ai.memcell/memcell

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/commands/connect.ts:313mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

    const models: Record<string, string> = {};
    for (const ag of present) {
      models[ag] = await resolveModelForAgent(ag, process.cwd());
    }
    const activeModel = await resolveModelForAgent(activeAgent, process.cwd());

• src/config.ts:96mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

    let here = tree;
    for (const part of parts.slice(0, -1)) {
      if (typeof here[part] !== "object" || here[part] === null) here[part] = {};
      here = here[part] as Tree;
    }

Auth Posture

• authentication_model

  registry declares credential header(s) Authorization that are not required on every declared endpoint — `03` §4's "authentication present but optional" band; 1 of 2 declared remote endpoint(s) require no credential header: https://memcell.ai/mcp/public/{memory}

• transport_security

  declared endpoint(s) are HTTPS: https://memcell.ai/mcp, https://memcell.ai/mcp/public/{memory}; scored 80, not 100: `03` §4 reserves 100 for HTTPS *with HSTS*, and an HSTS header can only be seen by connecting, which `04` §9 does not do. This is an unverifiable band, not an observed absence.

• secret_handling

  source was fetched but every file in it was oversized, unreadable or excluded, so no source text could be read, so there is nothing to scan for committed credentials

• authorization_granularity

  source was fetched but every file in it was oversized, unreadable or excluded, so no source text could be read, so neither the tool count nor any access-control logic can be read

Maintenance

• recency

  last commit 9 day(s) before 2026-10-16

• issue_responsiveness

  lifetime median (1 issue(s) in the last 6 months, under `03` §5's floor of 3): 35.1 day(s) to first maintainer comment

• release_cadence

  released 16 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text

• readme_quality

  README.md: configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately