io.github.theluckystrike/calendar-ics-reader-events-freebusy-conflicts

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/fetch.ts:22mcp-js-ssrf-metadata-endpoint (critical/medium)

  The cloud instance-metadata endpoint is contacted directly — the standard path from SSRF to credential theft on a hosted server.

    if (h === "localhost" || h.endsWith(".localhost")) return "localhost";
    if (h.endsWith(".local") || h.endsWith(".internal") || h.endsWith(".home.arpa")) return "a local network name";
    if (h === "metadata.google.internal") return "a cloud metadata service";
    if (h === "::1" || h === "0:0:0:0:0:0:0:1") return "the IPv6 loopback address";
    if (/^fe80:/i.test(h) || /^f[cd][0-9a-f]{2}:/i.test(h)) return "a private IPv6 address";

• src/fetch.ts:60mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    let res: Response;
    try {
      res = await fetch(parsed.toString(), {
        redirect: "follow",
        signal: ctrl.signal,

Auth Posture

• authentication_model

  credential requirement present; enforcement partially evidenced

• transport_security

  declared endpoint(s) are HTTPS: https://mcp.zovo.one/mcp/calendar; scored 80, not 100: `03` §4 reserves 100 for HTTPS *with HSTS*, and an HSTS header can only be seen by connecting, which `04` §9 does not do. This is an unverifiable band, not an observed absence.

• secret_handling

  detect-secrets matched 6 credential-shaped string(s), every one from a keyword or entropy heuristic (Hex High Entropy String). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Hex High Entropy String at server.appointment.json:28; Hex High Entropy String at server.itinerary.json:28; Hex High Entropy String at server.json:28; Hex High Entropy String at server.json.pub:28; Hex High Entropy String at server.mcpb.json:28; Hex High Entropy String at server.variant.json:28

• authorization_granularity

  10 tool registrations and no conditional access logic found — `03` §4 calls this case 'needs human review' and assigns it no score band, so it is not scored here

Maintenance

• recency

  last commit 2 day(s) before 2026-10-16

• issue_responsiveness

  this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.

• release_cadence

  released 4 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  this repository's 12-month history is longer than the bounded walk `04` §7 performs, and the authors found so far span more than one of `03` §5's bands. A limit of ours, not a finding about the server.

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately