io.github.andrewschristison/pondlog-ebird

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• packages/cli/src/cache.ts:67mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

    const keys = Object.keys(value as Record<string, unknown>).sort();
    for (const k of keys) {
      out[k] = canonicalize((value as Record<string, unknown>)[k]);
    }
    return out;

• packages/core/src/noaa.ts:82mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

          const timer = setTimeout(() => ac.abort(), params.timeoutMs ?? 30_000);
          try {
            const r = await fetch(url, {
              headers: {
                accept: "application/json",

• packages/source-ebird/src/client.ts:100mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        async () => {
          await limiter.acquire();
          const res = await fetch(url, {
            method: "GET",
            headers: {

• packages/source-inaturalist/src/client.ts:55mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        async () => {
          await limiter.acquire();
          const res = await fetch(url, {
            method: "GET",
            headers: {

• packages/source-mushroomobserver/src/client.ts:86mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

            : ctrl.signal;
          try {
            const res = await fetch(url, {
              method: "GET",
              headers: {

• packages/source-npn/src/client.ts:103mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

            : ctrl.signal;
          try {
            const res = await fetch(url, {
              method: "GET",
              headers: {

• packages/source-trefle/src/client.ts:128mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

            : ctrl.signal;
          try {
            const res = await fetch(url, {
              method: "GET",
              headers: {

• packages/source-usgs/src/client.ts:81mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

            : ctrl.signal;
          try {
            const res = await fetch(url, {
              method: "GET",
              headers: {

• packages/source-usgs/src/client.ts:144mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

            : ctrl.signal;
          try {
            const res = await fetch(url, {
              method: "GET",
              headers: {

• site/api/nature-proxy.js:56mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  
    const recentUrl = `https://api.ebird.org/v2/data/obs/geo/recent?lat=${lat}&lng=${lng}&dist=25&back=7`;
    const recent = await fetch(recentUrl, { headers }).then((r) => r.ok ? r.json() : []);
    const speciesSet = new Set(recent.map((o) => o.speciesCode));
    const notableUrl = `https://api.ebird.org/v2/data/obs/geo/recent/notable?lat=${lat}&lng=${lng}&dist=25`;

• site/api/nature-proxy.js:59mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    const speciesSet = new Set(recent.map((o) => o.speciesCode));
    const notableUrl = `https://api.ebird.org/v2/data/obs/geo/recent/notable?lat=${lat}&lng=${lng}&dist=25`;
    const notable = await fetch(notableUrl, { headers }).then((r) => r.ok ? r.json() : []).catch(() => []);
    const hotspotUrl = `https://api.ebird.org/v2/ref/hotspot/geo?lat=${lat}&lng=${lng}&dist=25&fmt=json`;
    const hotspots = await fetch(hotspotUrl, { headers }).then((r) => r.ok ? r.json() : []).catch(() => []);

• site/api/nature-proxy.js:61mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    const notable = await fetch(notableUrl, { headers }).then((r) => r.ok ? r.json() : []).catch(() => []);
    const hotspotUrl = `https://api.ebird.org/v2/ref/hotspot/geo?lat=${lat}&lng=${lng}&dist=25&fmt=json`;
    const hotspots = await fetch(hotspotUrl, { headers }).then((r) => r.ok ? r.json() : []).catch(() => []);
  
    return {

• site/api/nature-proxy.js:82mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      + `&east=${b.east.toFixed(4)}&west=${b.west.toFixed(4)}`
      + `&date=${isoDay(start)}-${isoDay(today)}&format=json&detail=low`;
    const r = await fetch(url, { headers: { Accept: 'application/json' } });
    if (!r.ok) throw new Error(`MO ${r.status}`);
    const data = await r.json();

• site/api/nature-proxy.js:130mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      const stationsUrl = `https://services.usanpn.org/npn_portal/stations/getStationsByLocation.json`
        + `?wkt=${encodeURIComponent(wkt)}&request_src=pondlog`;
      const sr = await fetch(stationsUrl, { signal: ctrl.signal });
      if (!sr.ok) return { activeEvents: [] };
      const stationsRaw = await sr.json();

• site/api/nature-proxy.js:153mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      top.forEach((s, i) => { obsParams.push(`station_ids%5B${i}%5D=${s.station_id}`); });
      const obsUrl = `https://services.usanpn.org/npn_portal/observations/getObservations.json?${obsParams.join('&')}`;
      const or = await fetch(obsUrl, { signal: ctrl.signal });
      if (!or.ok) return { activeEvents: [] };
      const obsRaw = await or.json();

• site/script.js:154mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

          + `?lat=${lat}&lng=${lng}&radius=25`
          + `&d1=${fmt(d1)}&d2=${fmt(d2)}&per_page=1`;
        const r = await fetch(url, { signal: a.signal, headers: { Accept: 'application/json' } });
        a.cancel();
        if (!r.ok) throw new Error(`status ${r.status}`);

• site/script.js:176mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

          + `&datum=MLLW&time_zone=lst_ldt&units=english`
          + `&interval=hilo&application=pondlog&format=json`;
        const r = await fetch(url, { signal: a.signal, headers: { Accept: 'application/json' } });
        a.cancel();
        if (!r.ok) throw new Error(`status ${r.status}`);

• site/script.js:202mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        const url = `https://waterservices.usgs.gov/nwis/iv/`
          + `?sites=${siteId}&parameterCd=00060&format=json`;
        const r = await fetch(url, { signal: a.signal, headers: { Accept: 'application/json' } });
        a.cancel();
        if (!r.ok) throw new Error(`status ${r.status}`);

• site/script.js:264mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      try {
        const url = `/api/nature-proxy?source=${source}&lat=${lat}&lng=${lng}`;
        const r = await fetch(url, { signal: a.signal, headers: { Accept: 'application/json' } });
        a.cancel();
        if (!r.ok) return null;

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  no committed credential found, and no environment variable with a credential-shaped name is read anywhere in the source

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 7 day(s) before 2026-10-16

• issue_responsiveness

  lifetime median (1 issue(s) in the last 6 months, under `03` §5's floor of 3): 87.0 day(s) to first maintainer comment

• release_cadence

  median release gap 0 days (by tags), last release 101 day(s) ago

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately