ai.novence/mcp

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Auth Posture

• authentication_model

  registry declares credential header(s) Authorization that are not required on every declared endpoint, and the source we fetched shows no enforcement — `03` §4's "authentication present but optional" band; 1 of 1 declared remote endpoint(s) require no credential header: https://api.novence.ai/mcp

• transport_security

  declared endpoint(s) are HTTPS: https://api.novence.ai/mcp; scored 80, not 100: `03` §4 reserves 100 for HTTPS *with HSTS*, and an HSTS header can only be seen by connecting, which `04` §9 does not do. This is an unverifiable band, not an observed absence.

• secret_handling

  detect-secrets matched 3 credential-shaped string(s), every one from a keyword or entropy heuristic (Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at README.md:56; Secret Keyword at SETUP.md:26; Secret Keyword at skills/novence-deploy/SKILL.md:16

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it. A tool-list handler IS present, so the tools are built in a shape this counter could not enumerate.

Dependency Health

• package-lock.jsonproxy-addr 2.0.7 — GHSA-jqcg-44mw-7w3h

  transitive, CVSS 9.1, fixed in 2.0.8

  https://osv.dev/vulnerability/GHSA-jqcg-44mw-7w3h
• package-lock.json@modelcontextprotocol/sdk 1.30.0 — GHSA-6qxp-vccf-f47h

  direct, CVSS 7.5, fixed in 1.31.0

  https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h
• package-lock.jsonip-address 10.7.0 — GHSA-h3mg-xc3c-68pw

  transitive, CVSS 6.3, fixed in 10.7.1

  https://osv.dev/vulnerability/GHSA-h3mg-xc3c-68pw
• package-lock.jsonip-address 10.7.0 — GHSA-j6r3-76f7-8jcv

  transitive, CVSS 6.3, fixed in 10.7.1

  https://osv.dev/vulnerability/GHSA-j6r3-76f7-8jcv
• package-lock.jsonfast-uri 3.1.7 — GHSA-hrr3-gc8f-f4qj

  transitive, CVSS 4.8, fixed in 3.1.8

  https://osv.dev/vulnerability/GHSA-hrr3-gc8f-f4qj

Maintenance

• recency

  last commit 2 day(s) before 2026-10-16

• issue_responsiveness

  lifetime median (1 issue(s) in the last 6 months, under `03` §5's floor of 3): 4.8 day(s) to first maintainer comment

• release_cadence

  this repository publishes neither releases nor version tags

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately