Windy Word MCP Server
windy-word-mcp
npm
v1.5.0
Published by sneakyfree — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 4 = 96. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 0
Tools 94
Each tool and what it can reach — statically extracted from the published source.
send_notificationnetwork egressarchives_by_date_rangeno sensitive capabilityauto_pasteno sensitive capabilitybring_window_to_frontno sensitive capabilitybulk_delete_archivesno sensitive capabilitybulk_export_archives_textno sensitive capabilitycancel_recordingno sensitive capabilitycheck_for_updatesno sensitive capabilityclear_install_historyno sensitive capabilityclear_paste_historyno sensitive capability
Show 84 more tools ↓
clear_translation_memoryno sensitive capabilitycloud_diagnoseno sensitive capabilitycreate_voice_clone_from_pathno sensitive capabilitydelete_archive_entryno sensitive capabilitydelete_voice_cloneno sensitive capabilitydescribe_settingno sensitive capabilitydetect_hardwareno sensitive capabilityexport_soul_file_to_pathno sensitive capabilityextract_document_textno sensitive capabilityget_active_paste_strategyno sensitive capabilityget_active_voice_cloneno sensitive capabilityget_archive_statsno sensitive capabilityget_autostart_statusno sensitive capabilityget_cloud_clone_order_statusno sensitive capabilityget_configno sensitive capabilityget_install_historyno sensitive capabilityget_install_statusno sensitive capabilityget_paste_historyno sensitive capabilityget_paste_targetno sensitive capabilityget_platformno sensitive capabilityget_recording_stateno sensitive capabilityget_sound_effect_stateno sensitive capabilityget_translation_memory_statsno sensitive capabilityget_versionno sensitive capabilityget_widget_stateno sensitive capabilityget_window_stateno sensitive capabilityget_windytune_stateno sensitive capabilityinstall_dependencyno sensitive capabilityinstall_dependency_asyncno sensitive capabilitylist_archive_entriesno sensitive capabilitylist_audio_devicesno sensitive capabilitylist_clone_bundlesno sensitive capabilitylist_diagnostic_checksno sensitive capabilitylist_hotkeysno sensitive capabilitylist_install_jobsno sensitive capabilitylist_installable_dependenciesno sensitive capabilitylist_modelsno sensitive capabilitylist_paste_strategiesno sensitive capabilitylist_settingsno sensitive capabilitylist_sound_effect_packsno sensitive capabilitylist_voice_clonesno sensitive capabilitylookup_translation_memoryno sensitive capabilitymaximize_windowno sensitive capabilityminimize_windowno sensitive capabilityopen_archive_folderno sensitive capabilityopen_urlno sensitive capabilitypreview_voice_cloneno sensitive capabilityquit_appno sensitive capabilityread_archive_entryno sensitive capabilityreset_hotkeysno sensitive capabilityrestart_appno sensitive capabilityrun_diagnosticsno sensitive capabilityrun_paste_injection_testno sensitive capabilitysave_text_fileno sensitive capabilitysave_translation_memoryno sensitive capabilitysearch_archivesno sensitive capabilityset_active_sound_packno sensitive capabilityset_active_voice_cloneno sensitive capabilityset_always_on_topno sensitive capabilityset_analytics_enabledno sensitive capabilityset_autostartno sensitive capabilityset_configno sensitive capabilityset_font_sizeno sensitive capabilityset_hotkeyno sensitive capabilityset_languageno sensitive capabilityset_master_sfx_volumeno sensitive capabilityset_modelno sensitive capabilityset_opacityno sensitive capabilityset_panel_visibilityno sensitive capabilityset_paste_strategyno sensitive capabilityset_settingno sensitive capabilityset_sound_effect_modeno sensitive capabilityset_sound_hookno sensitive capabilityset_themeno sensitive capabilityset_video_fullscreenno sensitive capabilityset_window_geometryno sensitive capabilitysetup_install_polkit_ruleno sensitive capabilitystart_recordingno sensitive capabilitystop_recordingno sensitive capabilitysubmit_voice_clone_to_cloudno sensitive capabilitytest_paste_strategyno sensitive capabilitytranscribe_audio_fileno sensitive capabilitytranslate_textno sensitive capabilityunmaximize_windowno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (94 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.5.0 latest |
A 96/100 | 0 | 1.9.0 | 2026-07-24 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan windy-word-mcp --onlineMore in Developer Tools
Security scan results for the 1stay MCP server.
Security scan results for the Adguard Home MCP server.
Security scan results for the Ado Browser MCP server.
Security scan results for the Adobe Experience Dev MCP server.
Security scan results for the Aemet MCP server.
Security scan results for the Affinity Mcp Bridge MCP server.