediation_leverageno sensitive capabilityget_review_queueno sensitive capabilityget_risk_viewno sensitive capabilityget_scan_promptno sensitive capabilityget_setup_statusno sensitive capabilityget_sufficiencyno sensitive capabilityget_system_dependenciesno sensitive capabilityget_threat_modelno sensitive capabilityget_verdict_divergenceno sensitive capabilityget_verification_reportno sensitive capabilityimport_compliance_frameworkno sensitive capabilityimport_controlsno sensitive capabilityimport_functional_testsno sensitive capabilityimport_threat_model_archiveno sensitive capabilitylift_composition_entityno sensitive capabilitylink_system_dependencyno sensitive capabilitylist_assertionsno sensitive capabilitylist_attestationsno sensitive capabilitylist_co_dispositionsno sensitive capabilitylist_compliance_frameworksno sensitive capabilitylist_decisionsno sensitive capabilitylist_effective_attack_pathsno sensitive capabilitylist_effective_control_objectivesno sensitive capabilitylist_effective_entitiesno sensitive capabilitylist_findingsno sensitive capabilitylist_groupsno sensitive capabilitylist_model_groupsno sensitive capabilitylist_proposalsno sensitive capabilitylist_reconciliation_candidatesno sensitive capabilitylist_relianceno sensitive capabilitylist_risk_acceptancesno sensitive capabilitylist_threat_modelsno sensitive capabilitymap_control_to_requirementno sensitive capabilitymodel_coherence_reportno sensitive capabilitypreview_finding_remediationno sensitive capabilitypreview_undo_compositionno sensitive capabilitypropose_attach_foundationno sensitive capabilityquery_threat_modelno sensitive capabilityrecompute_verdictsno sensitive capabilityreconcile_modelno sensitive capabilityreevaluate_threat_model_factorsno sensitive capabilityrefine_controlno sensitive capabilityrefine_threat_modelno sensitive capabilityregenerate_controlsno sensitive capabilityreject_reconciliation_candidateno sensitive capabilityremap_controlno sensitive capabilityremove_entityno sensitive capabilityremove_evidenceno sensitive capabilityremove_model_from_groupno sensitive capabilityrename_threat_modelno sensitive capabilityrestore_entityno sensitive capabilityretry_verdictsno sensitive capabilityrevalidate_entity_qualityno sensitive capabilityselect_compliance_frameworksno sensitive capabilityset_control_assumption_groupsno sensitive capabilityset_control_objective_calno sensitive capabilityset_functional_satisfaction_groupsno sensitive capabilityset_mitigation_groupsno sensitive capabilityset_model_provenanceno sensitive capabilityset_threat_model_parentno sensitive capabilitysplit_composition_entityno sensitive capabilitysubmit_assertionsno sensitive capabilitysubmit_attestationno sensitive capabilitysubmit_findingsno sensitive capabilitysubmit_functional_test_assertionsno sensitive capabilitysuggest_functional_test_mappingsno sensitive capabilityundo_composition_eventno sensitive capabilityunreject_reconciliation_candidateno sensitive capabilityupdate_control_statusno sensitive capabilityupdate_findingno sensitive capabilityupdate_organizationno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (139 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 10
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.76.1 latest |
A 96/100 | 0 | 1.13.0 | 2026-09-07 |
v0.74.0 |
A 96/100 | 0 | 1.13.0 | 2026-09-06 |
v0.73.0 |
A 96/100 | 0 | 1.13.0 | 2026-09-05 |
v0.71.1 |
A 96/100 | 0 | 1.13.0 | 2026-09-04 |
v0.70.3 |
A 96/100 | 0 | 1.13.0 | 2026-09-01 |
Show 5 more versions ↓
v0.70.1 |
A 96/100 | 0 | 1.13.0 | 2026-08-31 |
v0.70.0 |
A 96/100 | 0 | 1.13.0 | 2026-08-28 |
v0.69.0 |
A 96/100 | 0 | 1.13.0 | 2026-08-27 |
v0.68.2 |
A 96/100 | 0 | 1.13.0 | 2026-08-25 |
v0.68.0 |
A 96/100 | 0 | 1.12.1 | 2026-08-17 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan mipiti-mcp --online --registry pypiMore in Security & Testing
The Stripe Agent Toolkit enables popular agent frameworks including LangChain and Vercel's AI SDK to integrate with Stripe APIs through function calling.
MCP (Model Context Protocol) server for AgentGate. Enables Claude and other MCP-compatible AI assistants to request approvals.
Scan any website for AI agent readiness, payment protocols, and discovery endpoints
MCP server for aigently security guardrails — reads static catalog-data JSON, zero API dependency
Governed threat modeling, code threat verification, traceability & compliance, as MCP tools.
Governed threat modeling, code threat verification, traceability & compliance, as MCP tools.