io.github.jrullan/ducklab

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• internal/xplat/xplat.go:157mcp-go-shell-exec-interpreter (critical/medium)

  A shell interpreter is invoked with a constructed command string. Go's exec.Command is safe by default precisely because it takes an argument vector; routing through `sh -c` gives that safety away.

  		c = exec.Command("cmd", "/C", cmd)
  	} else {
  		c = exec.Command("/bin/sh", "-c", cmd)
  	}
  	c.Dir = workdir

• frontend/src/lib/colors.ts:189mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

      // Past eight the palette stops clearing the colour-vision floor, so a ninth
      // is muted rather than a colour that only looks distinct.
      out[id] = slot <= SERIES_SLOTS ? `var(--series-${slot})` : "var(--text-muted)";
      taken.add(slot);
      slot++;

• frontend/src/views/Settings.tsx:300mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

      const r: Record<string, string> = {};
      for (const mode of Object.keys(v.script_rounds ?? {})) {
        r[mode] = v.rounds[mode] ? String(v.rounds[mode]) : "";
      }
      setRounds(r);

• frontend/src/views/Settings.tsx:305mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

      const rt: Record<string, string> = {};
      for (const role of Object.keys(v.script_role_turns ?? {})) {
        rt[role] = v.role_turns?.[role] ? String(v.role_turns[role]) : "";
      }
      setRoleTurns(rt);

• internal/engineclt/engineclt.go:53mcp-go-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.

  			bodyReader = bytes.NewReader(data)
  		}
  		req, err := http.NewRequest(method, c.BaseURL+path, bodyReader)
  		if err != nil {
  			return nil, err

• internal/engineclt/engineclt.go:846mcp-go-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.

  
  func (c *Client) streamEvents(ctx context.Context, url string, fn func(SSEEvent) bool) error {
  	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
  	if err != nil {
  		return err

• internal/provider/openaicompat.go:144mcp-go-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.

  // silently running on a 32k default that starves a 200k model.
  func (p *OpenAICompat) ModelInfo(ctx context.Context, model string) (*ModelInfo, error) {
  	req, err := http.NewRequestWithContext(ctx, "GET", p.baseURL+"/models", nil)
  	if err != nil {
  		return nil, err

• internal/provider/openaicompat.go:194mcp-go-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.

  
  func (p *OpenAICompat) Models(ctx context.Context) ([]string, error) {
  	req, err := http.NewRequestWithContext(ctx, "GET", p.baseURL+"/models", nil)
  	if err != nil {
  		return nil, fmt.Errorf("create request: %w", err)

• internal/provider/openaicompat.go:238mcp-go-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.

  		return ChatResponse{}, fmt.Errorf("marshal request: %w", err)
  	}
  	httpReq, err := http.NewRequestWithContext(ctx, "POST", p.baseURL+"/chat/completions", strings.NewReader(string(body)))
  	if err != nil {
  		return ChatResponse{}, fmt.Errorf("create request: %w", err)

• internal/provider/openaicompat.go:410mcp-go-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.

  	}
  
  	httpReq, err := http.NewRequestWithContext(ctx, "POST", p.baseURL+"/chat/completions", strings.NewReader(string(body)))
  	if err != nil {
  		return ChatResponse{}, fmt.Errorf("create request: %w", err)

• internal/provider/openaicompat.go:781mcp-go-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.

  		return ChatResponse{}, fmt.Errorf("marshal request: %w", err)
  	}
  	httpReq, err := http.NewRequestWithContext(ctx, "POST", p.baseURL+"/v1/messages", strings.NewReader(string(jsonBody)))
  	if err != nil {
  		return ChatResponse{}, fmt.Errorf("create request: %w", err)

• internal/service/bugattach.go:56mcp-go-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and opened without confinement. filepath.Join cleans `..` but does not confine: a component of "../../etc/passwd" still resolves outside the base.

  		return nil, err
  	}
  	if err := os.WriteFile(filepath.Join(dir, name), data, 0o644); err != nil {
  		return nil, err
  	}

• internal/service/bugattach.go:116mcp-go-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and opened without confinement. filepath.Join cleans `..` but does not confine: a component of "../../etc/passwd" still resolves outside the base.

  			continue
  		}
  		data, err := os.ReadFile(filepath.Join(attachmentsDir(projectPath, bugID), name))
  		if err != nil {
  			continue

• internal/service/release.go:590mcp-go-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and opened without confinement. filepath.Join cleans `..` but does not confine: a component of "../../etc/passwd" still resolves outside the base.

  			continue
  		}
  		body, err := os.ReadFile(filepath.Join(release.Dir(entry.Path), n.Name()))
  		if err != nil {
  			continue

• internal/service/review.go:291mcp-go-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and opened without confinement. filepath.Join cleans `..` but does not confine: a component of "../../etc/passwd" still resolves outside the base.

  			continue
  		}
  		body, err := os.ReadFile(filepath.Join(review.Dir(entry.Path), n.Name()))
  		if err != nil {
  			continue

• internal/service/runview.go:137mcp-go-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and opened without confinement. filepath.Join cleans `..` but does not confine: a component of "../../etc/passwd" still resolves outside the base.

  			continue
  		}
  		data, err := os.ReadFile(filepath.Join(candDir, e.Name()))
  		if err != nil {
  			continue

• internal/service/runview.go:164mcp-go-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and opened without confinement. filepath.Join cleans `..` but does not confine: a component of "../../etc/passwd" still resolves outside the base.

  		return "", fmt.Errorf("run %q not found", id)
  	}
  	data, err := os.ReadFile(filepath.Join(dir, name))
  	if err != nil {
  		if os.IsNotExist(err) {

• internal/service/scorecard.go:153mcp-go-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and opened without confinement. filepath.Join cleans `..` but does not confine: a component of "../../etc/passwd" still resolves outside the base.

  				continue
  			}
  			raw, e := os.ReadFile(filepath.Join(root, sd.Name(), f.Name()))
  			if e != nil {
  				continue

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  detect-secrets matched 16 credential-shaped string(s), every one from a keyword or entropy heuristic (Base64 High Entropy String, Hex High Entropy String, Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Base64 High Entropy String at cmd/ducklab-desktop/frontend/dist/assets/index-ls-N76SS.js:57; Hex High Entropy String at cmd/fake-engine/main.go:409; Secret Keyword at docs/spec/02-DATA-MODEL.md:130; Secret Keyword at docs/spec/02-DATA-MODEL.md:140; Secret Keyword at docs/spec/02-DATA-MODEL.md:146; Base64 High Entropy String at frontend/src/lib/attention.ts:103; Hex High Entropy String at frontend/src/lib/format.test.ts:50; Hex High Entropy String at frontend/src/lib/runview.test.ts:666; Secret Keyword at frontend/src/views/ducklings.test.tsx:40; Hex High Entropy String at frontend/src/views/views.test.tsx:58; …and 6 more matches

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Dependency Health

• frontend/package-lock.jsonvitest 2.1.9 — GHSA-5xrq-8626-4rwp

  direct, CVSS 9.8, fixed in 3.2.6

  https://osv.dev/vulnerability/GHSA-5xrq-8626-4rwp
• frontend/package-lock.jsontinypool 1.1.1 — GHSA-5gmw-xhrv-c9v3

  transitive, CVSS 9.5, fixed in 2.1.1

  https://osv.dev/vulnerability/GHSA-5gmw-xhrv-c9v3
• frontend/package-lock.jsontinypool 1.1.1 — GHSA-85c8-ppgw-ccpr

  transitive, CVSS 9.5, fixed in 2.1.2

  https://osv.dev/vulnerability/GHSA-85c8-ppgw-ccpr
• frontend/package-lock.jsonvite 5.4.21 — GHSA-fx2h-pf6j-xcff

  direct, CVSS 8.2, fixed in 6.4.3

  https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff
• frontend/package-lock.jsonbraces 3.0.3 — GHSA-vfj7-8cjw-p6xm

  transitive, CVSS 8.7

  https://osv.dev/vulnerability/GHSA-vfj7-8cjw-p6xm
• frontend/package-lock.jsonsource-map-js 1.2.1 — GHSA-68fv-2mgg-jv7q

  transitive, CVSS 8.7, fixed in 1.2.2

  https://osv.dev/vulnerability/GHSA-68fv-2mgg-jv7q
• frontend/package-lock.jsonnanoid 3.3.16 — GHSA-2v37-7h3g-55p8

  transitive, CVSS 8.2, fixed in 3.3.18

  https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8
• frontend/package-lock.jsonvite 5.4.21 — GHSA-4w7w-66w2-5vf9

  direct, CVSS 6.3, fixed in 6.4.2

  https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9
• frontend/package-lock.jsonvitest 2.1.9 — GHSA-82fw-gwwq-j7x9

  direct, CVSS 5.9, fixed in 4.1.11

  https://osv.dev/vulnerability/GHSA-82fw-gwwq-j7x9
• frontend/package-lock.jsonvite 5.4.21 — GHSA-v6wh-96g9-6wx3

  direct, CVSS 5.5, fixed in 6.4.3

  https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3
• frontend/package-lock.json@vitest/mocker 2.1.9 — GHSA-82fw-gwwq-j7x9

  transitive, CVSS 5.9, fixed in 4.1.11

  https://osv.dev/vulnerability/GHSA-82fw-gwwq-j7x9
• frontend/package-lock.jsonpostcss-selector-parser 6.1.4 — GHSA-rj75-hqrm-r3gf

  transitive, CVSS 5.9, fixed in 7.1.6

  https://osv.dev/vulnerability/GHSA-rj75-hqrm-r3gf
• frontend/package-lock.jsonesbuild 0.21.5 — GHSA-67mh-4wv8-2f99

  transitive, CVSS 5.3, fixed in 0.25.0

  https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99
• go.modgolang.org/x/sys 0.43.0 — GO-2026-5024

  transitive, no CVSS published, fixed in 0.44.0

  https://osv.dev/vulnerability/GO-2026-5024

Maintenance

• recency

  last commit 5 day(s) before 2026-10-16

• issue_responsiveness

  every issue read was filed by the project itself (4 by its maintainers or bots), so none is someone outside waiting for an answer, and `03` §5's question — will anyone read an issue I file? — has nothing to measure.

• release_cadence

  median release gap 1 days (by releases), last release 37 day(s) ago

• bus_factor

  this repository's 12-month history is longer than the bounded walk `04` §7 performs, and the authors found so far span more than one of `03` §5's bands. A limit of ours, not a finding about the server.

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately