io.github.software-mansion/argent

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• assets/trace-processor/engine_bundle.node.js:1786mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

  		      for (const key of [ "mode", "atime", "mtime", "ctime" ]) {
  		        if (attr[key] != null) {
  		          node[key] = attr[key];
  		        }
  		      }

• assets/trace-processor/engine_bundle.node.js:2127mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

  		      for (const key of [ "mode", "atime", "mtime", "ctime" ]) {
  		        if (attr[key] != null) {
  		          node[key] = attr[key];
  		        }
  		      }

• assets/trace-processor/engine_bundle.node.js:4907mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

  		      // explicitly set to be so. We allow user code to do that to
  		      // force variables with default values to remain unset.
  		      if (ENV[x] === undefined) delete env[x]; else env[x] = ENV[x];
  		    }
  		    var strings = [];

• assets/trace-processor/engine_bundle.node.js:6972mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

  		      for (const key of [ "mode", "atime", "mtime", "ctime" ]) {
  		        if (attr[key] != null) {
  		          node[key] = attr[key];
  		        }
  		      }

• assets/trace-processor/engine_bundle.node.js:7313mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

  		      for (const key of [ "mode", "atime", "mtime", "ctime" ]) {
  		        if (attr[key] != null) {
  		          node[key] = attr[key];
  		        }
  		      }

• assets/trace-processor/engine_bundle.node.js:10089mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

  		      // explicitly set to be so. We allow user code to do that to
  		      // force variables with default values to remain unset.
  		      if (ENV[x] === undefined) delete env[x]; else env[x] = ENV[x];
  		    }
  		    var strings = [];

• assets/trace-processor/engine_bundle.node.js:663mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  		    readAsync = async url => {
  		      assert(!isFileURI(url), "readAsync does not work with file:// URLs");
  		      var response = await fetch(url, {
  		        credentials: "same-origin"
  		      });

• assets/trace-processor/engine_bundle.node.js:5847mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  		    readAsync = async url => {
  		      assert(!isFileURI(url), "readAsync does not work with file:// URLs");
  		      var response = await fetch(url, {
  		        credentials: "same-origin"
  		      });

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  detect-secrets matched 17 credential-shaped string(s), every one from a keyword or entropy heuristic (Base64 High Entropy String, Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at dist/cli-cmds.mjs:1427; Secret Keyword at dist/cli-cmds.mjs:2062; Secret Keyword at dist/cli-cmds.mjs:2063; Secret Keyword at dist/cli-cmds.mjs:4529; Base64 High Entropy String at dist/cli-cmds.mjs:7526; Secret Keyword at dist/installer.mjs:13294; Base64 High Entropy String at dist/installer.mjs:16291; Secret Keyword at dist/installer.mjs:16576; Base64 High Entropy String at dist/mcp-server.mjs:14109; Secret Keyword at dist/mcp-server.mjs:16633; …and 7 more matches

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 2 day(s) before 2026-10-16

• issue_responsiveness

  only 0 issue(s) from outside the project fall inside `03` §5's 6-month window, which is under §5's floor of 3, and §5's lifetime-median fallback needs this repository's whole issue history — more of it than `04` §7's bounded fetch reads. A limit of ours, not a finding about the server.

• release_cadence

  released 2 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  3 authors with >= 5 commits in 12 months

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately