dev.uptimepage/uptimepage

version 1.0.0

scanned 2026-10-16
source github.com/uptimepage/uptimepage
commit fa00f2009f70
transport streamable-http
files read 65
methodology 0.2.0
ruleset 0.1.1

Code Safetyweight 30

3 vendored or minified paths were excluded before scanning; machine-generated bundles are not the server's own code

Auth Postureweight 20

71measured on 85% of this axis

Dependency Healthweight 20

not assessed

27 vulnerabilities were found and none could be placed in `03` §6's table — no CVSS score, or an ecosystem whose manifest we cannot parse for direct-vs-transitive

Maintenanceweight 15

100measured on 75% of this axis

Transparencyweight 15

56measured on 80% of this axis

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

assets/js/charts/_init.js:59mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
export async function fetchJson(url) {
    const res = await fetch(url, { headers: { Accept: "application/json" } });
    if (!res.ok) throw new Error(`${url} → ${res.status}`);
    return res.json();
```
assets/js/ui/check_form.js:354mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
        let res;
        try {
            res = await fetch(form.dataset.action, {
                method: form.dataset.method,
                headers: jsonHeaders(),
```
assets/js/ui/escalation_policies.js:51mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
            let res;
            try {
                res = await fetch(form.dataset.action, {
                    method: form.dataset.method,
                    headers: {
```
assets/js/ui/incidents_console.js:25mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
  async function post(url, body) {
    const r = await fetch(url, {
      method: "POST",
      headers: {
```

assets/js/ui/incidents_tab.js:76mcp-js-ssrf-nonliteral-url (medium/low)

An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        body.innerHTML = `<span class="font-mono text-xs text-quiet"># loading timeline…</span>`;
        try {
            const r = await fetch(url, { headers: { "Accept": "application/json" } });
            if (!r.ok) throw new Error(`HTTP ${r.status}`);
            const json = await r.json();

assets/js/ui/monitors_list.js:96mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
    const url = bar.dataset.actionUrl || "/api/v1/targets/bulk-action";
    try {
      const r = await fetch(url, {
        method: "POST",
        headers: {
```
assets/js/ui/monitors_list.js:195mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
    const url = (bar && bar.dataset.actionUrl) || "/api/v1/targets/bulk-action";
    try {
      const r = await fetch(url, {
        method: "POST",
        headers: {
```
assets/js/ui/notification_channels.js:267mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
            showResult("# sending test alert…", "text-quiet");
            try {
                const res = await fetch(url, {
                    method: "POST",
                    headers: {
```
assets/js/ui/notification_channels.js:601mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
            let body;
            try {
                const res = await fetch(o.endpoint, {
                    method: "POST",
                    headers: { ...headers, "Content-Type": "application/json" },
```
assets/js/ui/notification_channels.js:703mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
            let res;
            try {
                res = await fetch(form.dataset.action, {
                    method: form.dataset.method,
                    headers: {
```

assets/js/ui/on_call_list.js:17mcp-js-ssrf-nonliteral-url (medium/low)

An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        const id = cell.getAttribute("data-schedule-id");
        try {
            const res = await fetch(
                "/api/v1/on-call/who?schedule_id=" + encodeURIComponent(id),
                { headers: { Accept: "application/json", "X-Requested-With": "uptimepage" } },

assets/js/ui/on_call_schedule.js:81mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
            let res;
            try {
                res = await fetch(form.dataset.action, {
                    method: form.dataset.method,
                    headers: {
```
assets/js/ui/postmortem_form.js:42mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
  async function send(url, method, body) {
    const r = await fetch(url, {
      method: method,
      headers: {
```

assets/js/ui/ribbon_drill.js:67mcp-js-ssrf-nonliteral-url (medium/low)

An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        const url = `${active.url}?${qs.toString()}`;
        try {
            const r = await fetch(url, { headers: { Accept: "text/html" } });
            if (!r.ok) throw new Error(`HTTP ${r.status}`);
            const html = await r.text();

Auth Posture

authentication_model
auth enforcement present at a call site in the source (inbound token verification) and documented in the README; "refused without credentials" (`03` §4) established by reading the code rather than by connecting
transport_security
declared endpoint(s) are HTTPS: https://mcp.uptimepage.dev/mcp; scored 80, not 100: `03` §4 reserves 100 for HTTPS *with HSTS*, and an HSTS header can only be seen by connecting, which `04` §9 does not do. This is an unverifiable band, not an observed absence.
secret_handling
Twilio API Key at scripts/seed-marketing.sh:484; …and 82 more matches
authorization_granularity
no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Dependency Health

Cargo.lockhickory-resolver 0.26.1 — GHSA-6w6g-hm98-mhgm
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 8.7, fixed in 0.26.2
https://osv.dev/vulnerability/GHSA-6w6g-hm98-mhgm
Cargo.lockrmcp 1.7.0 — GHSA-33f5-2c5q-wgwj
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 8.2, fixed in 2.0.0
https://osv.dev/vulnerability/GHSA-33f5-2c5q-wgwj
Cargo.lockhickory-resolver 0.26.1 — GHSA-5j98-2g5x-46v6
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.5, fixed in 0.26.2
https://osv.dev/vulnerability/GHSA-5j98-2g5x-46v6
Cargo.lockquinn-proto 0.11.14 — RUSTSEC-2026-0185
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.5, fixed in 0.11.15
https://osv.dev/vulnerability/RUSTSEC-2026-0185
Cargo.lockquinn-proto 0.11.14 — RUSTSEC-2026-0340
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.5, fixed in 0.11.18
https://osv.dev/vulnerability/RUSTSEC-2026-0340
Cargo.lockrmcp 1.7.0 — GHSA-9pj6-vhgr-3mwh
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.5, fixed in 2.0.0
https://osv.dev/vulnerability/GHSA-9pj6-vhgr-3mwh
Cargo.lockhickory-resolver 0.26.1 — GHSA-6f2x-v7q7-m7m5
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 6.9, fixed in 0.26.2
https://osv.dev/vulnerability/GHSA-6f2x-v7q7-m7m5
Cargo.lockrmcp 1.7.0 — GHSA-9g45-5xwm-f3wc
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 6.8, fixed in 2.1.0
https://osv.dev/vulnerability/GHSA-9g45-5xwm-f3wc
Cargo.lockrmcp 1.7.0 — GHSA-c9xm-49cp-xcr9
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 6.3, fixed in 2.0.0
https://osv.dev/vulnerability/GHSA-c9xm-49cp-xcr9
Cargo.lockrsa 0.9.10 — RUSTSEC-2023-0071
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 5.9
https://osv.dev/vulnerability/RUSTSEC-2023-0071
Cargo.lockcmov 0.5.3 — GHSA-3rjw-m598-pq24
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 5.5, fixed in 0.5.4
https://osv.dev/vulnerability/GHSA-3rjw-m598-pq24
Cargo.lockopentelemetry_sdk 0.31.0 — GHSA-w9wp-h8wv-79jx
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 5.3, fixed in 0.32.1
https://osv.dev/vulnerability/GHSA-w9wp-h8wv-79jx
Cargo.lockrustls 0.23.40 — RUSTSEC-2026-0285
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 5.3, fixed in 0.23.45
https://osv.dev/vulnerability/RUSTSEC-2026-0285
Cargo.lockrustls 0.23.40 — RUSTSEC-2026-0346
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 4.0, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0346
Cargo.lockrustls 0.23.40 — RUSTSEC-2026-0348
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 3.7, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0348
Cargo.lockrustls 0.23.40 — RUSTSEC-2026-0349
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 3.7, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0349
Cargo.lockammonia 4.1.4 — RUSTSEC-2021-0157
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 4.1.7
https://osv.dev/vulnerability/RUSTSEC-2021-0157
Cargo.lockammonia 4.1.4 — RUSTSEC-2021-0158
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 4.1.7
https://osv.dev/vulnerability/RUSTSEC-2021-0158
Cargo.lockbackoff 0.4.0 — RUSTSEC-2025-0012
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published
https://osv.dev/vulnerability/RUSTSEC-2025-0012
Cargo.lockevent-listener 5.4.1 — RUSTSEC-2026-0221
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 5.4.2
https://osv.dev/vulnerability/RUSTSEC-2026-0221
Cargo.lockh2 0.4.14 — RUSTSEC-2026-0258
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 0.4.16
https://osv.dev/vulnerability/RUSTSEC-2026-0258
Cargo.lockinstant 0.1.13 — RUSTSEC-2024-0384
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published
https://osv.dev/vulnerability/RUSTSEC-2024-0384
Cargo.lockpaste 1.0.15 — RUSTSEC-2024-0436
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published
https://osv.dev/vulnerability/RUSTSEC-2024-0436
Cargo.lockquinn-proto 0.11.14 — RUSTSEC-2026-0338
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 0.11.18
https://osv.dev/vulnerability/RUSTSEC-2026-0338
Cargo.lockquinn-proto 0.11.14 — RUSTSEC-2026-0339
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 0.11.17
https://osv.dev/vulnerability/RUSTSEC-2026-0339
Cargo.lockquinn-proto 0.11.14 — RUSTSEC-2026-0342
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 0.11.17
https://osv.dev/vulnerability/RUSTSEC-2026-0342
Cargo.lockrustls-pemfile 2.2.0 — RUSTSEC-2025-0134
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published
https://osv.dev/vulnerability/RUSTSEC-2025-0134

Maintenance

recency
last commit 2 day(s) before 2026-10-16
issue_responsiveness
median over 5 issue(s) in the last 6 months: 2.2 day(s) to first maintainer comment
release_cadence
median release gap 18 days (by releases), last release 99 day(s) ago
bus_factor
this repository's 12-month history is longer than the bounded walk `04` §7 performs, and the authors found so far span more than one of `03` §5's bands. A limit of ours, not a finding about the server.
repository_signals
`03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

license
LICENSE present with no SPDX-License-Identifier tag; identified as 'AGPL-3.0' from its text
readme_quality
README.md: installation instructions (+25), configuration documented (+25)
declared_scopes
specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.
changelog
no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call
security_contact
SECURITY.md present

Contest a finding

Every number here comes from a rule reading published source, and rules get things wrong. If something on this page is incorrect — or correct but mitigated by a check the rule cannot see — open an issue and we answer it in writing. A finding we got wrong is removed and the rule is fixed; one that stands is answered on the record.

Anyone can file: the maintainer, a researcher who disagrees with the classification, or a user who tested the server and could not reproduce it. Name this server and the rule or advisory ID shown beside the finding above. We aim to reply within five business days and to resolve within ten.

Open an appeal on GitHub