com.mnemopay/gridstamp
version 1.2.0
- scanned 2026-10-16
- source github.com/mnemopay/gridstamp
- transport stdio
- files read 36
- methodology 0.2.0
- ruleset 0.1.1
100
1 vendored or minified path was excluded before scanning; machine-generated bundles are not the server's own code
100measured on 65% of this axis
45measured on 94% of this axis
4 vulnerabilities could not be placed in `03` §6's table and are listed but not scored
not assessed
this server's declared repository could not be read through the GitHub API, so `03` §5's maintenance signals were not retrieved — note that a private repository and an absent one are indistinguishable from outside
45
The evidence
Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.
Auth Posture
- authentication_model
stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here
- transport_security
declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)
- secret_handling
detect-secrets matched 10 credential-shaped string(s), every one from a keyword or entropy heuristic (Hex High Entropy String, Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at examples/agent-proof-of-presence.ts:22; Hex High Entropy String at tests/remoteid/f3411.test.ts:87; Secret Keyword at tests/stress/load.test.ts:42; Secret Keyword at tests/stress/mega-simulation.bench.ts:26; Secret Keyword at tests/stress/production-100k.test.ts:42; Secret Keyword at tests/stress/production-15k.test.ts:44; Secret Keyword at tests/stress/stress-200k.test.ts:66; Secret Keyword at tests/stress/stress-300k.test.ts:36; Secret Keyword at tests/stress/summer-2026-simulation.bench.ts:131; Hex High Entropy String at tests/utils/crypto.test.ts:92
- authorization_granularity
no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it. A tool-list handler IS present, so the tools are built in a shape this counter could not enumerate.
Dependency Health
Showing the 50 most severe of 74 findings on this axis. The score was computed over all of them — findings beyond the fourth of a severity still deduct at a tenth of their weight — so the remainder is omitted from this page, not from the arithmetic.
- gtm/package-lock.jsonbraces 3.0.3 — GHSA-vfj7-8cjw-p6xm
transitive, CVSS 8.7
https://osv.dev/vulnerability/GHSA-vfj7-8cjw-p6xm - gtm/package-lock.jsonimage-size 1.2.1 — GHSA-5p2g-fcmc-qvqq
transitive, CVSS 8.7, fixed in 2.0.3
https://osv.dev/vulnerability/GHSA-5p2g-fcmc-qvqq - gtm/package-lock.jsonimage-size 1.2.1 — GHSA-w3rx-r6r6-pgpr
transitive, CVSS 8.7, fixed in 2.0.3
https://osv.dev/vulnerability/GHSA-w3rx-r6r6-pgpr - gtm/package-lock.jsonlinkify-it 5.0.0 — GHSA-22p9-wv53-3rq4
transitive, CVSS 8.7, fixed in 5.0.1
https://osv.dev/vulnerability/GHSA-22p9-wv53-3rq4 - gtm/package-lock.jsonsource-map-js 1.2.1 — GHSA-68fv-2mgg-jv7q
transitive, CVSS 8.7, fixed in 1.2.2
https://osv.dev/vulnerability/GHSA-68fv-2mgg-jv7q - gtm/package-lock.jsonnanoid 3.3.11 — GHSA-28wg-ghj8-5hjv
transitive, CVSS 8.2, fixed in 3.3.16
https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv - gtm/package-lock.jsonnanoid 3.3.11 — GHSA-2v37-7h3g-55p8
transitive, CVSS 8.2, fixed in 3.3.18
https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8 - gtm/package-lock.jsonvite 7.3.2 — GHSA-fx2h-pf6j-xcff
transitive, CVSS 8.2, fixed in 7.3.5
https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff - gtm/package-lock.jsonbrowserslist 4.28.2 — GHSA-73wf-gq98-2v4g
transitive, CVSS 7.5, fixed in 4.28.7
https://osv.dev/vulnerability/GHSA-73wf-gq98-2v4g - gtm/package-lock.jsonbrowserslist 4.28.2 — GHSA-c83g-rgw3-j3cx
transitive, CVSS 7.5, fixed in 4.28.7
https://osv.dev/vulnerability/GHSA-c83g-rgw3-j3cx - gtm/package-lock.jsonjs-yaml 3.14.2 — GHSA-2883-xcg3-v3hh
transitive, CVSS 7.5, fixed in 3.15.2
https://osv.dev/vulnerability/GHSA-2883-xcg3-v3hh - gtm/package-lock.jsonjs-yaml 4.1.1 — GHSA-2883-xcg3-v3hh
transitive, CVSS 7.5, fixed in 4.3.2
https://osv.dev/vulnerability/GHSA-2883-xcg3-v3hh - gtm/package-lock.jsonjs-yaml 3.14.2 — GHSA-52cp-r559-cp3m
transitive, CVSS 7.5, fixed in 3.15.0
https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m - gtm/package-lock.jsonjs-yaml 4.1.1 — GHSA-52cp-r559-cp3m
transitive, CVSS 7.5, fixed in 4.3.0
https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m - gtm/package-lock.jsonjs-yaml 3.14.2 — GHSA-5p4m-2wfm-xmqj
transitive, CVSS 7.5, fixed in 3.15.1
https://osv.dev/vulnerability/GHSA-5p4m-2wfm-xmqj - gtm/package-lock.jsonjs-yaml 4.1.1 — GHSA-5p4m-2wfm-xmqj
transitive, CVSS 7.5, fixed in 4.3.1
https://osv.dev/vulnerability/GHSA-5p4m-2wfm-xmqj - gtm/package-lock.jsonlinkify-it 5.0.0 — GHSA-v245-v573-v5vm
transitive, CVSS 7.5, fixed in 5.0.2
https://osv.dev/vulnerability/GHSA-v245-v573-v5vm - gtm/package-lock.jsonpostcss 8.5.10 — GHSA-6g55-p6wh-862q
transitive, CVSS 7.5, fixed in 8.5.12
https://osv.dev/vulnerability/GHSA-6g55-p6wh-862q - gtm/package-lock.jsonpostcss 8.5.10 — GHSA-r28c-9q8g-f849
transitive, CVSS 7.5, fixed in 8.5.18
https://osv.dev/vulnerability/GHSA-r28c-9q8g-f849 - gtm/package-lock.jsonuuid 11.1.0 — GHSA-w5hq-g745-h8pq
transitive, CVSS 7.5, fixed in 11.1.1
https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq - gtm/package-lock.jsonnanoid 3.3.11 — GHSA-xwg4-73v4-xw9w
transitive, CVSS 7.4, fixed in 3.3.12
https://osv.dev/vulnerability/GHSA-xwg4-73v4-xw9w - gtm/package-lock.json@vue/server-renderer 3.5.32 — GHSA-g2v6-rqmx-r4w6
transitive, CVSS 7.2, fixed in 3.5.42
https://osv.dev/vulnerability/GHSA-g2v6-rqmx-r4w6 - gtm/package-lock.jsondompurify 3.2.7 — GHSA-h8r8-wccr-v5f2
transitive, CVSS 6.9, fixed in 3.3.2
https://osv.dev/vulnerability/GHSA-h8r8-wccr-v5f2 - gtm/package-lock.jsondompurify 3.2.7 — GHSA-v9jr-rg53-9pgp
transitive, CVSS 6.9, fixed in 3.4.0
https://osv.dev/vulnerability/GHSA-v9jr-rg53-9pgp - gtm/package-lock.jsonsprintf-js 1.0.3 — GHSA-hp3w-g68c-fv3c
transitive, CVSS 6.9
https://osv.dev/vulnerability/GHSA-hp3w-g68c-fv3c - gtm/package-lock.jsondompurify 3.2.7 — GHSA-crv5-9vww-q3g8
transitive, CVSS 6.8, fixed in 3.4.0
https://osv.dev/vulnerability/GHSA-crv5-9vww-q3g8 - gtm/package-lock.jsonbaseline-browser-mapping 2.10.20 — GHSA-w5vr-8v7q-w6rv
transitive, CVSS 6.6, fixed in 2.11.0
https://osv.dev/vulnerability/GHSA-w5vr-8v7q-w6rv - gtm/package-lock.jsonmermaid 11.14.0 — GHSA-3rrr-jr9j-h3q3
transitive, CVSS 6.5, fixed in 11.16.1
https://osv.dev/vulnerability/GHSA-3rrr-jr9j-h3q3 - gtm/package-lock.jsonmarkdown-it 14.1.1 — GHSA-253c-mchw-3w2r
transitive, CVSS 6.3, fixed in 14.3.1
https://osv.dev/vulnerability/GHSA-253c-mchw-3w2r - gtm/package-lock.jsonpostcss 8.5.10 — GHSA-fxqj-rqcc-2cmp
transitive, CVSS 6.3, fixed in 8.5.23
https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp - gtm/package-lock.jsondompurify 3.2.7 — GHSA-76mc-f452-cxcm
transitive, CVSS 6.1, fixed in 3.4.7
https://osv.dev/vulnerability/GHSA-76mc-f452-cxcm - gtm/package-lock.jsondompurify 3.4.0 — GHSA-76mc-f452-cxcm
transitive, CVSS 6.1, fixed in 3.4.7
https://osv.dev/vulnerability/GHSA-76mc-f452-cxcm - gtm/package-lock.jsondompurify 3.2.7 — GHSA-hpcv-96wg-7vj8
transitive, CVSS 6.1, fixed in 3.4.6
https://osv.dev/vulnerability/GHSA-hpcv-96wg-7vj8 - gtm/package-lock.jsondompurify 3.4.0 — GHSA-hpcv-96wg-7vj8
transitive, CVSS 6.1, fixed in 3.4.6
https://osv.dev/vulnerability/GHSA-hpcv-96wg-7vj8 - gtm/package-lock.jsondompurify 3.2.7 — GHSA-r47g-fvhr-h676
transitive, CVSS 6.1, fixed in 3.4.6
https://osv.dev/vulnerability/GHSA-r47g-fvhr-h676 - gtm/package-lock.jsondompurify 3.4.0 — GHSA-r47g-fvhr-h676
transitive, CVSS 6.1, fixed in 3.4.6
https://osv.dev/vulnerability/GHSA-r47g-fvhr-h676 - gtm/package-lock.jsondompurify 3.2.7 — GHSA-v2wj-7wpq-c8vv
transitive, CVSS 6.1, fixed in 3.3.2
https://osv.dev/vulnerability/GHSA-v2wj-7wpq-c8vv - gtm/package-lock.jsondompurify 3.2.7 — GHSA-h7mw-gpvr-xq4m
transitive, CVSS 6.0, fixed in 3.4.0
https://osv.dev/vulnerability/GHSA-h7mw-gpvr-xq4m - gtm/package-lock.jsonpostcss-selector-parser 7.1.1 — GHSA-rj75-hqrm-r3gf
transitive, CVSS 5.9, fixed in 7.1.6
https://osv.dev/vulnerability/GHSA-rj75-hqrm-r3gf - gtm/package-lock.jsonvite 7.3.2 — GHSA-v6wh-96g9-6wx3
transitive, CVSS 5.5, fixed in 7.3.5
https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3 - gtm/package-lock.jsondompurify 3.2.7 — GHSA-39q2-94rc-95cp
transitive, CVSS 5.3, fixed in 3.4.0
https://osv.dev/vulnerability/GHSA-39q2-94rc-95cp - gtm/package-lock.jsondompurify 3.2.7 — GHSA-cj63-jhhr-wcxv
transitive, CVSS 5.3, fixed in 3.3.2
https://osv.dev/vulnerability/GHSA-cj63-jhhr-wcxv - gtm/package-lock.jsondompurify 3.2.7 — GHSA-cjmm-f4jc-qw8r
transitive, CVSS 5.3, fixed in 3.3.2
https://osv.dev/vulnerability/GHSA-cjmm-f4jc-qw8r - gtm/package-lock.jsonjs-yaml 3.14.2 — GHSA-h67p-54hq-rp68
transitive, CVSS 5.3, fixed in 3.15.0
https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68 - gtm/package-lock.jsonjs-yaml 4.1.1 — GHSA-h67p-54hq-rp68
transitive, CVSS 5.3, fixed in 4.2.0
https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68 - gtm/package-lock.jsonmarkdown-it 14.1.1 — GHSA-6v5v-wf23-fmfq
transitive, CVSS 5.3, fixed in 14.2.0
https://osv.dev/vulnerability/GHSA-6v5v-wf23-fmfq - gtm/package-lock.jsonmermaid 11.14.0 — GHSA-2v8p-3f2j-5mp7
transitive, CVSS 5.3, fixed in 11.16.1
https://osv.dev/vulnerability/GHSA-2v8p-3f2j-5mp7 - gtm/package-lock.jsonmermaid 11.14.0 — GHSA-6m6c-36f7-fhxh
transitive, CVSS 5.3, fixed in 11.15.0
https://osv.dev/vulnerability/GHSA-6m6c-36f7-fhxh - gtm/package-lock.jsonmermaid 11.14.0 — GHSA-6x64-9x62-f2gx
transitive, CVSS 5.3, fixed in 11.16.1
https://osv.dev/vulnerability/GHSA-6x64-9x62-f2gx - gtm/package-lock.jsonmermaid 11.14.0 — GHSA-87f9-hvmw-gh4p
transitive, CVSS 5.3, fixed in 11.15.0
https://osv.dev/vulnerability/GHSA-87f9-hvmw-gh4p
Maintenance
- recency
no last-commit date was retrieved for this repository
- issue_responsiveness
no issue-response median was retrieved. An unanswered issue scores 0 under `03` §5, but an absent measurement is not an unanswered issue.
- release_cadence
no release history was retrieved for this repository
- bus_factor
no contributor history was retrieved for this repository
- repository_signals
`03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.
Transparency
- license
LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text
- readme_quality
README.md: installation instructions (+25), configuration documented (+25)
- declared_scopes
neither the README nor the MCP manifest documents what the server accesses or what side effects it has
- changelog
CHANGELOG.md present
- security_contact
no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately
Contest a finding
Every number here comes from a rule reading published source, and rules get things wrong. If something on this page is incorrect — or correct but mitigated by a check the rule cannot see — open an issue and we answer it in writing. A finding we got wrong is removed and the rule is fixed; one that stands is answered on the record.
Anyone can file: the maintainer, a researcher who disagrees with the classification, or a user who tested the server and could not reproduce it. Name this server and the rule or advisory ID shown beside the finding above. We aim to reply within five business days and to resolve within ten.