io.github.DekryptLabs/dlbrowser

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/hermes_browser/__main__.py:108mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

          try:
              req = urllib.request.Request(url, method="GET")
              with urllib.request.urlopen(req, timeout=2) as resp:
                  if resp.status == 200:
                      print(f"DLBrowser gateway started (PID {proc.pid})")

• src/hermes_browser/cli.py:541mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

      try:
          req = urllib.request.Request(url, headers={"Accept": "application/vnd.github.v3+json", "User-Agent": "dlbrowser-cli"})
          with urllib.request.urlopen(req, timeout=15) as resp:
              data = json_lib.loads(resp.read().decode("utf-8"))
      except Exception as exc:

• src/hermes_browser/cli.py:603mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

          url = f"https://api.github.com/repos/{GITHUB_REPO}/releases/latest"
          req = urllib.request.Request(url, headers={"Accept": "application/vnd.github.v3+json", "User-Agent": "dlbrowser-cli"})
          with urllib.request.urlopen(req, timeout=10) as resp:
              data = json_lib.loads(resp.read().decode("utf-8"))
          latest_tag = data.get("tag_name", "").lstrip("v")

• src/hermes_browser/deep_crawl.py:123mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

          try:
              import urllib.request
              resp = urllib.request.urlopen(url, timeout=15)
              content = resp.read().decode("utf-8", errors="ignore")
  

• src/hermes_browser/hermes_ds_fallback.py:80mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

          )
  
          resp = urllib.request.urlopen(req, timeout=timeout)
          data = json.loads(resp.read().decode("utf-8"))
  

• src/hermes_browser/hermes_ds_fallback.py:138mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

              headers={"Authorization": f"Bearer {api_key}"},
          )
          resp = urllib.request.urlopen(req, timeout=10)
          return json.loads(resp.read().decode("utf-8"))
      except Exception as e:

• src/hermes_browser/llm_manager.py:309mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

          loop = asyncio.get_event_loop()
          resp = await asyncio.wait_for(
              loop.run_in_executor(None, lambda: urllib.request.urlopen(req, timeout=120)),
              timeout=130,
          )

• src/hermes_browser/mcp_server.py:695mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

                  headers={"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)"}
              )
              resp = urllib.request.urlopen(req, timeout=15)
              html = resp.read().decode("utf-8", errors="ignore")
  

• src/hermes_browser/smart_content.py:295mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

          )
  
          resp = urllib.request.urlopen(req, timeout=60)
          data = json.loads(resp.read().decode("utf-8"))
          content = data["choices"][0]["message"]["content"]

• src/hermes_browser/webhooks.py:263mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

              )
              try:
                  resp = urllib.request.urlopen(req, timeout=self.timeout)
                  return resp.getcode()
              except urllib.error.HTTPError as e:

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  detect-secrets matched 3 credential-shaped string(s), every one from a keyword or entropy heuristic (Basic Auth Credentials, Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Basic Auth Credentials at src/hermes_browser/proxy_pool.py:8; Secret Keyword at tests/test_webhooks.py:27; Secret Keyword at tests/test_webhooks.py:219

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 86 day(s) before 2026-10-16

• issue_responsiveness

  this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.

• release_cadence

  this repository publishes neither releases nor version tags

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately