io.github.codeChap/google-analytics
version 0.1.0
- scanned 2026-10-16
- source github.com/codeChap/mcp-server-google-analytics
- commit b003d8ade81a
- transport unknown
- methodology 0.2.0
No tag matching version 0.1.0 was found in this repository, so the scan read the default branch instead. The findings below describe that code, not necessarily the released version.
not assessed
no source files in a language the ruleset covers (python, javascript, typescript, go)
70measured on 20% of this axis
not assessed
23 vulnerabilities were found and none could be placed in `03` §6's table — no CVSS score, or an ecosystem whose manifest we cannot parse for direct-vs-transitive
70measured on 45% of this axis
0
The evidence
Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.
Auth Posture
- authentication_model
the registry entry declares no transport, so `03` §4's stdio carve-out cannot be applied either way
- transport_security
the registry entry declares no transport for any package or remote
- secret_handling
credentials are read from the environment (GOOGLE_APPLICATION_CREDENTIALS), but the README does not document which
- authorization_granularity
no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.
Dependency Health
- Cargo.lockopenssl 0.10.75 — GHSA-xp3w-r5p5-63rr
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 8.7, fixed in 0.10.79
https://osv.dev/vulnerability/GHSA-xp3w-r5p5-63rr - Cargo.lockopenssl 0.10.75 — GHSA-hppc-g8h3-xhp3
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 8.3, fixed in 0.10.78
https://osv.dev/vulnerability/GHSA-hppc-g8h3-xhp3 - Cargo.lockrmcp 1.8.0 — GHSA-33f5-2c5q-wgwj
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 8.2, fixed in 2.0.0
https://osv.dev/vulnerability/GHSA-33f5-2c5q-wgwj - Cargo.lockopenssl 0.10.75 — GHSA-ghm9-cr32-g9qj
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 8.1, fixed in 0.10.78
https://osv.dev/vulnerability/GHSA-ghm9-cr32-g9qj - Cargo.lockrmcp 1.8.0 — GHSA-9pj6-vhgr-3mwh
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.5, fixed in 2.0.0
https://osv.dev/vulnerability/GHSA-9pj6-vhgr-3mwh - Cargo.lockrustls-webpki 0.103.9 — RUSTSEC-2026-0104
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.5, fixed in 0.103.13
https://osv.dev/vulnerability/RUSTSEC-2026-0104 - Cargo.lockopenssl 0.10.75 — GHSA-8c75-8mhr-p7r9
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.2, fixed in 0.10.78
https://osv.dev/vulnerability/GHSA-8c75-8mhr-p7r9 - Cargo.lockopenssl 0.10.75 — GHSA-pqf5-4pqq-29f5
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.2, fixed in 0.10.78
https://osv.dev/vulnerability/GHSA-pqf5-4pqq-29f5 - Cargo.lockrmcp 1.8.0 — GHSA-9g45-5xwm-f3wc
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 6.8, fixed in 2.1.0
https://osv.dev/vulnerability/GHSA-9g45-5xwm-f3wc - Cargo.lockrmcp 1.8.0 — GHSA-c9xm-49cp-xcr9
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 6.3, fixed in 2.0.0
https://osv.dev/vulnerability/GHSA-c9xm-49cp-xcr9 - Cargo.lockjsonwebtoken 9.3.1 — GHSA-h395-gr6q-cpjc
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 5.5, fixed in 10.3.0
https://osv.dev/vulnerability/GHSA-h395-gr6q-cpjc - Cargo.lockrustls 0.23.37 — RUSTSEC-2026-0285
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 5.3, fixed in 0.23.45
https://osv.dev/vulnerability/RUSTSEC-2026-0285 - Cargo.lockopenssl 0.10.75 — GHSA-phqj-4mhp-q6mq
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 5.1, fixed in 0.10.80
https://osv.dev/vulnerability/GHSA-phqj-4mhp-q6mq - Cargo.lockopenssl 0.10.75 — GHSA-xv59-967r-8726
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 5.1, fixed in 0.10.79
https://osv.dev/vulnerability/GHSA-xv59-967r-8726 - Cargo.lockrustls-webpki 0.103.9 — RUSTSEC-2026-0049
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 4.4, fixed in 0.103.10
https://osv.dev/vulnerability/RUSTSEC-2026-0049 - Cargo.lockrustls 0.23.37 — RUSTSEC-2026-0346
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 4.0, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0346 - Cargo.lockrustls 0.23.37 — RUSTSEC-2026-0348
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 3.7, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0348 - Cargo.lockrustls 0.23.37 — RUSTSEC-2026-0349
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 3.7, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0349 - Cargo.lockrustls-webpki 0.103.9 — RUSTSEC-2026-0098
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 2.2, fixed in 0.103.12
https://osv.dev/vulnerability/RUSTSEC-2026-0098 - Cargo.lockrustls-webpki 0.103.9 — RUSTSEC-2026-0099
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 2.2, fixed in 0.103.12
https://osv.dev/vulnerability/RUSTSEC-2026-0099 - Cargo.lockopenssl 0.10.75 — GHSA-xmgf-hq76-4vx2
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 1.7, fixed in 0.10.78
https://osv.dev/vulnerability/GHSA-xmgf-hq76-4vx2 - Cargo.lockanyhow 1.0.102 — RUSTSEC-2026-0190
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 1.0.103
https://osv.dev/vulnerability/RUSTSEC-2026-0190 - Cargo.lockh2 0.4.13 — RUSTSEC-2026-0258
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 0.4.16
https://osv.dev/vulnerability/RUSTSEC-2026-0258
Maintenance
- recency
last commit 51 day(s) before 2026-10-16
- issue_responsiveness
this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.
- release_cadence
this repository publishes neither releases nor version tags
- bus_factor
sole maintainer
- repository_signals
`03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.
Transparency
- license
no LICENSE file and no license field in any package manifest — `03` §7: without a license, a consumer has no grant to use the server at all
- readme_quality
no README in the fetched source
- declared_scopes
neither the README nor the MCP manifest documents what the server accesses or what side effects it has
- changelog
no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call
- security_contact
no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately
Contest a finding
Every number here comes from a rule reading published source, and rules get things wrong. If something on this page is incorrect — or correct but mitigated by a check the rule cannot see — open an issue and we answer it in writing. A finding we got wrong is removed and the rule is fixed; one that stands is answered on the record.
Anyone can file: the maintainer, a researcher who disagrees with the classification, or a user who tested the server and could not reproduce it. Name this server and the rule or advisory ID shown beside the finding above. We aim to reply within five business days and to resolve within ten.