ai.mailmcp/mailmcp

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Auth Posture

• authentication_model

  no authentication appears in the source we fetched, but this server's network endpoint is a hosted remote, whose authentication can be enforced in front of its code — and no credential header is declared. An undeclared header is not an absent one, so `03` §4's "no authentication" band is not established.

• transport_security

  declared endpoint(s) are HTTPS: https://mailmcp.ai/mcp; scored 80, not 100: `03` §4 reserves 100 for HTTPS *with HSTS*, and an HSTS header can only be seen by connecting, which `04` §9 does not do. This is an unverifiable band, not an observed absence.

• secret_handling

  detect-secrets matched 40 credential-shaped string(s), every one from a keyword or entropy heuristic (Base64 High Entropy String, Basic Auth Credentials, Hex High Entropy String, Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Basic Auth Credentials at .env.example:65; Secret Keyword at dist/node.js:7; Secret Keyword at dist/node.js:158; Base64 High Entropy String at dist/node.js:229; Secret Keyword at dist/node.js:348; Base64 High Entropy String at dist/node.js:368; Base64 High Entropy String at dist/node.js:368; Base64 High Entropy String at dist/node.js:459; Base64 High Entropy String at dist/node.js:459; Base64 High Entropy String at dist/node.js:459; …and 30 more matches

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 5 day(s) before 2026-10-16

• issue_responsiveness

  lifetime median (2 issue(s) in the last 6 months, under `03` §5's floor of 3): 5.9 day(s) to first maintainer comment

• release_cadence

  released 5 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; text not matched against any license this build can identify (`04` §7's classifier is not wired; see module docstring)

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), states what the server does in the first 200 words (+20)

• declared_scopes

  specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.

• changelog

  CHANGELOG.md present

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately