app.worldmonitor/mcp

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  fail25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  server instructions: 'ignore previous instructions'-style override directed at the model. server instructions: off-vendor URL in a description (jmespath.org); capability text should not name where data goes. server instructions: off-vendor URL in a description (www.worldmonitor.app); capability text should not name where data goes. server instructions: off-vendor URL in a description (worldmonitor.app); capability text should not name where data goes.

• Supply chain

  warn25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  install hook "postinstall" present and not a recognized benign build command; dependency "@deck.gl/core" is edit-distance 1 from popular package "cors" (typosquat candidate); dependency "@upstash/redis" is edit-distance 2 from popular package "redux" (typosquat candidate); dependency "@vercel/og" is edit-distance 1 from popular package "pg" (typosquat candidate); dependency "d3" is edit-distance 2 from popular package "ws" (typosquat candidate); dependency "h3-js" is edit-distance 2 from popular package "ejs" (typosquat candidate); dependency "jose" is edit-distance 2 from popular package "@babel/core" (typosquat candidate); dependency "preact" is edit-distance 1 from top-20 package "react" (typosquat candidate); dependency "uqr" is edit-distance 2 from popular package "qs" (typosquat candidate); dependency "yaml" is edit-distance 2 from popular package "yarn" (typosquat candidate)

• Credential hygiene

  pass15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  No hardcoded secrets, secret-shaped tool parameters, or leaked keys found. PASS = no static red flag; static analysis cannot prove the code honors env-based secret handling at runtime.

• Permission scope

  pass15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  No shell-exec, unbounded/sensitive filesystem, or download-and-run primitives found in scanned source. PASS = no static red flag. Static scanning is blind to code fetched or executed at runtime.

• Version behavior

  fail10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  vs prior 1.13.0 (minor bump): tool "get_market_data" description changed (wording only, no injection pattern); tool "get_news_intelligence" description changed (wording only, no injection pattern); tool "get_country_risk" description changed (wording only, no injection pattern); new tool "get_imd_cyclone_marine" appeared; new tool "get_resilience_indicators" appeared; new tool "get_five_factor_scorecard" appeared; new tool "list_five_factor_scorecards" touches a sensitive surface (email/exec/net/fs); new tool "get_supply_vulnerabilities" appeared; new tool "get_chokepoint_dependencies" appeared; new hardcoded outbound host/BCC destination(s): acleddata.com, agsi.gie.eu, aisstream.io, api.slack.com, api.windy.com, api.worldmonitor.app, apiportal.wto.org, app.dodopayments.com, applications.icao.int, apps.fas.usda.gov, aqicn.org, aviationstack.com, brave.com, comtradedeveloper.un.org, console.anthropic.com, console.groq.com, corridorrisk.io, dash.cloudflare.com, dashboard.convex.dev, discord.com, docs.openaq.org, exa.ai, finnhub.io, firms.modaps.eosdis.nasa.gov, fred.stlouisfed.org, happy-animal-123.convex.site, my.telegram.org, open.gsa.gov, openrouter.ai, opensky-network.org, otx.alienvault.com, portal.api.imf.org, protomaps.com, transparency.entsoe.eu, ucdp.uu.se, upstash.com, urlhaus.abuse.ch, wingbits.com, worldmonitor.app, www.abuseipdb.com, www.alphavantage.co, www.coingecko.com, www.eia.gov, www.firecrawl.dev, www.manitoba511.ca, www.travelpayouts.com, your-app.clerk.accounts.dev, your-clerk-app.clerk.accounts.dev.

• Transport config

  warn10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  manifest/source references analytics behavior — disclosure