io.github.cyanheads/libofcongress-mcp-server

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/mcp-server/tools/definitions/libofcongress-search-newspapers.tool.ts:221mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

          );
        }
        bounds[field] = parsed.bound;
      }
      const range = resolveDateRange(bounds.date_start, bounds.date_end);

• src/services/lc-linked-data/lc-linked-data-service.ts:113mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      const data = await retryWithinBudget(
        async ({ signal }) => {
          const response = await fetch(url, {
            headers: { 'User-Agent': this.userAgent, Accept: 'application/json' },
            signal,

• src/services/loc-api/loc-api-service.ts:503mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      this.checkRateLimit();
      ctx.log.debug('LOC API request', { url });
      const response = await fetch(url, {
        headers: { 'User-Agent': this.userAgent, Accept: 'application/json' },
        signal,

• src/services/loc-api/loc-api-service.ts:963mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        const ocr = await retryWithinBudget(
          async ({ signal }) => {
            const response = await fetch(textUrl, {
              headers: { 'User-Agent': this.userAgent },
              signal,

Auth Posture

• authentication_model

  network transport, and no authentication middleware, credential-header read, or inbound token verification appears anywhere in the source we fetched — `03` §4's "no authentication; HTTP transport" band

• transport_security

  declared endpoint(s) are HTTPS: https://libofcongress.caseyjhand.com/mcp; scored 80, not 100: `03` §4 reserves 100 for HTTPS *with HSTS*, and an HSTS header can only be seen by connecting, which `04` §9 does not do. This is an unverifiable band, not an observed absence.

• secret_handling

  no committed credential found, and no environment variable with a credential-shaped name is read anywhere in the source

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 2 day(s) before 2026-10-16

• issue_responsiveness

  only 0 issue(s) from outside the project fall inside `03` §5's 6-month window, which is under §5's floor of 3, and §5's lifetime-median fallback needs this repository's whole issue history — more of it than `04` §7's bounded fetch reads. A limit of ours, not a finding about the server.

• release_cadence

  released 2 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately