io.github.AncientiCe/palace-rs

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  credentials are read from the environment (PALACE_API_KEY) and documented in the README

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Dependency Health

• Cargo.lockopenssl 0.10.76 — GHSA-xp3w-r5p5-63rr

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 8.7, fixed in 0.10.79

  https://osv.dev/vulnerability/GHSA-xp3w-r5p5-63rr
• Cargo.lockopenssl 0.10.76 — GHSA-hppc-g8h3-xhp3

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 8.3, fixed in 0.10.78

  https://osv.dev/vulnerability/GHSA-hppc-g8h3-xhp3
• Cargo.lockopenssl 0.10.76 — GHSA-ghm9-cr32-g9qj

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 8.1, fixed in 0.10.78

  https://osv.dev/vulnerability/GHSA-ghm9-cr32-g9qj
• Cargo.lockopenssl 0.10.76 — GHSA-8c75-8mhr-p7r9

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.2, fixed in 0.10.78

  https://osv.dev/vulnerability/GHSA-8c75-8mhr-p7r9
• Cargo.lockopenssl 0.10.76 — GHSA-pqf5-4pqq-29f5

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.2, fixed in 0.10.78

  https://osv.dev/vulnerability/GHSA-pqf5-4pqq-29f5
• Cargo.lockopenssl 0.10.76 — GHSA-phqj-4mhp-q6mq

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 5.1, fixed in 0.10.80

  https://osv.dev/vulnerability/GHSA-phqj-4mhp-q6mq
• Cargo.lockopenssl 0.10.76 — GHSA-xv59-967r-8726

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 5.1, fixed in 0.10.79

  https://osv.dev/vulnerability/GHSA-xv59-967r-8726
• Cargo.lockopenssl 0.10.76 — GHSA-xmgf-hq76-4vx2

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 1.7, fixed in 0.10.78

  https://osv.dev/vulnerability/GHSA-xmgf-hq76-4vx2

Maintenance

• recency

  last commit 4 day(s) before 2026-10-16

• issue_responsiveness

  this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.

• release_cadence

  released 4 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  2 regular authors in the last 12 months

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.

• changelog

  CHANGELOG.md present

• security_contact

  SECURITY.md present