Phrase MCP Server
phrase-mcp-server
npm
v0.4.0
Source verified
Published by phrase — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 3 = 97. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 0
Tools 94
Each tool and what it can reach — statically extracted from the published source.
strings_compare_branchingests untrusted inputstrings_create_locale_downloadingests untrusted inputstrings_get_branch_comparisoningests untrusted inputstrings_get_locale_downloadingests untrusted inputstrings_list_keysreads sensitive datatms_download_target_file_asyncingests untrusted inputtms_download_target_file_by_async_requestingests untrusted inputtms_get_async_requestingests untrusted inputtms_get_jobingests untrusted inputtms_get_projectingests untrusted input
Show 84 more tools ↓
tms_get_project_templateingests untrusted inputstrings_add_job_keysno sensitive capabilitystrings_add_job_localeno sensitive capabilitystrings_complete_jobno sensitive capabilitystrings_complete_job_localeno sensitive capabilitystrings_create_branchno sensitive capabilitystrings_create_glossaryno sensitive capabilitystrings_create_glossary_termno sensitive capabilitystrings_create_glossary_term_translationno sensitive capabilitystrings_create_jobno sensitive capabilitystrings_create_job_commentno sensitive capabilitystrings_create_job_templateno sensitive capabilitystrings_create_job_template_localeno sensitive capabilitystrings_create_keyno sensitive capabilitystrings_create_localeno sensitive capabilitystrings_create_projectno sensitive capabilitystrings_create_translationno sensitive capabilitystrings_create_uploadno sensitive capabilitystrings_delete_branchno sensitive capabilitystrings_delete_glossary_termno sensitive capabilitystrings_delete_keyno sensitive capabilitystrings_delete_localeno sensitive capabilitystrings_delete_projectno sensitive capabilitystrings_get_branchno sensitive capabilitystrings_get_glossaryno sensitive capabilitystrings_get_glossary_termno sensitive capabilitystrings_get_jobno sensitive capabilitystrings_get_job_commentno sensitive capabilitystrings_get_job_localeno sensitive capabilitystrings_get_job_templateno sensitive capabilitystrings_get_job_template_localeno sensitive capabilitystrings_get_keyno sensitive capabilitystrings_get_localeno sensitive capabilitystrings_get_projectno sensitive capabilitystrings_get_translationno sensitive capabilitystrings_get_uploadno sensitive capabilitystrings_list_account_jobsno sensitive capabilitystrings_list_branchesno sensitive capabilitystrings_list_formatsno sensitive capabilitystrings_list_glossariesno sensitive capabilitystrings_list_glossary_termsno sensitive capabilitystrings_list_job_commentsno sensitive capabilitystrings_list_job_localesno sensitive capabilitystrings_list_job_template_localesno sensitive capabilitystrings_list_job_templatesno sensitive capabilitystrings_list_jobsno sensitive capabilitystrings_list_localesno sensitive capabilitystrings_list_projectsno sensitive capabilitystrings_list_translationsno sensitive capabilitystrings_list_uploadsno sensitive capabilitystrings_lock_jobno sensitive capabilitystrings_merge_branchno sensitive capabilitystrings_remove_job_keysno sensitive capabilitystrings_remove_job_localeno sensitive capabilitystrings_reopen_jobno sensitive capabilitystrings_reopen_job_localeno sensitive capabilitystrings_review_job_localeno sensitive capabilitystrings_start_jobno sensitive capabilitystrings_sync_branchno sensitive capabilitystrings_unlock_jobno sensitive capabilitystrings_update_branchno sensitive capabilitystrings_update_glossaryno sensitive capabilitystrings_update_glossary_termno sensitive capabilitystrings_update_glossary_term_translationno sensitive capabilitystrings_update_jobno sensitive capabilitystrings_update_job_localeno sensitive capabilitystrings_update_keyno sensitive capabilitystrings_update_localeno sensitive capabilitystrings_update_projectno sensitive capabilitystrings_update_translationno sensitive capabilitytms_create_job_from_fileno sensitive capabilitytms_create_projectno sensitive capabilitytms_create_project_from_templateno sensitive capabilitytms_create_project_from_template_shorthandno sensitive capabilitytms_get_async_limitsno sensitive capabilitytms_list_jobsno sensitive capabilitytms_list_pending_requestsno sensitive capabilitytms_list_project_templatesno sensitive capabilitytms_list_projectsno sensitive capabilitytms_search_jobsno sensitive capabilitytms_set_job_statusno sensitive capabilitytms_set_project_statusno sensitive capabilitytms_update_jobno sensitive capabilitytms_update_projectno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (94 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.4.0 latest |
A 97/100 | 0 | 1.10.0 | 2026-07-25 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan phrase-mcp-server --onlineOther implementations of Phrase 1
Independent packages implementing the same tool, scanned with the same engine. Compare all 2 side by side →
More in Developer Tools
Security scan results for the 1stay MCP server.
Security scan results for the Adguard Home MCP server.
Security scan results for the Ado Browser MCP server.
Security scan results for the Adobe Experience Dev MCP server.
Security scan results for the Aemet MCP server.
Security scan results for the Affinity Mcp Bridge MCP server.