io.github.Techmatic-sys/indiamart-mcp-server

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• saas/frontend/sw.js:151mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      if (cached) return cached;
      try {
          const response = await fetch(request);
          if (response.ok) {
              const cache = await caches.open(STATIC_CACHE);

• saas/frontend/sw.js:164mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  async function networkFirstApi(request) {
      try {
          const response = await fetch(request);
          if (response.ok) {
              const cache = await caches.open(API_CACHE);

• saas/frontend/sw.js:182mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  async function networkFirstPage(request) {
      try {
          return await fetch(request);
      } catch (e) {
          const cached = await caches.match(request);

Auth Posture

• authentication_model

  the registry entry declares no transport, so `03` §4's stdio carve-out cannot be applied either way

• transport_security

  the registry entry declares no transport for any package or remote

• secret_handling

  Twilio API Key at saas/.env.example:36; …and 10 more matches

• authorization_granularity

  10 tool registrations with conditional access logic present in the same source

Maintenance

• recency

  last commit 193 day(s) before 2026-10-16

• issue_responsiveness

  lifetime median (1 issue(s) in the last 6 months, under `03` §5's floor of 3): 24.7 day(s) to first maintainer comment

• release_cadence

  this repository publishes neither releases nor version tags

• bus_factor

  no author reached `03` §5's 5-commit bar in the last 12 months (1 contributor(s) with fewer) — scored at §5's weakest described band, which the section defines for a quiet sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  CHANGELOG.md present

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately