ai.ankimcp/anki-mcp-server-addon

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• anki_mcp_server/dependency_loader.py:1125mcp-python-archive-extract-unconfined (critical/medium)

  An archive is extracted without validating member paths. A tar or zip entry may name `../` or an absolute path and write outside the destination; Python's extractall has historically done exactly that.

                  if ".dist-info" in member:
                      continue
                  zf.extract(member, temp_dir)
  
          # Remove wheel file

• .github/scripts/check_registry_version.py:130mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

      )
      try:
          with urllib.request.urlopen(request, timeout=REQUEST_TIMEOUT) as response:
              return response.status, response.read().decode("utf-8", "replace"), "ok"
      except urllib.error.HTTPError as exc:

• anki_mcp_server/dependency_loader.py:867mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

      the check is skipped whenever ``response.chunked`` is true.
      """
      with urllib.request.urlopen(pypi_url, timeout=_NETWORK_TIMEOUT_SECONDS) as response:
          chunked = getattr(response, "chunked", False)
          try:

• anki_mcp_server/dependency_loader.py:949mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

      wrong percentage is harmless where a wrongly rejected download is not.
      """
      with urllib.request.urlopen(wheel_url, timeout=_NETWORK_TIMEOUT_SECONDS) as response:
          chunked = getattr(response, "chunked", False)
          try:

• anki_mcp_server/primitives/essential/tools/store_media_file_tool.py:87mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

  
          try:
              with urllib.request.urlopen(url, timeout=30) as response:
                  return response.read(), "url"
          except urllib.error.HTTPError as e:

Auth Posture

• authentication_model

  the registry entry declares no transport, so `03` §4's stdio carve-out cannot be applied either way

• transport_security

  the registry entry declares no transport for any package or remote

• secret_handling

  detect-secrets matched 3 credential-shaped string(s), every one from a keyword or entropy heuristic (Base64 High Entropy String, Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at README.md:404; Base64 High Entropy String at tests/e2e/test_media_security.py:12; Base64 High Entropy String at tests/e2e/test_media_tools.py:11

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 5 day(s) before 2026-10-16

• issue_responsiveness

  median over 11 issue(s) in the last 6 months: 0.3 day(s) to first maintainer comment

• release_cadence

  released 5 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; text not matched against any license this build can identify (`04` §7's classifier is not wired; see module docstring)

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately