io.github.Lukie-81/reporelay

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Auth Posture

• authentication_model

  network transport, and no authentication middleware, credential-header read, or inbound token verification appears anywhere in the source we fetched — `03` §4's "no authentication; HTTP transport" band

• transport_security

  transport is streamable-http but the entry declares no endpoint URL to read a scheme from

• secret_handling

  detect-secrets matched 10 credential-shaped string(s), every one from a keyword or entropy heuristic (Hex High Entropy String, Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at dist/audit.js:159; Hex High Entropy String at dist/tunnel-client-install.js:26; Hex High Entropy String at dist/tunnel-client-install.js:32; Hex High Entropy String at dist/tunnel-client-install.js:38; Hex High Entropy String at dist/tunnel-client-install.js:44; Hex High Entropy String at dist/tunnel-client-install.js:50; Hex High Entropy String at dist/tunnel-client-install.js:56; Secret Keyword at dist/tunnel-client-install.js:203; Secret Keyword at docs/chatgpt-web.md:137; Secret Keyword at docs/chatgpt-web.md:143

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 46 day(s) before 2026-10-16

• issue_responsiveness

  median over 4 issue(s) in the last 6 months: 8.7 day(s) to first maintainer comment

• release_cadence

  median release gap 0 days (by tags), last release 61 day(s) ago

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  SECURITY.md present