io.github.xyzzylabs/wasm-mcp

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Auth Posture

• authentication_model

  source was fetched but every file in it was oversized, unreadable or excluded, so no source text could be read, and no credential header is declared. An undeclared header is not an absent one — measured 2026-09-15, only 10 of 100 remotes declare one at all — so `03` §4's "no authentication" band is not established.

• transport_security

  declared endpoint(s) are HTTPS: https://mcp.xyzzylabs.ai/wasm/mcp; scored 80, not 100: `03` §4 reserves 100 for HTTPS *with HSTS*, and an HSTS header can only be seen by connecting, which `04` §9 does not do. This is an unverifiable band, not an observed absence.

• secret_handling

  detect-secrets matched 4 credential-shaped string(s), every one from a keyword or entropy heuristic (Hex High Entropy String). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Hex High Entropy String at build/wasm-proposals-main.json:1; Hex High Entropy String at build/wasm-sections-js-api-main.json:1; Hex High Entropy String at build/wasm-sections-web-api-main.json:1; Hex High Entropy String at build/wasm-spec-core-main.json:1

• authorization_granularity

  source was fetched but every file in it was oversized, unreadable or excluded, so no source text could be read, so neither the tool count nor any access-control logic can be read

Maintenance

• recency

  last commit 2 day(s) before 2026-10-16

• issue_responsiveness

  every issue read was filed by the project itself (1 by its maintainers or bots), so none is someone outside waiting for an answer, and `03` §5's question — will anyone read an issue I file? — has nothing to measure.

• release_cadence

  median release gap 1 days (by releases), last release 97 day(s) ago

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), states what the server does in the first 200 words (+20)

• declared_scopes

  specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.

• changelog

  CHANGELOG.md present

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately