Analyzing package security…
Package trust score
This server scores 30/100 (grade D). The biggest gaps are supply chain & malware and supply chain — fixing those will raise your score fastest. Top recommendation: run a live probe (behavioral) and remove packages that trigger malware or egress signals (+~20 pts).
This server scores 30/100 (grade D). The biggest gaps are supply chain & malware and supply chain — fixing those will raise your score fastest. Top recommendation: run a live probe (behavioral) and remove packages that trigger malware or egress signals (+~20 pts).
| Category | Score | Weight | Points |
|---|---|---|---|
| CVE Posture | 86/100 | 15% | +13 |
| Supply Chain & Malware | 0/100 | 20% | +0 |
| Supply Chain | 50/100 | 10% | +5 |
| Authentication | 55/100 | 8% | +4 |
| Transport Security | 60/100 | 5% | +3 |
| Tool Capability | 100/100 | 15% | +15 |
| Attack History | 50/100 | 15% | +8 |
| Response Hygiene | 70/100 | 10% | +7 |
| Mastyf AI Protection | 50/100 | 2% | +1 |
Some dependency vulnerabilities were found. Patch or upgrade packages to raise this score.
Pick a layout and copy markdown, HTML, RST, BBCode, or AsciiDoc for your README.
Fix the issues above, then run a deep scan or publish from your mastyf.ai proxy for a maintainer-verified badge.
Trust score: 30/100 (live scan)
No known CVEs
Unknown publisher
High-confidence malware or egress signals — do not use this package until reviewed.
Supply-chain signals need review — verify package name and publisher before trusting.
Only basic API-key auth is configured. OAuth or mTLS is stronger for production.
Uses local stdio transport (low network exposure) but no wire encryption if exposed remotely.
Tool surface is mostly read-only or low risk.
The live probe sent attack payloads but the server returned no clear signals.
Live probe responses were clean — no payload reflection or secret leaks observed.
Not proxied through Mastyf AI — no runtime policy enforcement or audit trail.
Plain-language findings from the security scan — fix these to improve your score.
Attempted connect to registry.npmjs.org:443 — blocked by the trust-scan sandbox Detected by the behavioral layer with high confidence.
How to fix: Do not install or upgrade — treat this as malware until the publisher releases a clean version.
While the package ran, it tried to reach registry.npmjs.org on port 443 — this was blocked by the sandbox egress policy. Off-network callouts are a classic malware behavior.
How to fix: Inspect why the package phones home. If the package is not expected to use the network, do not use it.
The server accepts tool calls without verifying who is calling. In shared or remote setups, attackers could invoke file or system tools directly.
How to fix: Add OAuth 2.1, API keys, or mTLS before exposing this server beyond localhost.
The server talks over local stdin/stdout — low network risk when run on the same machine, but no encryption if tunneled remotely.
How to fix: Keep stdio for local dev; use HTTPS/mTLS or Mastyf AI proxy for remote agents.
The live probe sent 2 malicious payloads and observed no reflections or secret leaks. No exploitable behavior detected.
How to fix: Re-run a live probe after any code change to confirm no regressions.
Run a live probe (behavioral) and remove packages that trigger malware or egress signals