io.github.ECD5A/tkach-security
version 0.1.2
- scanned 2026-10-16
- source github.com/ECD5A/Tkach-Security
- commit d773070adefe
- transport stdio
- files read 14
- methodology 0.2.0
- ruleset 0.1.1
95
100measured on 65% of this axis
not assessed
17 vulnerabilities were found and none could be placed in `03` §6's table — no CVSS score, or an ecosystem whose manifest we cannot parse for direct-vs-transitive
88measured on 65% of this axis
67measured on 80% of this axis
The evidence
Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.
Code Safety
- sdk/go/tkachclient/client.go:247mcp-go-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.
url := "http://" + net.JoinHostPort(host, strconv.Itoa(port)) + path request, err := http.NewRequest(method, url, bytes.NewReader(body)) if err != nil { return Response{}, &Error{Code: ErrorInvalidRequest}
Auth Posture
- authentication_model
stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here
- transport_security
declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)
- secret_handling
detect-secrets matched 2 credential-shaped string(s), every one from a keyword or entropy heuristic (Basic Auth Credentials, Hex High Entropy String). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Hex High Entropy String at .github/workflows/publish-mcp.yml:33; Basic Auth Credentials at crates/tkach-provider-openai/src/config.rs:223
- authorization_granularity
no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.
Dependency Health
- Cargo.lockquinn-proto 0.11.17 — RUSTSEC-2026-0340
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.5, fixed in 0.11.18
https://osv.dev/vulnerability/RUSTSEC-2026-0340 - fuzz/Cargo.lockquinn-proto 0.11.17 — RUSTSEC-2026-0340
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.5, fixed in 0.11.18
https://osv.dev/vulnerability/RUSTSEC-2026-0340 - Cargo.lockquinn-proto 0.11.17 — RUSTSEC-2026-0343
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.5, fixed in 0.11.18
https://osv.dev/vulnerability/RUSTSEC-2026-0343 - fuzz/Cargo.lockquinn-proto 0.11.17 — RUSTSEC-2026-0343
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.5, fixed in 0.11.18
https://osv.dev/vulnerability/RUSTSEC-2026-0343 - Cargo.lockrustls 0.23.45 — RUSTSEC-2026-0346
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 4.0, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0346 - fuzz/Cargo.lockrustls 0.23.45 — RUSTSEC-2026-0346
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 4.0, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0346 - Cargo.lockrustls 0.23.45 — RUSTSEC-2026-0348
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 3.7, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0348 - fuzz/Cargo.lockrustls 0.23.45 — RUSTSEC-2026-0348
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 3.7, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0348 - Cargo.lockrustls 0.23.45 — RUSTSEC-2026-0349
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 3.7, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0349 - fuzz/Cargo.lockrustls 0.23.45 — RUSTSEC-2026-0349
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 3.7, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0349 - Cargo.locklru 0.12.5 — RUSTSEC-2026-0002
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 2.7, fixed in 0.16.3
https://osv.dev/vulnerability/RUSTSEC-2026-0002 - Cargo.lockrustls 0.23.45 — RUSTSEC-2026-0347
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 2.3, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0347 - fuzz/Cargo.lockrustls 0.23.45 — RUSTSEC-2026-0347
direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 2.3, fixed in 0.23.46
https://osv.dev/vulnerability/RUSTSEC-2026-0347 - Cargo.locklru 0.12.5 — RUSTSEC-2026-0253
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 0.18.2
https://osv.dev/vulnerability/RUSTSEC-2026-0253 - Cargo.lockpaste 1.0.15 — RUSTSEC-2024-0436
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published
https://osv.dev/vulnerability/RUSTSEC-2024-0436 - Cargo.lockquinn-proto 0.11.17 — RUSTSEC-2026-0338
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 0.11.18
https://osv.dev/vulnerability/RUSTSEC-2026-0338 - fuzz/Cargo.lockquinn-proto 0.11.17 — RUSTSEC-2026-0338
direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 0.11.18
https://osv.dev/vulnerability/RUSTSEC-2026-0338
Maintenance
- recency
last commit 27 day(s) before 2026-10-16
- issue_responsiveness
this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.
- release_cadence
released 27 day(s) ago (by releases), inside `03` §5's 30-day window
- bus_factor
sole maintainer
- repository_signals
`03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.
Transparency
- license
LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text
- readme_quality
README.md: configuration documented (+25)
- declared_scopes
specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.
- changelog
CHANGELOG.md present
- security_contact
SECURITY.md present
Contest a finding
Every number here comes from a rule reading published source, and rules get things wrong. If something on this page is incorrect — or correct but mitigated by a check the rule cannot see — open an issue and we answer it in writing. A finding we got wrong is removed and the rule is fixed; one that stands is answered on the record.
Anyone can file: the maintainer, a researcher who disagrees with the classification, or a user who tested the server and could not reproduce it. Name this server and the rule or advisory ID shown beside the finding above. We aim to reply within five business days and to resolve within ten.