Supercharged Figma — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.13.0",
"methodologyVersion": "mcptrustchecker-1.13"
},
"target": {
"id": "supercharged-figma-mcp",
"source": {
"kind": "package",
"origin": "supercharged-figma-mcp"
},
"server": {
"name": "supercharged-figma-mcp"
}
},
"grade": "A",
"score": {
"score": 97,
"threatScore": 100,
"grade": "A",
"band": "A",
"categorySubtotals": {
"injection": 0,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "client",
"term": "capability-exposure",
"level": "moderate",
"label": "capability blast radius (moderate) — client exposure if the model is manipulated",
"appliedPenalty": 3
},
{
"kind": "client",
"term": "verification-discount",
"level": "source",
"label": "publisher verification (provenance) — cryptographic build provenance ties the artifact to its source",
"appliedPenalty": 0
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.13"
},
"capability": {
"level": "moderate",
"reasons": [
"ingests untrusted external content (a prompt-injection entry point)",
"can send data / act on an external service"
],
"tags": [
"untrusted-input",
"external-sink"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (123 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (deploy/cloudflare/worker-relay.ts)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`deploy/cloudflare/worker-relay.ts:103`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "deploy/cloudflare/worker-relay.ts"
},
"evidence": "const resp = await stub.fetch(`https://relay.internal/bridge?channel=${encodeURIComponent(channel)}`, { method: 'POS",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "deploy/cloudflare/worker-relay.ts",
"line": 103,
"nonRuntime": false
}
},
{
"ruleId": "MTC-CAP-007",
"title": "Unconstrained URL/host parameter \"url\" on \"rest_download_image\"",
"category": "network",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"rest_download_image\" takes a URL/host parameter \"url\" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).",
"remediation": "Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.",
"location": {
"kind": "tool",
"name": "rest_download_image",
"field": "inputSchema.properties.url"
},
"owasp": "LLM06:2025 Excessive Agency",
"data": {
"param": "url"
}
}
],
"toxicFlows": [],
"capabilities": [
{
"tool": "connect_to_relay",
"tags": [],
"reasons": {}
},
{
"tool": "get_connection_status",
"tags": [],
"reasons": {}
},
{
"tool": "smart_select",
"tags": [],
"reasons": {}
},
{
"tool": "find_similar",
"tags": [],
"reasons": {}
},
{
"tool": "scan_by_pattern",
"tags": [],
"reasons": {}
},
{
"tool": "auto_discover_components",
"tags": [],
"reasons": {}
},
{
"tool": "batch_create",
"tags": [],
"reasons": {}
},
{
"tool": "batch_modify",
"tags": [],
"reasons": {}
},
{
"tool": "batch_clone",
"tags": [],
"reasons": {}
},
{
"tool": "batch_rename",
"tags": [],
"reasons": {}
},
{
"tool": "batch_delete",
"tags": [],
"reasons": {}
},
{
"tool": "create_component_from_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "create_variant_set",
"tags": [],
"reasons": {}
},
{
"tool": "auto_create_variants",
"tags": [],
"reasons": {}
},
{
"tool": "merge_to_component",
"tags": [],
"reasons": {}
},
{
"tool": "detach_instance",
"tags": [],
"reasons": {}
},
{
"tool": "swap_component",
"tags": [],
"reasons": {}
},
{
"tool": "create_interaction",
"tags": [],
"reasons": {}
},
{
"tool": "batch_connect",
"tags": [],
"reasons": {}
},
{
"tool": "copy_prototype",
"tags": [],
"reasons": {}
},
{
"tool": "create_flow",
"tags": [],
"reasons": {}
},
{
"tool": "create_color_style",
"tags": [],
"reasons": {}
},
{
"tool": "create_text_style",
"tags": [],
"reasons": {}
},
{
"tool": "apply_style_to_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "sync_styles_to_library",
"tags": [],
"reasons": {}
},
{
"tool": "analyze_duplicates",
"tags": [],
"reasons": {}
},
{
"tool": "suggest_component_structure",
"tags": [],
"reasons": {}
},
{
"tool": "generate_naming_scheme",
"tags": [],
"reasons": {}
},
{
"tool": "check_consistency",
"tags": [],
"reasons": {}
},
{
"tool": "select_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "set_focus",
"tags": [],
"reasons": {}
},
{
"tool": "move_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "set_node_position",
"tags": [],
"reasons": {}
},
{
"tool": "arrange_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "containerize_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "validate_structure",
"tags": [],
"reasons": {}
},
{
"tool": "capture_view",
"tags": [],
"reasons": {}
},
{
"tool": "get_document_info",
"tags": [],
"reasons": {}
},
{
"tool": "get_node_info",
"tags": [],
"reasons": {}
},
{
"tool": "get_selection",
"tags": [],
"reasons": {}
},
{
"tool": "set_multiple_text_contents",
"tags": [],
"reasons": {}
},
{
"tool": "undo_operations",
"tags": [],
"reasons": {}
},
{
"tool": "apply_style_preset",
"tags": [],
"reasons": {}
},
{
"tool": "frame_to_components",
"tags": [],
"reasons": {}
},
{
"tool": "analyze_frame_structure",
"tags": [],
"reasons": {}
},
{
"tool": "cross_page_copy",
"tags": [],
"reasons": {}
},
{
"tool": "cross_page_move",
"tags": [],
"reasons": {}
},
{
"tool": "batch_edit_across_pages",
"tags": [],
"reasons": {}
},
{
"tool": "explode_component_set",
"tags": [],
"reasons": {}
},
{
"tool": "detach_and_organize",
"tags": [],
"reasons": {}
},
{
"tool": "convert_instances_to_components",
"tags": [],
"reasons": {}
},
{
"tool": "split_component_by_variants",
"tags": [],
"reasons": {}
},
{
"tool": "merge_components_to_set",
"tags": [],
"reasons": {}
},
{
"tool": "create_ellipse",
"tags": [],
"reasons": {}
},
{
"tool": "create_line",
"tags": [],
"reasons": {}
},
{
"tool": "create_polygon",
"tags": [],
"reasons": {}
},
{
"tool": "create_star",
"tags": [],
"reasons": {}
},
{
"tool": "create_vector",
"tags": [],
"reasons": {}
},
{
"tool": "create_group",
"tags": [],
"reasons": {}
},
{
"tool": "create_section",
"tags": [],
"reasons": {}
},
{
"tool": "create_slice",
"tags": [],
"reasons": {}
},
{
"tool": "create_connector",
"tags": [],
"reasons": {}
},
{
"tool": "create_sticky",
"tags": [],
"reasons": {}
},
{
"tool": "create_shape_with_text",
"tags": [],
"reasons": {}
},
{
"tool": "create_table",
"tags": [],
"reasons": {}
},
{
"tool": "union_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "subtract_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "intersect_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "exclude_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "flatten_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "set_constraints",
"tags": [],
"reasons": {}
},
{
"tool": "set_layout_grid",
"tags": [],
"reasons": {}
},
{
"tool": "set_effects",
"tags": [],
"reasons": {}
},
{
"tool": "set_export_settings",
"tags": [],
"reasons": {}
},
{
"tool": "set_blend_mode",
"tags": [],
"reasons": {}
},
{
"tool": "set_mask",
"tags": [],
"reasons": {}
},
{
"tool": "set_auto_layout",
"tags": [],
"reasons": {}
},
{
"tool": "remove_auto_layout",
"tags": [],
"reasons": {}
},
{
"tool": "align_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "distribute_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "create_effect_style",
"tags": [],
"reasons": {}
},
{
"tool": "create_grid_style",
"tags": [],
"reasons": {}
},
{
"tool": "update_paint_style",
"tags": [],
"reasons": {}
},
{
"tool": "update_text_style",
"tags": [],
"reasons": {}
},
{
"tool": "delete_style",
"tags": [],
"reasons": {}
},
{
"tool": "get_all_styles",
"tags": [],
"reasons": {}
},
{
"tool": "create_variable",
"tags": [],
"reasons": {}
},
{
"tool": "create_variable_collection",
"tags": [],
"reasons": {}
},
{
"tool": "set_variable_value",
"tags": [],
"reasons": {}
},
{
"tool": "bind_variable_to_node",
"tags": [],
"reasons": {}
},
{
"tool": "unbind_variable",
"tags": [],
"reasons": {}
},
{
"tool": "get_all_variables",
"tags": [],
"reasons": {}
},
{
"tool": "delete_variable",
"tags": [],
"reasons": {}
},
{
"tool": "create_page",
"tags": [],
"reasons": {}
},
{
"tool": "delete_page",
"tags": [],
"reasons": {}
},
{
"tool": "rename_page",
"tags": [],
"reasons": {}
},
{
"tool": "reorder_pages",
"tags": [],
"reasons": {}
},
{
"tool": "duplicate_page",
"tags": [],
"reasons": {}
},
{
"tool": "create_image_fill",
"tags": [],
"reasons": {}
},
{
"tool": "export_node",
"tags": [],
"reasons": {}
},
{
"tool": "export_nodes_batch",
"tags": [],
"reasons": {}
},
{
"tool": "add_component_property",
"tags": [],
"reasons": {}
},
{
"tool": "set_component_property",
"tags": [],
"reasons": {}
},
{
"tool": "remove_component_property",
"tags": [],
"reasons": {}
},
{
"tool": "scale_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "flip_horizontal",
"tags": [],
"reasons": {}
},
{
"tool": "flip_vertical",
"tags": [],
"reasons": {}
},
{
"tool": "import_component_from_file",
"tags": [],
"reasons": {}
},
{
"tool": "import_style_from_file",
"tags": [],
"reasons": {}
},
{
"tool": "rest_get_file",
"tags": [],
"reasons": {}
},
{
"tool": "rest_get_file_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "rest_get_team_components",
"tags": [],
"reasons": {}
},
{
"tool": "rest_get_file_components",
"tags": [],
"reasons": {}
},
{
"tool": "rest_get_team_styles",
"tags": [],
"reasons": {}
},
{
"tool": "rest_export_nodes",
"tags": [],
"reasons": {}
},
{
"tool": "rest_batch_export",
"tags": [],
"reasons": {}
},
{
"tool": "rest_download_image",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"download\""
]
}
},
{
"tool": "rest_copy_component_to_local",
"tags": [],
"reasons": {}
},
{
"tool": "rest_compare_components",
"tags": [],
"reasons": {}
},
{
"tool": "rest_get_rate_limit",
"tags": [],
"reasons": {}
},
{
"tool": "get_performance_report",
"tags": [],
"reasons": {}
},
{
"tool": "cancel_operation",
"tags": [],
"reasons": {}
},
{
"tool": "get_active_operations",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "46e3678ad04b487e05bf0ffd47564e71d33faec013325feb4142fde429036544",
"stats": {
"tools": 123,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 0,
"medium": 2,
"low": 0,
"info": 0
}
}
}