No red flags across the 6 checks that ran — clean on everything we could inspect.
- Publisher
- ai.pubfi
- Repository
- github.com/helixbox/pubfi-docs
- Install
- remote only
- Versions
- 42
- MCP revision
- 2025-11-25 · superseded
- Inspected
- 6 of 6 checks · 100%
- Scored
- 2026-09-02 · rubric 1.0.0
What we checked
Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.
Injection surface
pass25% of gradeTool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).
Scanned 35 text field(s); no instruction-injection patterns found. PASS = no static red flag. A server can serve different tool descriptions at runtime (the rug-pull class), which static scanning cannot see.
Supply chain
pass25% of gradePackage provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.
repository linkage verified
Credential hygiene
pass15% of gradeHow the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.
No hardcoded secrets, secret-shaped tool parameters, or leaked keys found. PASS = no static red flag; static analysis cannot prove the code honors env-based secret handling at runtime.
Permission scope
pass15% of gradeDeclared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.
No shell-exec, unbounded/sensitive filesystem, or download-and-run primitives found in scanned source. PASS = no static red flag. Static scanning is blind to code fetched or executed at runtime.
Version behavior
pass10% of gradeDiff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).
tool surface, capabilities, install scripts, and publisher unchanged vs prior version 0.2.18 (patch bump); no rug-pull drift.
Transport config
pass10% of gradeRemote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.
remote endpoint "https://mcp.pubfi.ai" uses TLS (https); remote endpoint uses OAuth (strongest auth mode)
Version history
Each release plotted by grade against the safe line at B. A version that sinks below the line has lost its trusted standing — the shape of a rug-pull.
| Version | Published | Grade | Score | Inspected | Change |
|---|---|---|---|---|---|
| v0.2.22 · current | 2026-09-01 | A | 100 | 6/6 · 100% | ±0 |
| v0.2.18 | 2026-08-24 | A | 90 | 6/6 · 100% | B→A in v0.2.18 |
| v0.2.17 | 2026-08-23 | B | 100 | 5/6 · 75% | A→B in v0.2.17 |
| v0.2.14 | 2026-08-22 | A | 100 | 6/6 · 100% | ±0 |
| v0.2.13 | 2026-08-21 | A | 95 | 6/6 · 100% | ±0 |
| v0.2.7 | 2026-08-19 | A | 100 | 5/6 · 90% | ±0 |
| v0.2.4 | 2026-08-16 | A | 95 | 6/6 · 100% | ±0 |
| v0.2.3 | 2026-08-14 | A | 90 | 6/6 · 100% | ±0 |
| v0.2.2 | 2026-08-13 | A | 90 | 6/6 · 100% | ±0 |
| v0.1.98 | 2026-08-12 | A | 90 | 6/6 · 100% | ±0 |
| v0.1.96 | 2026-08-12 | A | 90 | 6/6 · 100% | B→A in v0.1.96 |
| v0.1.85 | 2026-08-08 | B | 80 | 6/6 · 100% | ±0 |
| v0.1.79 | 2026-07-31 | B | 95 | 4/6 · 65% | A→B in v0.1.79 |
| v0.2.12 | 2026-08-20 | A | 100 | 5/6 · 90% | B→A in v0.2.12 |
| v0.1.76 | 2026-07-29 | B | 85 | 6/6 · 100% | A→B in v0.1.76 |
| v0.1.73 | 2026-07-25 | A | 90 | 6/6 · 100% | ±0 |
| v0.1.72 | 2026-07-25 | A | 90 | 5/6 · 90% | B→A in v0.1.72 |
| v0.1.67 | 2026-07-24 | B | 80 | 6/6 · 100% | ±0 |
| v0.1.66 | 2026-07-22 | B | 95 | 5/6 · 75% | A→B in v0.1.66 |
| v0.1.65 | 2026-07-20 | A | 90 | 6/6 · 100% | B→A in v0.1.65 |
| v0.1.64 | 2026-07-19 | B | 80 | 6/6 · 100% | ±0 |
| v0.1.63 | 2026-07-17 | B | 100 | 3/6 · 55% | — |