io.github.CSOAI-ORG/scam-detector-mcp

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• auth_middleware.py:26mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

          req = urllib.request.Request(_VERIFY_URL, data=data,
                                       headers={"Content-Type": "application/json"}, method="POST")
          with urllib.request.urlopen(req, timeout=_TIMEOUT) as r:
              d = json.load(r)
              return bool(d.get("allowed", True)), d.get("tier", "free"), d.get("remaining")

• server.py:323mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

          req = _meter_urlreq.Request(_METER_URL, data=data,
              headers={"Content-Type": "application/json"}, method="POST")
          with _meter_urlreq.urlopen(req, timeout=2.5) as r:
              d = json.loads(r.read())
              if isinstance(d, dict) and "allowed" in d:

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  credentials are read from the environment (MEOK_API_KEY, MEOK_ATTEST_KEY, MEOK_PAYG_KEY), but the README does not document which

• authorization_granularity

  5 tool registrations and no conditional access logic found — `03` §4 calls this case 'needs human review' and assigns it no score band, so it is not scored here

Maintenance

• recency

  last commit 42 day(s) before 2026-10-16

• issue_responsiveness

  this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.

• release_cadence

  a release exists but fewer than two fall inside `03` §5's 12-month window, so no median gap can be taken — and §5's remaining bands are all defined on that median. A limit of the methodology, not of this repository.

• bus_factor

  2 regular authors in the last 12 months

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  CHANGELOG.md present

• security_contact

  SECURITY.md present