io.github.sandraschi/leanforge-mcp

version 0.1.0

scanned 2026-10-16
source github.com/sandraschi/leanforge-mcp
commit 67592f6bf91a
transport stdio
files read 46
methodology 0.2.0
ruleset 0.1.1

Code Safetyweight 30

Auth Postureweight 20

100measured on 65% of this axis

Dependency Healthweight 20

Maintenanceweight 15

93measured on 45% of this axis

Transparencyweight 15

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

src/leanforge_mcp/core/job_manager.py:139mcp-python-sql-string-built (medium/medium)

A SQL statement is assembled by string building rather than passed as a parameterised query. Every driver here accepts parameters as a second argument; building the string is never necessary.

            if col not in existing:
                logger.info("Migrating jobs table: adding column %s", col)
                await db.execute(f"ALTER TABLE jobs ADD COLUMN {col} {col_type}")

    def _owner_alive(self, pid: int | None, started_at: float | None) -> bool:

webapp/backend/routes/problems.py:128mcp-python-sql-string-built (medium/medium)
A SQL statement is assembled by string building rather than passed as a parameterised query. Every driver here accepts parameters as a second argument; building the string is never necessary.
```
    db_path = request.app.state.config.database.path
    async with aiosqlite.connect(db_path) as db:
        await db.execute(
            f"UPDATE problems SET {', '.join(fields)} WHERE id=?", values
        )
```
scripts/cua-smoke.py:151mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
                headers={"Content-Type": "application/json"},
            )
            resp = urllib.request.urlopen(r, timeout=30)
            return json.loads(resp.read())
        except Exception as e:
```
scripts/cua-smoke.py:349mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    for attempt in range(MAX_RETRY):
        try:
            resp = urllib.request.urlopen(f"{BACKEND_URL}{HEALTH_PATH}", timeout=5)
            if resp.status == 200:
                log(f"Backend healthy (attempt {attempt + 1})")
```
scripts/cua-smoke.py:393mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
def check_feature_route():
    try:
        resp = urllib.request.urlopen(f"{BACKEND_URL}{FEATURE_PATH}", timeout=5)
        body = json.loads(resp.read())
        log(f"Feature route {FEATURE_PATH}: HTTP {resp.status}")
```
scripts/cua-smoke.py:406mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
def check_diagnostics():
    try:
        resp = urllib.request.urlopen(f"{BACKEND_URL}{DIAGNOSTICS_PATH}", timeout=5)
        data = json.loads(resp.read())
        if data.get("success"):
```

webapp/frontend/src/pages/ProblemLibrary.tsx:50mcp-js-ssrf-nonliteral-url (medium/low)

An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  const handleSubmitJob = async (p: Problem) => {
    const source = p.lean_source || `import Mathlib\n\ntheorem ${p.title.replace(/\s+/g, "_")} : ${p.statement} := by\n  sorry\n`;
    const res = await fetch(API_BASE + "/jobs", {
      method: "POST",
      headers: { "Content-Type": "application/json" },

Auth Posture

authentication_model
stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here
transport_security
declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)
secret_handling
detect-secrets matched 11 credential-shaped string(s), every one from a keyword or entropy heuristic (Hex High Entropy String, Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at CLAUDE.md:99; Secret Keyword at INSTALL.md:69; Secret Keyword at INSTALL.md:70; Secret Keyword at config.example.toml:54; Secret Keyword at config.example.toml:63; Secret Keyword at docs/CONFIGURATION.md:107; Secret Keyword at docs/CONFIGURATION.md:108; Hex High Entropy String at server.json:14; Secret Keyword at src/leanforge_mcp/core/config.py:45; Secret Keyword at src/leanforge_mcp/core/config.py:53; …and 1 more matches
authorization_granularity
8 tool registrations and no conditional access logic found — `03` §4 calls this case 'needs human review' and assigns it no score band, so it is not scored here

Dependency Health

uv.lockanyio 4.13.0 — PYSEC-2026-4025
transitive, CVSS 9.3, fixed in 4.14.2
https://osv.dev/vulnerability/PYSEC-2026-4025
uv.lockpyjwt 2.13.0 — PYSEC-2026-4145
transitive, CVSS 9.1, fixed in 2.14.0
https://osv.dev/vulnerability/PYSEC-2026-4145
webapp/frontend/package-lock.jsonvite 5.4.21 — GHSA-fx2h-pf6j-xcff
direct, CVSS 8.2, fixed in 6.4.3
https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff
webapp/frontend/package-lock.jsonpostcss 8.5.16 — GHSA-r28c-9q8g-f849
direct, CVSS 7.5, fixed in 8.5.18
https://osv.dev/vulnerability/GHSA-r28c-9q8g-f849
webapp/frontend/package-lock.jsonbraces 3.0.3 — GHSA-vfj7-8cjw-p6xm
transitive, CVSS 8.7
https://osv.dev/vulnerability/GHSA-vfj7-8cjw-p6xm
uv.lockcryptography 48.0.1 — PYSEC-2026-3553
transitive, CVSS 8.7, fixed in 49.0.0
https://osv.dev/vulnerability/PYSEC-2026-3553
webapp/frontend/package-lock.jsonsource-map-js 1.2.1 — GHSA-68fv-2mgg-jv7q
transitive, CVSS 8.7, fixed in 1.2.2
https://osv.dev/vulnerability/GHSA-68fv-2mgg-jv7q
uv.lockcryptography 48.0.1 — PYSEC-2026-3552
transitive, CVSS 8.2, fixed in 50.0.0
https://osv.dev/vulnerability/PYSEC-2026-3552
webapp/frontend/package-lock.jsonnanoid 3.3.15 — GHSA-28wg-ghj8-5hjv
transitive, CVSS 8.2, fixed in 3.3.16
https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv
webapp/frontend/package-lock.jsonnanoid 3.3.15 — GHSA-2v37-7h3g-55p8
transitive, CVSS 8.2, fixed in 3.3.18
https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8
uv.lockpyjwt 2.13.0 — PYSEC-2026-4183
transitive, CVSS 8.2, fixed in 2.15.0
https://osv.dev/vulnerability/PYSEC-2026-4183
uv.lockmcp 1.27.2 — PYSEC-2026-3483
transitive, CVSS 7.6, fixed in 1.28.1
https://osv.dev/vulnerability/PYSEC-2026-3483
webapp/frontend/package-lock.jsonbrowserslist 4.28.5 — GHSA-73wf-gq98-2v4g
transitive, CVSS 7.5, fixed in 4.28.7
https://osv.dev/vulnerability/GHSA-73wf-gq98-2v4g
webapp/frontend/package-lock.jsonbrowserslist 4.28.5 — GHSA-c83g-rgw3-j3cx
transitive, CVSS 7.5, fixed in 4.28.7
https://osv.dev/vulnerability/GHSA-c83g-rgw3-j3cx
uv.lockmcp 1.27.2 — GHSA-84m7-p3x7-pcfv
transitive, CVSS 7.5, fixed in 1.30.0
https://osv.dev/vulnerability/GHSA-84m7-p3x7-pcfv
uv.lockstarlette 1.2.1 — PYSEC-2026-249
transitive, CVSS 7.5, fixed in 1.3.1
https://osv.dev/vulnerability/PYSEC-2026-249
uv.lockpyjwt 2.13.0 — PYSEC-2026-4143
transitive, CVSS 7.4, fixed in 2.14.0
https://osv.dev/vulnerability/PYSEC-2026-4143
uv.lockpyjwt 2.13.0 — PYSEC-2026-4144
transitive, CVSS 7.4, fixed in 2.14.0
https://osv.dev/vulnerability/PYSEC-2026-4144
uv.lockpyjwt 2.13.0 — PYSEC-2026-4149
transitive, CVSS 7.4, fixed in 2.14.0
https://osv.dev/vulnerability/PYSEC-2026-4149
uv.lockpyjwt 2.13.0 — PYSEC-2026-4150
transitive, CVSS 7.4, fixed in 2.14.0
https://osv.dev/vulnerability/PYSEC-2026-4150
uv.lockpyjwt 2.13.0 — PYSEC-2026-4151
transitive, CVSS 7.4, fixed in 2.14.0
https://osv.dev/vulnerability/PYSEC-2026-4151
webapp/frontend/package-lock.jsonreact-router-dom 6.30.4 — GHSA-jjmj-jmhj-qwj2
direct, CVSS 6.9, fixed in 6.30.6
https://osv.dev/vulnerability/GHSA-jjmj-jmhj-qwj2
webapp/frontend/package-lock.jsonpostcss 8.5.16 — GHSA-fxqj-rqcc-2cmp
direct, CVSS 6.3, fixed in 8.5.23
https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp
webapp/frontend/package-lock.jsonvite 5.4.21 — GHSA-4w7w-66w2-5vf9
direct, CVSS 6.3, fixed in 6.4.2
https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9
webapp/frontend/package-lock.jsonvite 5.4.21 — GHSA-v6wh-96g9-6wx3
direct, CVSS 5.5, fixed in 6.4.3
https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3
uv.lockcryptography 48.0.1 — PYSEC-2026-3554
transitive, CVSS 6.9, fixed in 49.0.0
https://osv.dev/vulnerability/PYSEC-2026-3554
uv.lockanyio 4.13.0 — PYSEC-2026-4024
transitive, CVSS 6.8, fixed in 4.14.2
https://osv.dev/vulnerability/PYSEC-2026-4024
webapp/frontend/package-lock.jsonbaseline-browser-mapping 2.10.42 — GHSA-w5vr-8v7q-w6rv
transitive, CVSS 6.6, fixed in 2.11.0
https://osv.dev/vulnerability/GHSA-w5vr-8v7q-w6rv
uv.lockpyjwt 2.13.0 — PYSEC-2026-4146
transitive, CVSS 6.5
https://osv.dev/vulnerability/PYSEC-2026-4146
webapp/frontend/package-lock.jsonreact-router 6.30.4 — GHSA-337j-9hxr-rhxg
transitive, CVSS 6.1, fixed in 7.18.0
https://osv.dev/vulnerability/GHSA-337j-9hxr-rhxg
webapp/frontend/package-lock.jsonpostcss-selector-parser 6.1.4 — GHSA-rj75-hqrm-r3gf
transitive, CVSS 5.9, fixed in 7.1.6
https://osv.dev/vulnerability/GHSA-rj75-hqrm-r3gf
uv.lockpyjwt 2.13.0 — PYSEC-2026-4152
transitive, CVSS 5.9, fixed in 2.14.0
https://osv.dev/vulnerability/PYSEC-2026-4152
webapp/frontend/package-lock.jsonesbuild 0.21.5 — GHSA-67mh-4wv8-2f99
transitive, CVSS 5.3, fixed in 0.25.0
https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99
uv.lockpydantic-settings 2.14.1 — GHSA-4xgf-cpjx-pc3j
transitive, CVSS 5.3, fixed in 2.14.2
https://osv.dev/vulnerability/GHSA-4xgf-cpjx-pc3j
uv.lockpyjwt 2.13.0 — PYSEC-2026-4140
transitive, CVSS 5.3, fixed in 2.14.0
https://osv.dev/vulnerability/PYSEC-2026-4140
uv.lockpyjwt 2.13.0 — PYSEC-2026-4141
transitive, CVSS 5.3, fixed in 2.15.0
https://osv.dev/vulnerability/PYSEC-2026-4141
uv.lockpyjwt 2.13.0 — PYSEC-2026-4142
transitive, CVSS 5.3, fixed in 2.14.0
https://osv.dev/vulnerability/PYSEC-2026-4142
uv.lockstarlette 1.2.1 — PYSEC-2026-248
transitive, CVSS 5.3, fixed in 1.3.0
https://osv.dev/vulnerability/PYSEC-2026-248
webapp/frontend/package-lock.jsonreact-router 6.30.4 — GHSA-wrjc-x8rr-h8h6
transitive, CVSS 5.1, fixed in 7.18.0
https://osv.dev/vulnerability/GHSA-wrjc-x8rr-h8h6
uv.lockpyjwt 2.13.0 — PYSEC-2026-4147
transitive, CVSS 4.8, fixed in 2.14.0
https://osv.dev/vulnerability/PYSEC-2026-4147
uv.lockpyjwt 2.13.0 — PYSEC-2026-4148
transitive, CVSS 4.4, fixed in 2.14.0
https://osv.dev/vulnerability/PYSEC-2026-4148

Maintenance

recency
last commit 3 day(s) before 2026-10-16
issue_responsiveness
this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.
release_cadence
a release exists but fewer than two fall inside `03` §5's 12-month window, so no median gap can be taken — and §5's remaining bands are all defined on that median. A limit of the methodology, not of this repository.
bus_factor
2 regular authors in the last 12 months
repository_signals
`03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

license
LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text
readme_quality
README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)
declared_scopes
neither the README nor the MCP manifest documents what the server accesses or what side effects it has
changelog
CHANGELOG.md present
security_contact
no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately

Contest a finding

Every number here comes from a rule reading published source, and rules get things wrong. If something on this page is incorrect — or correct but mitigated by a check the rule cannot see — open an issue and we answer it in writing. A finding we got wrong is removed and the rule is fixed; one that stands is answered on the record.

Anyone can file: the maintainer, a researcher who disagrees with the classification, or a user who tested the server and could not reproduce it. Name this server and the rule or advisory ID shown beside the finding above. We aim to reply within five business days and to resolve within ten.

Open an appeal on GitHub