ai.adeu/adeu

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/desktop-auth.ts:20mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

  
  function openBrowser(url: string) {
    if (platform() === "darwin") exec(`open "${url}"`);
    else if (platform() === "win32") exec(`start "" "${url}"`);
    else exec(`xdg-open "${url}"`);

• src/desktop-auth.ts:20mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

  
  function openBrowser(url: string) {
    if (platform() === "darwin") exec(`open "${url}"`);
    else if (platform() === "win32") exec(`start "" "${url}"`);
    else exec(`xdg-open "${url}"`);

• src/desktop-auth.ts:21mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

  function openBrowser(url: string) {
    if (platform() === "darwin") exec(`open "${url}"`);
    else if (platform() === "win32") exec(`start "" "${url}"`);
    else exec(`xdg-open "${url}"`);
  }

• src/desktop-auth.ts:21mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

  function openBrowser(url: string) {
    if (platform() === "darwin") exec(`open "${url}"`);
    else if (platform() === "win32") exec(`start "" "${url}"`);
    else exec(`xdg-open "${url}"`);
  }

• src/desktop-auth.ts:22mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

    if (platform() === "darwin") exec(`open "${url}"`);
    else if (platform() === "win32") exec(`start "" "${url}"`);
    else exec(`xdg-open "${url}"`);
  }
  

• src/desktop-auth.ts:22mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

    if (platform() === "darwin") exec(`open "${url}"`);
    else if (platform() === "win32") exec(`start "" "${url}"`);
    else exec(`xdg-open "${url}"`);
  }
  

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  detect-secrets matched 1 credential-shaped string(s), every one from a keyword or entropy heuristic (Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at src/mcp.cloud.test.ts:99

• authorization_granularity

  9 tool registrations and no conditional access logic found — `03` §4 calls this case 'needs human review' and assigns it no score band, so it is not scored here

Maintenance

• recency

  last commit 2 day(s) before 2026-10-16

• issue_responsiveness

  median over 17 issue(s) in the last 6 months: 0.5 day(s) to first maintainer comment

• release_cadence

  released 11 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  this repository's 12-month history is longer than the bounded walk `04` §7 performs, and the authors found so far span more than one of `03` §5's bands. A limit of ours, not a finding about the server.

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  package.json declares 'MIT' but no LICENSE file ships with the source

• readme_quality

  README.md: configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately