io.github.marcelo-ochoa/mikrotik

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• tools/report.ts:44mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

                  try {
                      const trafficReplies = await currentApi.talk(["/interface/monitor-traffic", `=interface=${name}`, "=once="]);
                      report.traffic[name] = trafficReplies.filter(r => r.command === "!re").map(r => r.attributes)[0] || {};
                  } catch (e) {
                      report.traffic[name] = "Error: " + (e as Error).message;

• tools/report.ts:46mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

                      report.traffic[name] = trafficReplies.filter(r => r.command === "!re").map(r => r.attributes)[0] || {};
                  } catch (e) {
                      report.traffic[name] = "Error: " + (e as Error).message;
                  }
              }

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  detect-secrets matched 2 credential-shaped string(s), every one from a keyword or entropy heuristic (Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at Demos.md:112; Secret Keyword at README.md:97

• authorization_granularity

  1 tool registration(s) detected — at or below `03` §4's threshold of 3, so there is no multi-tool surface to segregate

Maintenance

• recency

  last commit 56 day(s) before 2026-10-16

• issue_responsiveness

  this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.

• release_cadence

  no release in 570 days (by releases) — over a year

• bus_factor

  3 authors with >= 5 commits in 12 months

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text

• readme_quality

  README.md: configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.

• changelog

  CHANGELOG.md present

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately