io.github.tlkc888-Jenkins/joy

version 2.40.0

scanned 2026-10-16
source github.com/tlkc888-Jenkins/Joy
transport streamable-http
files read 1115
methodology 0.2.0
ruleset 0.1.1

Code Safetyweight 30

11measured on 99% of this axis

5 findings in test code are listed but not deducted; 8 vendored or minified paths were excluded before scanning; machine-generated bundles are not the server's own code; 1 file could not be parsed and was not scanned

Auth Postureweight 20

61measured on 85% of this axis

Dependency Healthweight 20

0measured on 61% of this axis

2 vulnerabilities could not be placed in `03` §6's table and are listed but not scored; the dependencies in 3 requirements files (agents/code-reviewer/requirements.txt, agents/researcher/requirements.txt, joy-telegram/requirements.txt) were not measured — they pin no exact version, or could not be read whole — so the score covers the 5 lockfiles that were

Maintenanceweight 15

not assessed

this server's declared repository could not be read through the GitHub API, so `03` §5's maintenance signals were not retrieved — note that a private repository and an absent one are indistinguishable from outside

Transparencyweight 15

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

Showing the 50 most severe of 54 findings on this axis. The score was computed over all of them — findings beyond the fourth of a severity still deduct at a tenth of their weight — so the remainder is omitted from this page, not from the arithmetic.

cli/index.js:116mcp-js-shell-exec-nonliteral (critical/medium)
A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.
```
  try {
    execSync(`claude mcp add --transport http ${result.agent.name} ${endpoint}`, { stdio: 'inherit' });
    console.log(`\n${colors.green}Successfully added ${result.agent.name} to Claude${colors.reset}\n`);
  } catch (err) {
```

cli/index.js:116mcp-js-shell-exec-template-literal (critical/medium)

A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.


  try {
    execSync(`claude mcp add --transport http ${result.agent.name} ${endpoint}`, { stdio: 'inherit' });
    console.log(`\n${colors.green}Successfully added ${result.agent.name} to Claude${colors.reset}\n`);
  } catch (err) {

docs/autogpt_research/autogpt_platform/backend/backend/util/cache.py:217mcp-python-pickle-loads (critical/medium)
Attacker-reachable input is unpickled. pickle executes constructors during load, so a crafted payload is arbitrary code execution — this is not a hardening issue, it is the documented behaviour of the format.
```
                        )
                        return None
                    return pickle.loads(payload)
            except Exception as e:
                logger.error(f"Redis error during cache check for {func_name}: {e}")
```
docs/autogpt_research/autogpt_platform/backend/backend/util/metrics.py:97mcp-python-ssrf-metadata-endpoint (critical/medium)
The cloud instance-metadata endpoint is contacted directly. On a hosted MCP server this is the canonical path from SSRF to credential theft: 169.254.169.254 serves IAM role credentials to anything that asks.
```
        # Google metadata DNS errors — expected in non-GCP environments
        if (
            "metadata.google.internal" in exc_msg
            and settings.config.behave_as != BehaveAs.CLOUD
        ):
```
docs/autogpt_research/autogpt_platform/frontend/scripts/generate-api-queries.ts:54mcp-js-shell-exec-nonliteral (critical/medium)
A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.
```
  try {
    // Fetch the OpenAPI spec to a temp file
    execSync(`curl "${openApiUrl}" -o "${tmpOutputPath}"`, {
      stdio: "inherit",
    });
```
docs/autogpt_research/autogpt_platform/frontend/scripts/generate-api-queries.ts:54mcp-js-shell-exec-template-literal (critical/medium)
A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.
```
  try {
    // Fetch the OpenAPI spec to a temp file
    execSync(`curl "${openApiUrl}" -o "${tmpOutputPath}"`, {
      stdio: "inherit",
    });
```
docs/autogpt_research/autogpt_platform/frontend/scripts/generate-api-queries.ts:59mcp-js-shell-exec-nonliteral (critical/medium)
A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.
```
    // Format with prettier
    execSync(`prettier --write "${tmpOutputPath}"`, { stdio: "inherit" });

    // Move temp file to final output path
```
docs/autogpt_research/autogpt_platform/frontend/scripts/generate-api-queries.ts:59mcp-js-shell-exec-template-literal (critical/medium)
A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.
```
    // Format with prettier
    execSync(`prettier --write "${tmpOutputPath}"`, { stdio: "inherit" });

    // Move temp file to final output path
```

agents/code-reviewer/agent.py:51mcp-python-ssrf-nonliteral-url (medium/low)

An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

        """Make request to Joy API"""
        url = f"{JOY_BASE_URL}{path}"
        response = requests.request(method, url, headers=self.joy_headers, **kwargs)
        if response.status_code >= 400:
            print(f"[Joy] Error {response.status_code}: {response.text[:200]}")

agents/researcher/agent.py:51mcp-python-ssrf-nonliteral-url (medium/low)

        """Make request to Joy API"""
        url = f"{JOY_BASE_URL}{path}"
        response = requests.request(method, url, headers=self.joy_headers, **kwargs)
        if response.status_code >= 400:
            print(f"[Joy] Error {response.status_code}: {response.text[:200]}")

autonomous-moderator.js:227mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
      const timeout = setTimeout(() => controller.abort(), 5000);

      const response = await fetch(agent.endpoint, {
        method: 'HEAD',
        signal: controller.signal
```
claude-agent/main.py:119mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    try:
        headers = {"x-api-key": JOY_API_KEY}
        response = httpx.get(
            f"{JOY_API_URL}/messages",
            headers=headers,
```
claude-agent/main.py:182mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
            "content": content
        }
        response = httpx.post(
            f"{JOY_API_URL}/messages",
            headers=headers,
```
claude-agent/main.py:204mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    try:
        headers = {"x-api-key": JOY_API_KEY}
        response = httpx.get(
            f"{JOY_API_URL}/messages",
            headers=headers,
```
claude-agent/main.py:240mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
            headers = {"x-api-key": JOY_API_KEY}
            response = httpx.get(
                f"{JOY_API_URL}/messages",
                headers=headers,
```
docs/autogpt_research/.github/workflows/scripts/check_actions_status.py:39mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    try:
        print("Making API request to:", url)
        response = requests.get(url, headers=headers, timeout=10)
        response.raise_for_status()
        return response.json()
```
docs/autogpt_research/autogpt_platform/backend/backend/blocks/mcp/client.py:136mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
            extra_headers=headers,
        )
        response = await requests.post(self.server_url, json=payload)

        # Capture session ID from response (MCP Streamable HTTP transport)
```
docs/autogpt_research/autogpt_platform/backend/backend/blocks/mcp/client.py:179mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
            extra_headers=headers,
        )
        await requests.post(self.server_url, json=notification)

    async def discover_auth(self) -> dict[str, Any] | None:
```
docs/autogpt_research/autogpt_platform/backend/backend/blocks/mcp/client.py:210mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        for url in candidates:
            try:
                resp = await requests.get(url)
                if resp.status == 200:
                    data = resp.json()
```
docs/autogpt_research/autogpt_platform/backend/backend/blocks/mcp/client.py:251mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        for url in candidates:
            try:
                resp = await requests.get(url)
                if resp.status == 200:
                    data = resp.json()
```
docs/autogpt_research/autogpt_platform/backend/backend/cli/oauth_tool.py:962mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
                    )

                    with urlopen(req) as response:
                        response_body = response.read()
                        self.send_response(response.status)
```
docs/autogpt_research/autogpt_platform/backend/backend/cli/oauth_tool.py:1010mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
                    )

                    with urlopen(req) as response:
                        response_body = response.read()
                        self.send_response(response.status)
```
docs/autogpt_research/autogpt_platform/backend/backend/executor/automod/manager.py:341mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        try:
            response = await requests.post(
                url, json=request_data.model_dump(), timeout=self.config.timeout
            )
```
docs/autogpt_research/autogpt_platform/frontend/public/mockServiceWorker.js:238mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
    }

    return fetch(requestClone, { headers })
  }
```
docs/autogpt_research/autogpt_platform/frontend/src/app/(platform)/copilot/components/ArtifactPanel/components/useArtifactContent.ts:83mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
      setContent(null);
      setPdfUrl(null);
      fetch(artifact.sourceUrl)
        .then((res) => {
          if (!res.ok) throw new Error(`Failed to fetch: ${res.status}`);
```
docs/autogpt_research/autogpt_platform/frontend/src/app/(platform)/copilot/components/ArtifactPanel/components/useArtifactContent.ts:124mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
      };
    }
    fetch(artifact.sourceUrl)
      .then((res) => {
        if (!res.ok) throw new Error(`Failed to fetch: ${res.status}`);
```
docs/autogpt_research/autogpt_platform/frontend/src/app/(platform)/copilot/components/ArtifactPanel/downloadArtifact.ts:20mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
      .replace(/[\\/:*?"<>|\x00-\x1f]/g, "_")
      .replace(/^\.+/, "") || "download";
  return fetch(artifact.sourceUrl)
    .then((res) => {
      if (!res.ok) throw new Error(`Download failed: ${res.status}`);
```
docs/autogpt_research/autogpt_platform/frontend/src/app/(platform)/copilot/components/ArtifactPanel/useArtifactPanel.ts:96mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
    const textPromise = cached
      ? Promise.resolve(cached)
      : fetch(activeArtifact.sourceUrl).then((res) => {
          if (!res.ok) throw new Error(`Copy failed: ${res.status}`);
          return res.text();
```
joy-router/server.js:43mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
  if (body) options.body = JSON.stringify(body);

  const response = await fetch(url, options);
  const data = await response.json();
```
langchain-joy/langchain_joy/tools.py:42mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
            payload["endpoint"] = endpoint

        response = requests.post(f"{JOY_API_URL}/agents/register", json=payload)
        return response.json()
```
langchain-joy/langchain_joy/tools.py:77mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
            headers["X-API-Key"] = self.api_key

        response = requests.get(f"{JOY_API_URL}/agents/discover", params=params, headers=headers)
        return response.json()
```
langchain-joy/langchain_joy/tools.py:107mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        headers = {"X-API-Key": self.api_key}

        response = requests.post(f"{JOY_API_URL}/vouches", json=payload, headers=headers)
        return response.json()
```
langchain-joy/langchain_joy/tools.py:137mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        headers = {"X-API-Key": self.api_key}

        response = requests.post(f"{JOY_API_URL}/messages", json=payload, headers=headers)
        return response.json()
```
langchain-joy/langchain_joy/tools.py:164mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
            headers["X-API-Key"] = self.api_key

        response = requests.get(f"{JOY_API_URL}/agents/{agent_id}", headers=headers)
        return response.json()
```
mcp-server/index.js:44mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
  };

  const response = await fetch(url, { ...options, headers });
  return response.json();
}
```
packages/joy-python/joy_trust.py:62mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        try:
            with urllib.request.urlopen(req, timeout=30) as response:
                return json.loads(response.read().decode())
        except urllib.error.HTTPError as e:
```
prs/crewai-implementation/joy_trust.py:27mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    """
    try:
        r = requests.get(
            f"{JOY_API}/trust/{agent_id}",
            timeout=REQUEST_TIMEOUT
```
prs/crewai-implementation/joy_trust.py:70mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    """
    try:
        r = requests.get(
            f"{JOY_API}/agents/discover",
            params={
```
prs/crewai-implementation/joy_trust.py:119mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    """
    try:
        r = requests.get(
            f"{JOY_API}/agents/{agent_id}",
            timeout=REQUEST_TIMEOUT
```
prs/crewai-implementation/joy_trust.py:173mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
                headers["X-API-Key"] = self.api_key

            r = requests.get(
                f"{JOY_API}/trust/{agent_id}",
                headers=headers,
```
prs/langchain-implementation/joy_trust.py:25mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    """Get trust score for an agent from Joy network."""
    try:
        r = requests.get(f"{JOY_API}/trust/{agent_id}", timeout=REQUEST_TIMEOUT)
        if r.status_code == 200:
            return r.json().get("score", 0)
```
prs/langchain-implementation/joy_trust.py:166mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        """
        try:
            r = requests.get(
                f"{JOY_API}/agents/discover",
                params={
```
prs/langchain-implementation/joy_trust.py:193mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        """Get full agent details."""
        try:
            r = requests.get(
                f"{JOY_API}/agents/{agent_id}",
                headers=self.headers,
```
sdk/mcp-trust-middleware.js:28mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
      : `${JOY_API}/trust/${agentId}`;

    const response = await fetch(url, {
      method: 'GET',
      headers: { 'Accept': 'application/json' },
```
sdk/python/langchain-joy/langchain_joy/__init__.py:25mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    """Get trust score for an agent from Joy network."""
    try:
        r = requests.get(f"{JOY_API}/trust/{agent_id}", timeout=REQUEST_TIMEOUT)
        if r.status_code == 200:
            return r.json().get("score", 0)
```
sdk/python/langchain-joy/langchain_joy/__init__.py:150mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        """Find agents with specific capability above trust threshold."""
        try:
            r = requests.get(
                f"{JOY_API}/agents/discover",
                params={
```
sdk/python/langchain-joy/langchain_joy/__init__.py:177mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        """Get full agent details."""
        try:
            r = requests.get(
                f"{JOY_API}/agents/{agent_id}",
                headers=self.headers,
```
trust-provider/index.ts:71mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
    try {
      const response = await fetch(url, {
        method,
        headers,
```
trust-provider/joy_trust.py:84mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        try:
            with urllib.request.urlopen(req, timeout=10) as response:
                return json.loads(response.read().decode())
        except urllib.error.HTTPError as e:
```
docs/autogpt_research/autogpt_platform/backend/backend/copilot/tools/agent_browser_integration_test.py:267mcp-python-ssrf-metadata-endpoint (critical/medium)
Test code — listed, not deducted: `03` §3 grades the code a user runs. The cloud instance-metadata endpoint is contacted directly. On a hosted MCP server this is the canonical path from SSRF to credential theft: 169.254.169.254 serves IAM role credentials to anything that asks.
```
    "ssrf_url",
    [
        "http://169.254.169.254/",  # AWS/GCP/Azure metadata endpoint
        "http://127.0.0.1/",  # IPv4 loopback
        "http://10.0.0.1/",  # RFC-1918 private range
```

Auth Posture

authentication_model
credential enforcement present in source but not documented in the README
transport_security
declared endpoint(s) are HTTPS: https://joy-connect.fly.dev/mcp; scored 80, not 100: `03` §4 reserves 100 for HTTPS *with HSTS*, and an HSTS header can only be seen by connecting, which `04` §9 does not do. This is an unverifiable band, not an observed absence.
secret_handling
JSON Web Token at docs/autogpt_research/autogpt_platform/.env.default:8; JSON Web Token at docs/autogpt_research/autogpt_platform/.env.default:9; JSON Web Token at docs/autogpt_research/autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils_test.py:90; JSON Web Token at docs/autogpt_research/autogpt_platform/backend/.env.default:32; JSON Web Token at docs/autogpt_research/autogpt_platform/backend/load-tests/configs/environment.js:9; JSON Web Token at docs/autogpt_research/autogpt_platform/backend/load-tests/configs/environment.js:17; JSON Web Token at docs/autogpt_research/autogpt_platform/backend/load-tests/configs/environment.js:25; JSON Web Token at docs/autogpt_research/autogpt_platform/db/docker/docker-compose.yml:28; JSON Web Token at docs/autogpt_research/autogpt_platform/db/docker/docker-compose.yml:29; JSON Web Token at docs/autogpt_research/autogpt_platform/frontend/.env.default:3; …and 2078 more matches
authorization_granularity
no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Dependency Health

Showing the 49 most severe of 433 findings on this axis. The score was computed over all of them — findings beyond the fourth of a severity still deduct at a tenth of their weight — so the remainder is omitted from this page, not from the arithmetic.

agents/code-reviewer/requirements.txtunpinned requirements
18 vulnerabilities osv-scanner reported at versions it resolved rather than read from a pin (agents/code-reviewer/requirements.txt, agents/researcher/requirements.txt, claude-agent/requirements.txt) are not attributed — nobody pinned those versions, so they say nothing about what this server ships
docs/autogpt_research/autogpt_platform/backend/poetry.lockblack 24.10.0 — PYSEC-2026-2120
direct, CVSS 9.8, fixed in 26.3.0
https://osv.dev/vulnerability/PYSEC-2026-2120
docs/autogpt_research/autogpt_platform/autogpt_libs/poetry.lockcryptography 46.0.5 — PYSEC-2026-36
direct, CVSS 9.8, fixed in 46.0.7
https://osv.dev/vulnerability/PYSEC-2026-36
docs/autogpt_research/autogpt_platform/backend/poetry.lockcryptography 46.0.4 — PYSEC-2026-36
direct, CVSS 9.8, fixed in 46.0.7
https://osv.dev/vulnerability/PYSEC-2026-36
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlvitest 4.0.17 — GHSA-5xrq-8626-4rwp
direct, CVSS 9.8, fixed in 4.1.0
https://osv.dev/vulnerability/GHSA-5xrq-8626-4rwp
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlnext 15.4.10 — GHSA-2xp9-vwfh-vxw4
direct, CVSS 9.5, fixed in 15.5.24
https://osv.dev/vulnerability/GHSA-2xp9-vwfh-vxw4
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlorval 7.13.0 — GHSA-2h9g-j24r-h63g
direct, CVSS 9.3, fixed in 8.21.0
https://osv.dev/vulnerability/GHSA-2h9g-j24r-h63g
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlorval 7.13.0 — GHSA-2w86-xfrc-g85r
direct, CVSS 9.3, fixed in 8.21.0
https://osv.dev/vulnerability/GHSA-2w86-xfrc-g85r
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlorval 7.13.0 — GHSA-3575-w9fc-c2j6
direct, CVSS 9.3, fixed in 8.21.0
https://osv.dev/vulnerability/GHSA-3575-w9fc-c2j6
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlorval 7.13.0 — GHSA-6437-gxhq-pqv8
direct, CVSS 9.3, fixed in 8.21.0
https://osv.dev/vulnerability/GHSA-6437-gxhq-pqv8
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlorval 7.13.0 — GHSA-653q-5476-x79g
direct, CVSS 9.3, fixed in 8.21.0
https://osv.dev/vulnerability/GHSA-653q-5476-x79g
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlorval 7.13.0 — GHSA-6mr6-jvcr-2f25
direct, CVSS 9.3, fixed in 8.21.0
https://osv.dev/vulnerability/GHSA-6mr6-jvcr-2f25
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlorval 7.13.0 — GHSA-88f2-fpv8-89q2
direct, CVSS 9.3, fixed in 8.21.0
https://osv.dev/vulnerability/GHSA-88f2-fpv8-89q2
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlorval 7.13.0 — GHSA-8j6p-r8jg-mxqh
direct, CVSS 9.3, fixed in 8.21.0
https://osv.dev/vulnerability/GHSA-8j6p-r8jg-mxqh
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlorval 7.13.0 — GHSA-fg9p-mrxr-hvq7
direct, CVSS 9.3, fixed in 8.21.0
https://osv.dev/vulnerability/GHSA-fg9p-mrxr-hvq7
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlorval 7.13.0 — GHSA-p4cg-3328-rvfg
direct, CVSS 9.3, fixed in 8.21.0
https://osv.dev/vulnerability/GHSA-p4cg-3328-rvfg
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlorval 7.13.0 — GHSA-w727-8j6c-2rj4
direct, CVSS 9.3, fixed in 8.21.0
https://osv.dev/vulnerability/GHSA-w727-8j6c-2rj4
docs/autogpt_research/autogpt_platform/backend/poetry.lockaiohttp 3.13.3 — PYSEC-2026-2102
direct, CVSS 9.1, fixed in 3.13.4
https://osv.dev/vulnerability/PYSEC-2026-2102
docs/autogpt_research/autogpt_platform/autogpt_libs/poetry.lockpyjwt 2.11.0 — PYSEC-2026-4145
direct, CVSS 9.1, fixed in 2.14.0
https://osv.dev/vulnerability/PYSEC-2026-4145
docs/autogpt_research/autogpt_platform/backend/poetry.lockpyjwt 2.11.0 — PYSEC-2026-4145
direct, CVSS 9.1, fixed in 2.14.0
https://osv.dev/vulnerability/PYSEC-2026-4145
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlnext 15.4.10 — GHSA-p293-qw3h-jr36
direct, CVSS 9.0, fixed in 15.5.24
https://osv.dev/vulnerability/GHSA-p293-qw3h-jr36
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlprotobufjs 7.5.4 — GHSA-xq3m-2v4x-88gg
transitive, CVSS 9.8, fixed in 7.5.5
https://osv.dev/vulnerability/GHSA-xq3m-2v4x-88gg
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yaml@orval/core 7.13.0 — GHSA-h526-wf6g-67jv
transitive, CVSS 9.3, fixed in 7.19.0
https://osv.dev/vulnerability/GHSA-h526-wf6g-67jv
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yaml@orval/mcp 7.13.0 — GHSA-mwr6-3gp8-9jmj
transitive, CVSS 9.3, fixed in 7.18.0
https://osv.dev/vulnerability/GHSA-mwr6-3gp8-9jmj
docs/autogpt_research/autogpt_platform/autogpt_libs/poetry.lockanyio 4.9.0 — PYSEC-2026-4025
transitive, CVSS 9.3, fixed in 4.14.2
https://osv.dev/vulnerability/PYSEC-2026-4025
docs/autogpt_research/autogpt_platform/backend/poetry.lockanyio 4.12.1 — PYSEC-2026-4025
transitive, CVSS 9.3, fixed in 4.14.2
https://osv.dev/vulnerability/PYSEC-2026-4025
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlshell-quote 1.8.3 — GHSA-w7jw-789q-3m8p
transitive, CVSS 9.2, fixed in 1.8.4
https://osv.dev/vulnerability/GHSA-w7jw-789q-3m8p
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlsharp 0.34.5 — GHSA-rgj7-g3m4-5g8c
direct, CVSS 8.9, fixed in 0.35.4
https://osv.dev/vulnerability/GHSA-rgj7-g3m4-5g8c
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlsharp 0.34.5 — GHSA-wq5f-xc86-pv6w
direct, CVSS 8.9, fixed in 0.35.5
https://osv.dev/vulnerability/GHSA-wq5f-xc86-pv6w
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlstorybook 9.1.5 — GHSA-mjf5-7g4m-gx5w
direct, CVSS 8.9, fixed in 9.1.19
https://osv.dev/vulnerability/GHSA-mjf5-7g4m-gx5w
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlhappy-dom 20.3.4 — GHSA-6q6h-j7hj-3r64
direct, CVSS 8.8, fixed in 20.8.8
https://osv.dev/vulnerability/GHSA-6q6h-j7hj-3r64
docs/autogpt_research/autogpt_platform/backend/poetry.lockyt-dlp 2025.12.8 — PYSEC-2026-3432
direct, CVSS 8.8, fixed in 2026.02.21
https://osv.dev/vulnerability/PYSEC-2026-3432
docs/autogpt_research/autogpt_platform/backend/poetry.lockblack 24.10.0 — PYSEC-2026-2121
direct, CVSS 8.7, fixed in 26.3.1
https://osv.dev/vulnerability/PYSEC-2026-2121
docs/autogpt_research/autogpt_platform/autogpt_libs/poetry.lockcryptography 46.0.5 — PYSEC-2026-3553
direct, CVSS 8.7, fixed in 49.0.0
https://osv.dev/vulnerability/PYSEC-2026-3553
docs/autogpt_research/autogpt_platform/backend/poetry.lockcryptography 46.0.4 — PYSEC-2026-3553
direct, CVSS 8.7, fixed in 49.0.0
https://osv.dev/vulnerability/PYSEC-2026-3553
docs/autogpt_research/autogpt_platform/backend/poetry.locksqlparse 0.5.5 — PYSEC-2026-3697
direct, CVSS 8.7, fixed in 0.6.0
https://osv.dev/vulnerability/PYSEC-2026-3697
docs/autogpt_research/autogpt_platform/backend/poetry.locksqlparse 0.5.5 — PYSEC-2026-3699
direct, CVSS 8.7, fixed in 0.6.0
https://osv.dev/vulnerability/PYSEC-2026-3699
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlnext 15.4.10 — GHSA-c4j6-fc7j-m34r
direct, CVSS 8.6, fixed in 15.5.16
https://osv.dev/vulnerability/GHSA-c4j6-fc7j-m34r
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlnext 15.4.10 — GHSA-89xv-2m56-2m9x
direct, CVSS 8.3, fixed in 15.5.21
https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlnext 15.4.10 — GHSA-p9j2-gv94-2wf4
direct, CVSS 8.3, fixed in 15.5.21
https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4
docs/autogpt_research/autogpt_platform/backend/poetry.lockyt-dlp 2025.12.8 — PYSEC-2026-3430
direct, CVSS 8.3, fixed in 2026.6.9
https://osv.dev/vulnerability/PYSEC-2026-3430
docs/autogpt_research/autogpt_platform/backend/poetry.lockyt-dlp 2025.12.8 — PYSEC-2026-3433
direct, CVSS 8.3, fixed in 2026.6.9
https://osv.dev/vulnerability/PYSEC-2026-3433
docs/autogpt_research/autogpt_platform/backend/poetry.lockcryptography 46.0.4 — PYSEC-2026-2141
direct, CVSS 8.2, fixed in 46.0.5
https://osv.dev/vulnerability/PYSEC-2026-2141
docs/autogpt_research/autogpt_platform/autogpt_libs/poetry.lockcryptography 46.0.5 — PYSEC-2026-3552
direct, CVSS 8.2, fixed in 50.0.0
https://osv.dev/vulnerability/PYSEC-2026-3552
docs/autogpt_research/autogpt_platform/backend/poetry.lockcryptography 46.0.4 — PYSEC-2026-3552
direct, CVSS 8.2, fixed in 50.0.0
https://osv.dev/vulnerability/PYSEC-2026-3552
claude-agent/requirements.txtgunicorn 21.2.0 — PYSEC-2026-1434
direct, CVSS 8.2, fixed in 22.0.0
https://osv.dev/vulnerability/PYSEC-2026-1434
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamlnext 15.4.10 — GHSA-m99w-x7hq-7vfj
direct, CVSS 8.2, fixed in 15.5.21
https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj
docs/autogpt_research/autogpt_platform/autogpt_libs/poetry.lockpyjwt 2.11.0 — PYSEC-2026-4183
direct, CVSS 8.2, fixed in 2.15.0
https://osv.dev/vulnerability/PYSEC-2026-4183
docs/autogpt_research/autogpt_platform/backend/poetry.lockpyjwt 2.11.0 — PYSEC-2026-4183
direct, CVSS 8.2, fixed in 2.15.0
https://osv.dev/vulnerability/PYSEC-2026-4183
docs/autogpt_research/autogpt_platform/frontend/pnpm-lock.yamllodash 4.17.21 — GHSA-r5fr-rjxr-66jc
direct, CVSS 8.1, fixed in 4.18.0
https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc

Maintenance

recency
no last-commit date was retrieved for this repository
issue_responsiveness
no issue-response median was retrieved. An unanswered issue scores 0 under `03` §5, but an absent measurement is not an unanswered issue.
release_cadence
no release history was retrieved for this repository
bus_factor
no contributor history was retrieved for this repository
repository_signals
`03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

license
docs/autogpt_research/LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text
readme_quality
prs/README.md: states what the server does in the first 200 words (+20)
declared_scopes
neither the README nor the MCP manifest documents what the server accesses or what side effects it has
changelog
CHANGELOG.md present
security_contact
docs/autogpt_research/SECURITY.md present

Contest a finding

Every number here comes from a rule reading published source, and rules get things wrong. If something on this page is incorrect — or correct but mitigated by a check the rule cannot see — open an issue and we answer it in writing. A finding we got wrong is removed and the rule is fixed; one that stands is answered on the record.

Anyone can file: the maintainer, a researcher who disagrees with the classification, or a user who tested the server and could not reproduce it. Name this server and the rule or advisory ID shown beside the finding above. We aim to reply within five business days and to resolve within ten.

Open an appeal on GitHub