Mimi Seed — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.13.0",
"methodologyVersion": "mcptrustchecker-1.13"
},
"target": {
"id": "@yoonion/mimi-seed-mcp",
"source": {
"kind": "package",
"origin": "@yoonion/mimi-seed-mcp"
},
"server": {
"name": "@yoonion/mimi-seed-mcp"
}
},
"grade": "A",
"score": {
"score": 94,
"threatScore": 100,
"grade": "A",
"band": "A",
"categorySubtotals": {
"injection": 0,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "client",
"term": "capability-exposure",
"level": "high",
"label": "capability blast radius (high) — client exposure if the model is manipulated",
"appliedPenalty": 6
},
{
"kind": "client",
"term": "verification-discount",
"level": "source",
"label": "publisher verification (provenance) — cryptographic build provenance ties the artifact to its source",
"appliedPenalty": 0
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.13"
},
"capability": {
"level": "high",
"reasons": [
"ingests untrusted external content (a prompt-injection entry point)",
"reads sensitive or local data",
"has a read → egress path (a data-exfiltration surface)",
"can execute shell commands or code"
],
"tags": [
"untrusted-input",
"sensitive-source",
"code-exec"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/android/keystore.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/android/keystore.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/android/keystore.js"
},
"evidence": "spawnSync } from 'node:child_process'; import { randomBytes } from 'node:crypto'; import { readFileSync, unlinkSync, ex",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/android/keystore.js",
"line": 1,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/video/render.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/video/render.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/video/render.js"
},
"evidence": ", execFile } from 'node:child_process'; import { randomUUID } from 'node:crypto'; import { closeSync, createWriteStream,",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/video/render.js",
"line": 1,
"nonRuntime": false
}
}
],
"toxicFlows": [],
"capabilities": [
{
"tool": "admob_list_accounts",
"tags": [],
"reasons": {}
},
{
"tool": "admob_list_apps",
"tags": [],
"reasons": {}
},
{
"tool": "admob_list_ad_units",
"tags": [],
"reasons": {}
},
{
"tool": "admob_get_today_earnings",
"tags": [],
"reasons": {}
},
{
"tool": "admob_get_report",
"tags": [],
"reasons": {}
},
{
"tool": "admob_create_app",
"tags": [],
"reasons": {}
},
{
"tool": "admob_create_ad_unit",
"tags": [],
"reasons": {}
},
{
"tool": "generate_release_notes_from_commits",
"tags": [],
"reasons": {}
},
{
"tool": "generate_review_reply",
"tags": [],
"reasons": {}
},
{
"tool": "android_signing_setup",
"tags": [],
"reasons": {}
},
{
"tool": "android_generate_keystore",
"tags": [],
"reasons": {}
},
{
"tool": "jenkins_upload_playstore_sa",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_get_weekly_insight",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_list_apps",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_verify_credentials",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_get_app",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_list_versions",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_create_version",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_attach_build",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_attach_latest_build",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_get_metadata",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_update_localization",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_list_screenshots",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_upload_screenshot",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_delete_screenshot",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_delete_screenshot_set",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_update_whats_new",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_update_review_notes",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_get_review_notes",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_list_builds",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_list_beta_groups",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_get_app_info",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_list_app_info_localizations",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_update_app_info_localization",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_create_app_info_localization",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_list_reviews",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_reply_review",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_create_inapp_purchase",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_create_subscription",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_list_products",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_update_product_review_note",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_list_product_localizations",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_update_product_localization",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_upload_product_review_screenshot",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_add_product_to_review",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_list_review_submissions",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_remove_review_submission_item",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_add_version_to_review_submission",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_update_version_string",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_update_product",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_delete_product",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_plan_release",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_submit_for_review",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_cancel_review",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_release_status",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_release_version",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_update_release_type",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_phased_release",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_get_age_rating",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_update_age_rating",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_declare_encryption",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_get_availability",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_set_territory_availability",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_beta_status",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_update_beta_review_detail",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_update_beta_test_info",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_update_whats_to_test",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_submit_beta_review",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_set_beta_group_build",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_add_beta_testers",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_notify_beta_testers",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_list_previews",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_upload_preview",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_delete_preview",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_get_sales_report",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_get_finance_report",
"tags": [],
"reasons": {}
},
{
"tool": "mimi_seed_status",
"tags": [],
"reasons": {}
},
{
"tool": "mimi_seed_auth_start",
"tags": [],
"reasons": {}
},
{
"tool": "mimi_seed_auth_status",
"tags": [],
"reasons": {}
},
{
"tool": "mimi_seed_remote_sync_credentials",
"tags": [],
"reasons": {}
},
{
"tool": "bigquery_run_query",
"tags": [],
"reasons": {}
},
{
"tool": "bigquery_list_datasets",
"tags": [],
"reasons": {}
},
{
"tool": "bigquery_list_tables",
"tags": [],
"reasons": {}
},
{
"tool": "bigquery_get_table_schema",
"tags": [],
"reasons": {}
},
{
"tool": "bigquery_auth_status",
"tags": [],
"reasons": {}
},
{
"tool": "gcp_get_billing_info",
"tags": [],
"reasons": {}
},
{
"tool": "gcp_list_billing_projects",
"tags": [],
"reasons": {}
},
{
"tool": "gcp_list_budgets",
"tags": [],
"reasons": {}
},
{
"tool": "gcp_create_budget",
"tags": [],
"reasons": {}
},
{
"tool": "android_check_billing_compliance",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_check_submission_risks",
"tags": [],
"reasons": {}
},
{
"tool": "appstore_check_submission_risks",
"tags": [],
"reasons": {}
},
{
"tool": "screenshot_validate",
"tags": [],
"reasons": {}
},
{
"tool": "release_status",
"tags": [],
"reasons": {}
},
{
"tool": "ci_save_config",
"tags": [],
"reasons": {}
},
{
"tool": "ci_list_workflows",
"tags": [],
"reasons": {}
},
{
"tool": "ci_trigger_build",
"tags": [],
"reasons": {}
},
{
"tool": "ci_get_build_status",
"tags": [],
"reasons": {}
},
{
"tool": "ci_list_recent_builds",
"tags": [],
"reasons": {}
},
{
"tool": "ci_cancel_build",
"tags": [],
"reasons": {}
},
{
"tool": "facebook_save_config",
"tags": [],
"reasons": {}
},
{
"tool": "facebook_list_pages",
"tags": [],
"reasons": {}
},
{
"tool": "facebook_get_page",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"get_page\""
]
}
},
{
"tool": "facebook_post_photo",
"tags": [],
"reasons": {}
},
{
"tool": "facebook_post_multi_photo",
"tags": [],
"reasons": {}
},
{
"tool": "facebook_current_config",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_get_remote_config_overview",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_list_projects",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_get_project",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_create_project",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_list_android_apps",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_create_android_app",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_get_android_config",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_delete_android_app",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_list_ios_apps",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_create_ios_app",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_get_ios_config",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_delete_ios_app",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_list_web_apps",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_create_web_app",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_get_web_config",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_delete_web_app",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_enable_service",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_enable_common_services",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_list_enabled_services",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_link_analytics",
"tags": [],
"reasons": {}
},
{
"tool": "firebase_get_analytics_details",
"tags": [],
"reasons": {}
},
{
"tool": "ga4_list_account_summaries",
"tags": [],
"reasons": {}
},
{
"tool": "ga4_list_properties",
"tags": [],
"reasons": {}
},
{
"tool": "ga4_create_property",
"tags": [],
"reasons": {}
},
{
"tool": "ga4_create_data_stream",
"tags": [],
"reasons": {}
},
{
"tool": "ga4_list_data_streams",
"tags": [],
"reasons": {}
},
{
"tool": "ga4_plan_bigquery_link",
"tags": [],
"reasons": {}
},
{
"tool": "ga4_create_bigquery_link",
"tags": [],
"reasons": {}
},
{
"tool": "ga4_run_report",
"tags": [],
"reasons": {}
},
{
"tool": "googleads_save_config",
"tags": [],
"reasons": {}
},
{
"tool": "googleads_list_campaigns",
"tags": [],
"reasons": {}
},
{
"tool": "googleads_get_campaign_report",
"tags": [],
"reasons": {}
},
{
"tool": "googleads_get_uac_report",
"tags": [],
"reasons": {}
},
{
"tool": "googleads_list_accessible_customers",
"tags": [],
"reasons": {}
},
{
"tool": "googleads_config_status",
"tags": [],
"reasons": {}
},
{
"tool": "gsc_list_sites",
"tags": [],
"reasons": {}
},
{
"tool": "gsc_list_sitemaps",
"tags": [],
"reasons": {}
},
{
"tool": "gsc_get_sitemap",
"tags": [],
"reasons": {}
},
{
"tool": "gsc_submit_sitemap",
"tags": [],
"reasons": {}
},
{
"tool": "gsc_inspect_url",
"tags": [],
"reasons": {}
},
{
"tool": "gsc_search_analytics",
"tags": [],
"reasons": {}
},
{
"tool": "iam_list_service_accounts",
"tags": [],
"reasons": {}
},
{
"tool": "iam_create_service_account",
"tags": [],
"reasons": {}
},
{
"tool": "iam_list_keys",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"list_keys\""
]
}
},
{
"tool": "iam_create_key",
"tags": [],
"reasons": {}
},
{
"tool": "iam_add_iam_policy_binding",
"tags": [],
"reasons": {}
},
{
"tool": "instagram_save_config",
"tags": [],
"reasons": {}
},
{
"tool": "instagram_get_account",
"tags": [],
"reasons": {}
},
{
"tool": "instagram_post_image",
"tags": [],
"reasons": {}
},
{
"tool": "instagram_post_carousel",
"tags": [],
"reasons": {}
},
{
"tool": "jenkins_status",
"tags": [],
"reasons": {}
},
{
"tool": "jenkins_save_config",
"tags": [],
"reasons": {}
},
{
"tool": "jenkins_list_credentials",
"tags": [],
"reasons": {}
},
{
"tool": "jenkins_create_credential",
"tags": [],
"reasons": {}
},
{
"tool": "jenkins_upload_keystore",
"tags": [],
"reasons": {}
},
{
"tool": "jenkins_delete_credential",
"tags": [],
"reasons": {}
},
{
"tool": "jenkins_list_jobs",
"tags": [],
"reasons": {}
},
{
"tool": "jenkins_get_job_config",
"tags": [],
"reasons": {}
},
{
"tool": "jenkins_create_job",
"tags": [],
"reasons": {}
},
{
"tool": "jenkins_update_job",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_get_app",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_update_details",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_get_listing",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_update_listing",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_list_tracks",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_get_statistics",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_list_images",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_upload_image",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_delete_all_images",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_replace_images",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_update_release_notes",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_update_latest_release_notes",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_list_reviews",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_reply_review",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_list_inapp_products",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_list_subscriptions",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_create_onetime_product",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_create_subscription",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_verify_service_account",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_register_service_account",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_list_service_accounts",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_delete_service_account",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_plan_release",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_submit_release",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_promote_release",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_list_products",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_update_product_listing",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_update_subscription_listing",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_update_product_state",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_update_product",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_delete_product",
"tags": [],
"reasons": {}
},
{
"tool": "setup_playstore_connection",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_upload_data_safety",
"tags": [],
"reasons": {}
},
{
"tool": "playstore_list_recovery_actions",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "e654b1bf9b1c1fb5f96dcfc08cec8bc21884d73e8b853ed37539932112e3d491",
"stats": {
"tools": 200,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 2,
"medium": 0,
"low": 0,
"info": 0
}
}
}