dev.usetrail/trail

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/hooks-install.js:185mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

      if (!Array.isArray(groups)) continue
      const before = groups.length
      settings.hooks[event] = groups.filter((g) => !(g.hooks ?? []).some((h) => nosso(h.command)))
      if (settings.hooks[event].length !== before) results.push(t(`${event}: removido`, `${event}: removed`))
    }

• src/login.js:27mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    out.write(t(`Conectando ao Trail em ${base}\n`, `Connecting to Trail at ${base}\n`))
  
    const startRes = await fetch(base + '/api/auth/device/start', { method: 'POST' })
    if (!startRes.ok) throw new Error(t(`nao consegui iniciar o login (device/start -> HTTP ${startRes.status})`, `could not start the sign-in (device/start -> HTTP ${startRes.status})`))
    const d = await startRes.json()

• src/login.js:43mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    while (Date.now() < deadline) {
      await sleep(interval)
      const pr = await fetch(base + '/api/auth/device/poll', {
        method: 'POST',
        headers: { 'content-type': 'application/json' },

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  credentials are read from the environment (TETHER_API_AUTH, TETHER_API_TOKEN) and documented in the README

• authorization_granularity

  18 tool registrations and no conditional access logic found — `03` §4 calls this case 'needs human review' and assigns it no score band, so it is not scored here

Maintenance

• recency

  last commit 29 day(s) before 2026-10-16

• issue_responsiveness

  this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.

• release_cadence

  released 29 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately