io.github.LeandroPG19/cuba-memorys

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• npm/postinstall.js:46mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

          .get(u, (res) => {
            if (res.statusCode === 301 || res.statusCode === 302) {
              request(res.headers.location);
              return;
            }

• npm/postinstall.js:72mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

          .on("error", fail);
      };
      request(url);
    });
  }

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  detect-secrets matched 11 credential-shaped string(s), every one from a keyword or entropy heuristic (Basic Auth Credentials, Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at CHANGELOG.md:499; Basic Auth Credentials at README.md:55; Basic Auth Credentials at packaging/cuba-memorys.service:90; Basic Auth Credentials at scripts/backup-db.sh:8; Basic Auth Credentials at scripts/demo.sh:64; Secret Keyword at scripts/gen-eval-dataset.py:41; Basic Auth Credentials at scripts/mcp_live_session_test.py:30; Basic Auth Credentials at scripts/merge-gate.sh:35; Basic Auth Credentials at scripts/restore-db.sh:12; Basic Auth Credentials at scripts/run-all-tests.sh:7; …and 1 more matches

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 2 day(s) before 2026-10-16

• issue_responsiveness

  every issue read was filed by the project itself (1 by its maintainers or bots), so none is someone outside waiting for an answer, and `03` §5's question — will anyone read an issue I file? — has nothing to measure.

• release_cadence

  released 2 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  this repository's 12-month history is longer than the bounded walk `04` §7 performs, and the authors found so far span more than one of `03` §5's bands. A limit of ours, not a finding about the server.

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.

• changelog

  CHANGELOG.md present

• security_contact

  SECURITY.md present