io.github.pedroknigge/arkgate

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• bin/lib/ark-order-invariants.mjs:48mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

              throw new ArkOrderError('ARKORDER_NESTED_XI', `${label} key ${JSON.stringify(key)} is not a slow primitive (nested values are microstate)`);
          }
          out[key] = Object.is(value, -0) ? 0 : value;
      }
      return Object.freeze(out);

• bin/lib/write-path-capabilities.mjs:516mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

    }
    for (const capability of WRITE_CAPABILITY_NAMES) {
      evidence[capability] = unique(evidence[capability]);
    }
  

• bin/ark-dashboard.mjs:96mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    const timer = setTimeout(() => controller.abort(), fetchTimeoutMs);
    try {
      const res = await fetch(url, { signal: controller.signal });
      if (!res.ok) {
        return { ok: false, kind: 'failure', error: `HTTP ${res.status}` };

• bin/lib/ci-and-commands.mjs:560mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

      let text;
      try {
        text = fs.readFileSync(path.join(dir, name), 'utf8');
      } catch {
        continue;

• bin/lib/flat-parent-importers.mjs:94mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

  function readText(root, rel) {
    try {
      return fs.readFileSync(path.join(root, rel), 'utf8');
    } catch {
      return '';

• bin/lib/gate-files.mjs:731mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

      let content = '';
      try {
        content = fs.readFileSync(path.join(workflowsDir, file), 'utf8');
      } catch {
        continue;

• bin/lib/github-enforcement.mjs:285mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

      return fs.readdirSync(directory)
        .filter((file) => /\.ya?ml$/i.test(file))
        .map((file) => ({ file, text: fs.readFileSync(path.join(directory, file), 'utf8') }));
    } catch {
      return [];

• bin/lib/html-report.mjs:39mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

    const fileIncludes = (rel, needle) => {
      try {
        return fs.readFileSync(path.join(root, rel), 'utf8').includes(needle);
      } catch {
        return false;

• bin/lib/html-report.mjs:373mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

    if (!noArchive) {
      const stamp = new Date().toISOString().replace(/[:.]/g, '-');
      fs.writeFileSync(path.join(historyDir, `${stamp}.json`), `${JSON.stringify(snapshot, null, 2)}\n`);
      // Cap history: keep newest ARK_REPORT_HISTORY_MAX JSON files.
      try {

• bin/lib/install-migrate.mjs:104mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

      let text;
      try {
        text = fs.readFileSync(path.join(root, rel), 'utf8');
      } catch {
        continue;

• bin/lib/install-migrate.mjs:120mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

      let json;
      try {
        json = JSON.parse(fs.readFileSync(path.join(root, rel), 'utf8'));
      } catch {
        continue;

• bin/lib/install-migrate.mjs:549mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

        let existing = '';
        try {
          existing = fs.readFileSync(path.join(root, relativePath), 'utf8');
        } catch {
          // Missing file → write the generated Ark template.

• bin/lib/mcp-adoption.mjs:124mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

      let json;
      try {
        json = JSON.parse(fs.readFileSync(path.join(root, rel), 'utf8'));
      } catch {
        continue;

• bin/lib/mcp-adoption.mjs:403mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

          for (const f of fs.readdirSync(wfDir)) {
            if (!/\.ya?ml$/i.test(f)) continue;
            const text = fs.readFileSync(path.join(wfDir, f), 'utf8');
            if (text.includes('--baseline') && (text.includes('ark-check') || text.includes('arkgate-check'))) {
              primaryPathUsesBaseline = true;

• bin/lib/skill-install.mjs:588mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

      .map((entry) => entry.name)
      .sort()
      .map((name) => [path.basename(name, '.md'), fs.readFileSync(path.join(dir, name), 'utf8')]);
  }
  

• bin/lib/weakest-link.mjs:133mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

      let text = '';
      try {
        text = fs.readFileSync(path.join(wfDir, f), 'utf8');
      } catch {
        continue;

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  no committed credential found, and no environment variable with a credential-shaped name is read anywhere in the source

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it. A tool-list handler IS present, so the tools are built in a shape this counter could not enumerate.

Maintenance

• recency

  last commit 2 day(s) before 2026-10-16

• issue_responsiveness

  median over 3 issue(s) in the last 6 months: 1.2 day(s) to first maintainer comment

• release_cadence

  released 2 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  this repository's 12-month history is longer than the bounded walk `04` §7 performs, and the authors found so far span more than one of `03` §5's bands. A limit of ours, not a finding about the server.

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  CHANGELOG.md present

• security_contact

  SECURITY.md present