Prime MCP Server
prime-mcp-server
npm
v1.0.0
Published by mikahdev — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 1 = 99. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 0
Tools 62
Each tool and what it can reach — statically extracted from the published source.
prime_add_estimate_itemno sensitive capabilityprime_create_allocationno sensitive capabilityprime_create_ap_invoiceno sensitive capabilityprime_create_attachmentno sensitive capabilityprime_create_contactno sensitive capabilityprime_create_estimateno sensitive capabilityprime_create_jobno sensitive capabilityprime_create_notificationno sensitive capabilityprime_create_schedule_itemno sensitive capabilityprime_delete_estimate_itemno sensitive capability
Show 52 more tools ↓
prime_delete_schedule_itemno sensitive capabilityprime_get_allocationno sensitive capabilityprime_get_ap_invoiceno sensitive capabilityprime_get_ar_invoiceno sensitive capabilityprime_get_attachmentno sensitive capabilityprime_get_contactno sensitive capabilityprime_get_estimateno sensitive capabilityprime_get_jobno sensitive capabilityprime_get_job_allocation_summaryno sensitive capabilityprime_get_job_financial_summaryno sensitive capabilityprime_get_job_scheduleno sensitive capabilityprime_get_job_statusno sensitive capabilityprime_get_job_trade_comparisonno sensitive capabilityprime_get_notificationno sensitive capabilityprime_get_notification_templateno sensitive capabilityprime_get_userno sensitive capabilityprime_get_work_orderno sensitive capabilityprime_list_allocation_statusesno sensitive capabilityprime_list_allocationsno sensitive capabilityprime_list_ap_invoicesno sensitive capabilityprime_list_ar_invoicesno sensitive capabilityprime_list_attachmentsno sensitive capabilityprime_list_divisionsno sensitive capabilityprime_list_estimatesno sensitive capabilityprime_list_filter_tagsno sensitive capabilityprime_list_job_statusesno sensitive capabilityprime_list_job_typesno sensitive capabilityprime_list_notification_templatesno sensitive capabilityprime_list_notificationsno sensitive capabilityprime_list_perilsno sensitive capabilityprime_list_schedule_itemsno sensitive capabilityprime_list_tradesno sensitive capabilityprime_list_usersno sensitive capabilityprime_list_work_ordersno sensitive capabilityprime_list_workflowsno sensitive capabilityprime_rate_limit_statusno sensitive capabilityprime_search_contactsno sensitive capabilityprime_search_jobsno sensitive capabilityprime_search_jobs_by_addressno sensitive capabilityprime_search_jobs_by_customerno sensitive capabilityprime_update_allocationno sensitive capabilityprime_update_ap_invoiceno sensitive capabilityprime_update_ap_invoice_statusno sensitive capabilityprime_update_ar_invoice_statusno sensitive capabilityprime_update_attachmentno sensitive capabilityprime_update_contactno sensitive capabilityprime_update_estimateno sensitive capabilityprime_update_estimate_itemno sensitive capabilityprime_update_jobno sensitive capabilityprime_update_job_statusno sensitive capabilityprime_update_schedule_itemno sensitive capabilityprime_update_work_orderno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (62 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.0.0 latest |
A 99/100 | 0 | 1.10.0 | 2026-07-25 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan prime-mcp-server --onlineMore in Developer Tools
Security scan results for the 1stay MCP server.
Security scan results for the Adguard Home MCP server.
Security scan results for the Ado Browser MCP server.
Security scan results for the Adobe Experience Dev MCP server.
Security scan results for the Aemet MCP server.
Security scan results for the Affinity Mcp Bridge MCP server.