ai.tensorfeed/x402-base-mcp

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/tools/tf.ts:91mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        const url = `${TF_AFTA_CERT_ENDPOINT}?domain=${encodeURIComponent(domain)}`;
        try {
          const res = await fetch(url, {
            method: 'GET',
            headers: {

• src/tools/x402.ts:185mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        const url = `https://${domain}${path}`;
        try {
          const res = await fetch(url, {
            method: 'GET',
            headers: {

• src/tools/x402.ts:303mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      let res: Response;
      try {
        res = await fetch(url, {
          method: 'GET',
          headers: {

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  no committed credential found, and no environment variable with a credential-shaped name is read anywhere in the source

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 2 day(s) before 2026-10-16

• issue_responsiveness

  lifetime median (2 issue(s) in the last 6 months, under `03` §5's floor of 3): 108.7 day(s) to first maintainer comment

• release_cadence

  median release gap 0 days (by tags), last release 141 day(s) ago

• bus_factor

  2 regular authors in the last 12 months

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.

• changelog

  CHANGELOG.md present

• security_contact

  SECURITY.md present