io.github.ldclabs/KIP

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• conformance/engine-runner.mjs:37mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

      for (const key of Object.keys(value).sort()) {
        if (VOLATILE.has(key)) continue
        out[key] = normalize(value[key], tagOf, seen)
      }
      return out

• conformance/engine-runner.mjs:106mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

   */
  export function caseRequest(testCase, parameters = {}) {
    if (!testCase.operations) return request(testCase.command, { ...parameters, ...testCase.params }, testCase.envelope ?? {})
    return {
      kip: '2.0',

• conformance/engine-runner.mjs:130mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        for (const setup of fixture.setup ?? []) {
          const step = typeof setup === 'string' ? { command: setup } : setup
          const outcome = flatten(await adapter.execute(request(step.command, { ...parameters, ...step.params })))
          if (outcome.error) throw new Error(`setup failed with ${outcome.error.code}: ${outcome.error.message}`)
          // Capture raw read values, including the engine's actual basis. Never

• v1/mcp/kip-mcp-server/src/services/kipClient.ts:40mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  
    try {
      const res = await fetch(opts.baseUrl, {
        method: 'POST',
        headers: getHeaders(opts),

• v1/skill/kip-cognitive-nexus/scripts/execute_kip.py:105mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

  
      try:
          with urlopen(req, timeout=TIMEOUT_SECONDS) as response:
              response_body = response.read().decode("utf-8")
              return json.loads(response_body)

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  detect-secrets matched 1 credential-shaped string(s), every one from a keyword or entropy heuristic (Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at README.md:52

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 7 day(s) before 2026-10-16

• issue_responsiveness

  every issue read was filed by the project itself (6 by its maintainers or bots), so none is someone outside waiting for an answer, and `03` §5's question — will anyone read an issue I file? — has nothing to measure.

• release_cadence

  median release gap 7 days (by releases), last release 47 day(s) ago

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  no LICENSE file and no license field in any package manifest — `03` §7: without a license, a consumer has no grant to use the server at all

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately