Tniq MCP Server
tniq-mcp
npm
v1.2.0
Source verified
Published by ringer — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
MCP server for TNIQ by Ringer — telecom number management, porting, toll-free, messaging, and CNAM APIs
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 1.2 = 99. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −1.2 | Package runs install-time scripts MTC-SUP-010 | supply-chain |
2. Client adoption risk — 99 − 3 = 96. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 3
low Shell/command execution in packaging/dev tooling (dist/setup.js)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`dist/setup.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ecFileSync } from "node:child_process"; import { stdin, stdout } from "node:process"; import { CONFIG_DIR, CONFIG_FILE,
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/setup.js
low Shell/command execution in packaging/dev tooling (postinstall.js)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`postinstall.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ecFileSync } from "node:child_process"; import { fileURLToPath } from "node:url"; import { join, dirname } from "node:pa
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server postinstall.js
low Package runs install-time scripts (postinstall)MTC-SUP-010
"tniq-mcp" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.
Evidence: node postinstall.js
Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.
Location: package tniq-mcp
Tools 200
Each tool and what it can reach — statically extracted from the published source.
inv_download_audit_diffingests untrusted inputinv_exportingests untrusted inputcnam_activateno sensitive capabilitycnam_deleteno sensitive capabilitycnam_queryno sensitive capabilityinv_aggregateno sensitive capabilityinv_assign_by_idno sensitive capabilityinv_assign_numberno sensitive capabilityinv_cancel_auditno sensitive capabilityinv_clear_quarantineno sensitive capability
Show 190 more tools ↓
inv_commit_auditno sensitive capabilityinv_disconnect_by_idno sensitive capabilityinv_disconnect_numberno sensitive capabilityinv_get_audit_diffno sensitive capabilityinv_get_audit_historyno sensitive capabilityinv_get_audit_statusno sensitive capabilityinv_get_map_datano sensitive capabilityinv_get_map_latasno sensitive capabilityinv_get_map_rate_centersno sensitive capabilityinv_get_map_statesno sensitive capabilityinv_get_nruf_reportno sensitive capabilityinv_get_numberno sensitive capabilityinv_get_summaryno sensitive capabilityinv_queryno sensitive capabilityinv_reject_auditno sensitive capabilityinv_release_by_idno sensitive capabilityinv_release_numberno sensitive capabilityinv_reserve_by_idno sensitive capabilityinv_reserve_numberno sensitive capabilityinv_set_pinno sensitive capabilityinv_set_quarantineno sensitive capabilityinv_start_auditno sensitive capabilityinv_update_metadatano sensitive capabilityinv_update_metadata_by_idno sensitive capabilityinv_validate_queryno sensitive capabilitymsg_appeal_brandno sensitive capabilitymsg_appeal_vettingno sensitive capabilitymsg_assign_numbersno sensitive capabilitymsg_brand_cnp_registerno sensitive capabilitymsg_campaign_cnp_registerno sensitive capabilitymsg_cancel_cnp_migrationno sensitive capabilitymsg_cnp_backfillno sensitive capabilitymsg_create_brandno sensitive capabilitymsg_create_campaignno sensitive capabilitymsg_create_nnidno sensitive capabilitymsg_delete_brandno sensitive capabilitymsg_delete_nnidno sensitive capabilitymsg_elect_cnpno sensitive capabilitymsg_get_brandno sensitive capabilitymsg_get_brand_eventsno sensitive capabilitymsg_get_campaignno sensitive capabilitymsg_get_campaign_eventsno sensitive capabilitymsg_get_cnp_migrationno sensitive capabilitymsg_get_mno_statusno sensitive capabilitymsg_get_nnidno sensitive capabilitymsg_get_overviewno sensitive capabilitymsg_get_sharing_statusno sensitive capabilitymsg_import_vettingno sensitive capabilitymsg_link_brandno sensitive capabilitymsg_link_campaignno sensitive capabilitymsg_list_brandsno sensitive capabilitymsg_list_campaign_numbersno sensitive capabilitymsg_list_campaignsno sensitive capabilitymsg_list_cnpsno sensitive capabilitymsg_list_entity_typesno sensitive capabilitymsg_list_identity_appeal_categoriesno sensitive capabilitymsg_list_mnosno sensitive capabilitymsg_list_nnidsno sensitive capabilitymsg_list_use_casesno sensitive capabilitymsg_list_verticalsno sensitive capabilitymsg_list_vet_appeal_categoriesno sensitive capabilitymsg_list_vetting_providersno sensitive capabilitymsg_lookup_brandno sensitive capabilitymsg_lookup_campaignno sensitive capabilitymsg_nudge_cnpno sensitive capabilitymsg_remove_numbersno sensitive capabilitymsg_request_vettingno sensitive capabilitymsg_resubmit_campaignno sensitive capabilitymsg_revet_brandno sensitive capabilitymsg_start_cnp_migrationno sensitive capabilitymsg_update_brandno sensitive capabilitymsg_update_campaignno sensitive capabilitymsg_update_nnidno sensitive capabilityport_auto_fixno sensitive capabilityport_bulk_actionsno sensitive capabilityport_cancelno sensitive capabilityport_cancel_jobno sensitive capabilityport_create_projectno sensitive capabilityport_create_workflow_ruleno sensitive capabilityport_delete_projectno sensitive capabilityport_fix_ddd_mismatchno sensitive capabilityport_get_auto_activationno sensitive capabilityport_get_batch_operationsno sensitive capabilityport_get_detailed_progressno sensitive capabilityport_get_detailsno sensitive capabilityport_get_error_groupsno sensitive capabilityport_get_failed_jobsno sensitive capabilityport_get_filter_presetsno sensitive capabilityport_get_job_statsno sensitive capabilityport_get_jobs_by_stateno sensitive capabilityport_get_lifecycle_summaryno sensitive capabilityport_get_progressno sensitive capabilityport_get_projectno sensitive capabilityport_get_project_job_statusno sensitive capabilityport_get_statisticsno sensitive capabilityport_get_workflow_rulesno sensitive capabilityport_list_projectsno sensitive capabilityport_out_create_projectno sensitive capabilityport_out_get_detailsno sensitive capabilityport_out_get_projectno sensitive capabilityport_out_list_projectsno sensitive capabilityport_out_lookupno sensitive capabilityport_out_retryno sensitive capabilityport_out_submitno sensitive capabilityport_out_update_tnno sensitive capabilityport_protect_create_ruleno sensitive capabilityport_protect_delete_ruleno sensitive capabilityport_protect_get_effectiveno sensitive capabilityport_protect_get_ruleno sensitive capabilityport_protect_list_rulesno sensitive capabilityport_protect_update_ruleno sensitive capabilityport_retry_jobno sensitive capabilityport_retry_project_jobsno sensitive capabilityport_save_filter_presetno sensitive capabilityport_set_priorityno sensitive capabilityport_submitno sensitive capabilityport_syncno sensitive capabilityport_update_auto_activationno sensitive capabilityport_update_projectno sensitive capabilityport_update_tn_detailno sensitive capabilityport_validateno sensitive capabilityref_get_cicno sensitive capabilityref_get_nnidno sensitive capabilityref_get_resp_orgno sensitive capabilityref_get_spidno sensitive capabilityref_resolve_cicsno sensitive capabilityref_search_cicsno sensitive capabilityref_search_nnidsno sensitive capabilityref_search_resp_orgsno sensitive capabilityref_search_spidsno sensitive capabilityreport_create_jobno sensitive capabilityreport_get_jobno sensitive capabilityreport_list_jobsno sensitive capabilityroc_cancelno sensitive capabilityroc_create_projectno sensitive capabilityroc_escalate_hdino sensitive capabilityroc_generate_loano sensitive capabilityroc_get_auditno sensitive capabilityroc_get_detailsno sensitive capabilityroc_get_documentsno sensitive capabilityroc_get_projectno sensitive capabilityroc_inbound_checkinno sensitive capabilityroc_inbound_checkoutno sensitive capabilityroc_inbound_processno sensitive capabilityroc_list_projectsno sensitive capabilityroc_refreshno sensitive capabilityroc_remove_tfnsno sensitive capabilityroc_submitno sensitive capabilityroc_syncno sensitive capabilityroc_upload_documentno sensitive capabilityroc_upload_loano sensitive capabilitysoa_acknowledge_eventno sensitive capabilitysoa_activateno sensitive capabilitysoa_cancelno sensitive capabilitysoa_create_conflictno sensitive capabilitysoa_create_lrnno sensitive capabilitysoa_disconnectno sensitive capabilitysoa_get_activation_readyno sensitive capabilitysoa_get_eventsno sensitive capabilitysoa_get_spidno sensitive capabilitysoa_get_statusno sensitive capabilitysoa_intraspno sensitive capabilitysoa_queryno sensitive capabilitysoa_releaseno sensitive capabilitysoa_remove_conflictno sensitive capabilitysoa_remove_lrnno sensitive capabilitytf_activateno sensitive capabilitytf_change_resporgno sensitive capabilitytf_copy_templateno sensitive capabilitytf_create_templateno sensitive capabilitytf_delete_draftno sensitive capabilitytf_delete_templateno sensitive capabilitytf_disconnectno sensitive capabilitytf_disconnect_templateno sensitive capabilitytf_get_draftno sensitive capabilitytf_get_templateno sensitive capabilitytf_get_template_historyno sensitive capabilitytf_get_template_history_versionno sensitive capabilitytf_list_draftsno sensitive capabilitytf_list_templatesno sensitive capabilitytf_lock_templateno sensitive capabilitytf_push_draftno sensitive capabilitytf_query_statusno sensitive capabilitytf_release_reservationno sensitive capabilitytf_reserveno sensitive capabilitytf_save_draftno sensitive capabilitytf_search_and_reserveno sensitive capabilitytf_search_spareno sensitive capabilitytf_unlock_templateno sensitive capabilitytf_update_templateno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.2.0 latest |
A 96/100 | 3 | 1.13.0 | 2026-09-09 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan tniq-mcp --onlineMore in Developer Tools
Hotel booking MCP server — 300K+ properties, real confirmation numbers, loyalty programs. Builders monetize every booking via Stripe Connect. The first MCP server that completes real hotel reservations inside AI conversations.
Generates production-ready UI components from natural language, inspired by v0.
Manage AdGuard Home through AI assistants
Read-only Azure DevOps for MCP clients using only your existing browser session — no PAT, no Azure CLI. Browse work items, pull requests, comments, attachments and Artifacts feeds across every project, repo and feed you can access.
MCP server for Adobe Experience Manager Assets integration development
Servidor MCP para el tiempo oficial de España (API pública OpenData de AEMET). Predicción, observación y avisos como herramientas MCP tipadas.