Opencut Controller — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.13.0",
"methodologyVersion": "mcptrustchecker-1.13"
},
"target": {
"id": "opencut-controller",
"source": {
"kind": "package",
"origin": "opencut-controller"
},
"server": {
"name": "opencut-controller"
}
},
"grade": "A",
"score": {
"score": 95,
"threatScore": 99,
"grade": "A",
"band": "A",
"categorySubtotals": {
"injection": 0,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 1.2,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "threat",
"ruleId": "MTC-SUP-010",
"category": "supply-chain",
"severity": "low",
"confidence": "heuristic",
"rawWeight": 3,
"confidenceMult": 0.4,
"diminishingFactor": 1,
"appliedPenalty": 1.2
},
{
"kind": "client",
"term": "capability-exposure",
"level": "moderate",
"label": "capability blast radius (moderate) — client exposure if the model is manipulated",
"appliedPenalty": 3
},
{
"kind": "client",
"term": "verification-discount",
"level": "repo",
"label": "publisher verification (public source) — no provenance, but the source is public and inspectable",
"appliedPenalty": 1
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.13"
},
"capability": {
"level": "moderate",
"reasons": [
"ingests untrusted external content (a prompt-injection entry point)"
],
"tags": [
"untrusted-input"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (171 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-SUP-010",
"title": "Package runs install-time scripts (postinstall)",
"category": "supply-chain",
"severity": "low",
"confidence": "heuristic",
"description": "\"opencut-controller\" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.",
"remediation": "Review the scripts; install with --ignore-scripts where possible and vet what they do.",
"location": {
"kind": "package",
"name": "opencut-controller"
},
"evidence": "playwright install chromium",
"owasp": "LLM03:2025 Supply Chain",
"references": [
"https://github.com/ossf/package-analysis",
"https://owasp.org/www-project-top-10-ci-cd-security-risks/"
],
"data": {
"scripts": [
"postinstall"
]
}
}
],
"toxicFlows": [],
"capabilities": [
{
"tool": "project_create",
"tags": [],
"reasons": {}
},
{
"tool": "project_load",
"tags": [],
"reasons": {}
},
{
"tool": "project_save",
"tags": [],
"reasons": {}
},
{
"tool": "project_delete",
"tags": [],
"reasons": {}
},
{
"tool": "project_list",
"tags": [],
"reasons": {}
},
{
"tool": "project_get_active",
"tags": [],
"reasons": {}
},
{
"tool": "project_rename",
"tags": [],
"reasons": {}
},
{
"tool": "project_update_settings",
"tags": [],
"reasons": {}
},
{
"tool": "project_get_timeline_view_state",
"tags": [],
"reasons": {}
},
{
"tool": "project_set_timeline_view_state",
"tags": [],
"reasons": {}
},
{
"tool": "project_get_export_state",
"tags": [],
"reasons": {}
},
{
"tool": "project_cancel_export",
"tags": [],
"reasons": {}
},
{
"tool": "project_clear_export_state",
"tags": [],
"reasons": {}
},
{
"tool": "project_close",
"tags": [],
"reasons": {}
},
{
"tool": "project_get_total_duration",
"tags": [],
"reasons": {}
},
{
"tool": "project_duplicate",
"tags": [],
"reasons": {}
},
{
"tool": "scene_create",
"tags": [],
"reasons": {}
},
{
"tool": "scene_delete",
"tags": [],
"reasons": {}
},
{
"tool": "scene_rename",
"tags": [],
"reasons": {}
},
{
"tool": "scene_switch",
"tags": [],
"reasons": {}
},
{
"tool": "scene_list",
"tags": [],
"reasons": {}
},
{
"tool": "scene_get_current",
"tags": [],
"reasons": {}
},
{
"tool": "playback_play",
"tags": [],
"reasons": {}
},
{
"tool": "playback_pause",
"tags": [],
"reasons": {}
},
{
"tool": "playback_toggle",
"tags": [],
"reasons": {}
},
{
"tool": "playback_stop",
"tags": [],
"reasons": {}
},
{
"tool": "playback_seek",
"tags": [],
"reasons": {}
},
{
"tool": "playback_set_volume",
"tags": [],
"reasons": {}
},
{
"tool": "playback_mute",
"tags": [],
"reasons": {}
},
{
"tool": "playback_unmute",
"tags": [],
"reasons": {}
},
{
"tool": "playback_toggle_mute",
"tags": [],
"reasons": {}
},
{
"tool": "playback_get_state",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_track_add",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_track_remove",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_track_toggle_mute",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_track_toggle_visibility",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_track_list",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_track_get",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_insert",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_delete",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_duplicate",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_move",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_split",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_trim",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_update_duration",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_update_start_time",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_toggle_visibility",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_toggle_mute",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_update",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_get",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_preview",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_preview_commit",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_element_preview_discard",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_effect_add",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_effect_remove",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_effect_update_params",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_effect_toggle",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_effect_reorder",
"tags": [],
"reasons": {}
},
{
"tool": "keyframe_upsert",
"tags": [],
"reasons": {}
},
{
"tool": "keyframe_remove",
"tags": [],
"reasons": {}
},
{
"tool": "keyframe_retime",
"tags": [],
"reasons": {}
},
{
"tool": "keyframe_effect_param_upsert",
"tags": [],
"reasons": {}
},
{
"tool": "keyframe_effect_param_remove",
"tags": [],
"reasons": {}
},
{
"tool": "keyframe_list",
"tags": [],
"reasons": {}
},
{
"tool": "selection_select",
"tags": [],
"reasons": {}
},
{
"tool": "selection_deselect_all",
"tags": [],
"reasons": {}
},
{
"tool": "selection_get",
"tags": [],
"reasons": {}
},
{
"tool": "selection_is_selected",
"tags": [],
"reasons": {}
},
{
"tool": "clipboard_copy",
"tags": [],
"reasons": {}
},
{
"tool": "clipboard_paste",
"tags": [],
"reasons": {}
},
{
"tool": "history_undo",
"tags": [],
"reasons": {}
},
{
"tool": "history_redo",
"tags": [],
"reasons": {}
},
{
"tool": "history_can_undo",
"tags": [],
"reasons": {}
},
{
"tool": "history_can_redo",
"tags": [],
"reasons": {}
},
{
"tool": "media_list",
"tags": [],
"reasons": {}
},
{
"tool": "media_add_file",
"tags": [],
"reasons": {}
},
{
"tool": "media_remove",
"tags": [],
"reasons": {}
},
{
"tool": "media_clear_all",
"tags": [],
"reasons": {}
},
{
"tool": "media_get",
"tags": [],
"reasons": {}
},
{
"tool": "media_add_to_timeline",
"tags": [],
"reasons": {}
},
{
"tool": "media_is_loading",
"tags": [],
"reasons": {}
},
{
"tool": "text_create",
"tags": [],
"reasons": {}
},
{
"tool": "text_update_content",
"tags": [],
"reasons": {}
},
{
"tool": "text_update_font",
"tags": [],
"reasons": {}
},
{
"tool": "text_update_style",
"tags": [],
"reasons": {}
},
{
"tool": "text_update_background",
"tags": [],
"reasons": {}
},
{
"tool": "text_update_transform",
"tags": [],
"reasons": {}
},
{
"tool": "text_update_blend_mode",
"tags": [],
"reasons": {}
},
{
"tool": "text_list",
"tags": [],
"reasons": {}
},
{
"tool": "text_delete",
"tags": [],
"reasons": {}
},
{
"tool": "audio_set_element_volume",
"tags": [],
"reasons": {}
},
{
"tool": "audio_sound_search",
"tags": [],
"reasons": {}
},
{
"tool": "audio_sound_save",
"tags": [],
"reasons": {}
},
{
"tool": "audio_sound_remove_saved",
"tags": [],
"reasons": {}
},
{
"tool": "audio_sound_list_saved",
"tags": [],
"reasons": {}
},
{
"tool": "audio_sound_toggle_commercial_filter",
"tags": [],
"reasons": {}
},
{
"tool": "audio_sound_add_to_timeline",
"tags": [],
"reasons": {}
},
{
"tool": "audio_sound_clear_saved",
"tags": [],
"reasons": {}
},
{
"tool": "sticker_search",
"tags": [],
"reasons": {}
},
{
"tool": "sticker_browse_category",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"browse\""
]
}
},
{
"tool": "sticker_add_to_timeline",
"tags": [],
"reasons": {}
},
{
"tool": "sticker_list_recent",
"tags": [],
"reasons": {}
},
{
"tool": "sticker_clear_recent",
"tags": [],
"reasons": {}
},
{
"tool": "sticker_set_category",
"tags": [],
"reasons": {}
},
{
"tool": "transcription_transcribe",
"tags": [],
"reasons": {}
},
{
"tool": "transcription_cancel",
"tags": [],
"reasons": {}
},
{
"tool": "transcription_generate_captions",
"tags": [],
"reasons": {}
},
{
"tool": "transcription_add_captions_to_timeline",
"tags": [],
"reasons": {}
},
{
"tool": "transcription_get_state",
"tags": [],
"reasons": {}
},
{
"tool": "export_project",
"tags": [],
"reasons": {}
},
{
"tool": "export_get_progress",
"tags": [],
"reasons": {}
},
{
"tool": "export_cancel",
"tags": [],
"reasons": {}
},
{
"tool": "export_clear_state",
"tags": [],
"reasons": {}
},
{
"tool": "export_set_quality",
"tags": [],
"reasons": {}
},
{
"tool": "export_set_fps",
"tags": [],
"reasons": {}
},
{
"tool": "bookmark_toggle",
"tags": [],
"reasons": {}
},
{
"tool": "bookmark_update",
"tags": [],
"reasons": {}
},
{
"tool": "bookmark_move",
"tags": [],
"reasons": {}
},
{
"tool": "bookmark_remove",
"tags": [],
"reasons": {}
},
{
"tool": "bookmark_list",
"tags": [],
"reasons": {}
},
{
"tool": "bookmark_get_at_time",
"tags": [],
"reasons": {}
},
{
"tool": "bookmark_is_bookmarked",
"tags": [],
"reasons": {}
},
{
"tool": "bookmark_toggle_overlay",
"tags": [],
"reasons": {}
},
{
"tool": "canvas_set_size",
"tags": [],
"reasons": {}
},
{
"tool": "canvas_set_fps",
"tags": [],
"reasons": {}
},
{
"tool": "canvas_set_background",
"tags": [],
"reasons": {}
},
{
"tool": "canvas_set_layout_guide",
"tags": [],
"reasons": {}
},
{
"tool": "canvas_toggle_layout_guide",
"tags": [],
"reasons": {}
},
{
"tool": "canvas_clear_layout_guide",
"tags": [],
"reasons": {}
},
{
"tool": "canvas_get_settings",
"tags": [],
"reasons": {}
},
{
"tool": "panel_set_size",
"tags": [],
"reasons": {}
},
{
"tool": "panel_reset",
"tags": [],
"reasons": {}
},
{
"tool": "panel_get_sizes",
"tags": [],
"reasons": {}
},
{
"tool": "panel_set_active_tab",
"tags": [],
"reasons": {}
},
{
"tool": "panel_set_media_view_mode",
"tags": [],
"reasons": {}
},
{
"tool": "panel_set_media_sort",
"tags": [],
"reasons": {}
},
{
"tool": "panel_get_active_tab",
"tags": [],
"reasons": {}
},
{
"tool": "keybinding_get_all",
"tags": [],
"reasons": {}
},
{
"tool": "keybinding_update",
"tags": [],
"reasons": {}
},
{
"tool": "keybinding_remove",
"tags": [],
"reasons": {}
},
{
"tool": "keybinding_reset_defaults",
"tags": [],
"reasons": {}
},
{
"tool": "keybinding_import",
"tags": [],
"reasons": {}
},
{
"tool": "keybinding_export",
"tags": [],
"reasons": {}
},
{
"tool": "keybinding_enable",
"tags": [],
"reasons": {}
},
{
"tool": "keybinding_disable",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_toggle_snapping",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_toggle_ripple_editing",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_set_zoom",
"tags": [],
"reasons": {}
},
{
"tool": "timeline_set_scroll",
"tags": [],
"reasons": {}
},
{
"tool": "storage_get_migration_state",
"tags": [],
"reasons": {}
},
{
"tool": "storage_list_projects",
"tags": [],
"reasons": {}
},
{
"tool": "storage_get_is_dirty",
"tags": [],
"reasons": {}
},
{
"tool": "auth_sign_up",
"tags": [],
"reasons": {}
},
{
"tool": "auth_sign_in",
"tags": [],
"reasons": {}
},
{
"tool": "auth_sign_out",
"tags": [],
"reasons": {}
},
{
"tool": "auth_get_session",
"tags": [],
"reasons": {}
},
{
"tool": "auth_get_profile",
"tags": [],
"reasons": {}
},
{
"tool": "auth_check_logged_in",
"tags": [],
"reasons": {}
},
{
"tool": "api_health_check",
"tags": [],
"reasons": {}
},
{
"tool": "api_sounds_search",
"tags": [],
"reasons": {}
},
{
"tool": "api_sounds_search_next_page",
"tags": [],
"reasons": {}
},
{
"tool": "OpenCut Projects List",
"tags": [],
"reasons": {}
},
{
"tool": "Current Editor State",
"tags": [],
"reasons": {}
},
{
"tool": "Timeline Tracks",
"tags": [],
"reasons": {}
},
{
"tool": "create_intro_video",
"tags": [],
"reasons": {}
},
{
"tool": "text",
"tags": [],
"reasons": {}
},
{
"tool": "duration",
"tags": [],
"reasons": {}
},
{
"tool": "add_background_music",
"tags": [],
"reasons": {}
},
{
"tool": "query",
"tags": [],
"reasons": {}
},
{
"tool": "apply_transition",
"tags": [],
"reasons": {}
},
{
"tool": "effect",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "6728fb3db1102264a36fe3a472336fa7a199a2170eb6e6d9bed036f14b364e20",
"stats": {
"tools": 171,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 0,
"medium": 0,
"low": 1,
"info": 0
}
}
}