com.meta-council/decision-intelligence

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  warn25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  tool "run_workflow" param "idempotency_key" description: cross-tool redirection ('instead of call…').

• Supply chain

  pass25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  repository linkage verified

• Credential hygiene

  fail15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  tool "ticket_plan" has a secret-shaped input parameter "preview_token" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ticket_batch_create" has a secret-shaped input parameter "preview_token" — secrets must never be tool parameters (the model would supply/handle the credential).

• Permission scope

  unscannable15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  No source files, package.json, or pyproject were fetched; cannot infer capability scope.

• Version behavior

  fail10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  vs prior 1.3.0 (minor bump): tool "list_workflows" description changed (wording only, no injection pattern); tool "run_workflow" gained input property(ies): parameters, idempotency_key; tool "get_settings" description changed (wording only, no injection pattern); tool "locus_determine_from_scores" description changed (wording only, no injection pattern); tool "ask_legal" description changed (wording only, no injection pattern); tool "ask_legal" gained secret/exfil-shaped input(s): context; tool "create_accounting_run" description changed (wording only, no injection pattern); tool "ticket_list" description changed (wording only, no injection pattern); tool "ticket_list" gained input property(ies): session_id, workflow_session_id, recursive, cursor, scope; tool "ticket_create" description changed (wording only, no injection pattern); tool "ticket_create" gained input property(ies): session_id, workflow_session_id, effort_points, order_index, external_ref; tool "ticket_update" description changed (wording only, no injection pattern); tool "ticket_update" gained input property(ies): parent_id, clear_parent, session_id, clear_session, workflow_session_id, clear_workflow_session, effort_points, clear_effort_points, external_ref; tool "ticket_comment" description changed (wording only, no injection pattern); new tool "plan_workflow" touches a sensitive surface (email/exec/net/fs); new tool "test_workflow_step" touches a sensitive surface (email/exec/net/fs); new tool "estimate_cost" appeared; new tool "retry_workflow" touches a sensitive surface (email/exec/net/fs); new tool "list_integrations" touches a sensitive surface (email/exec/net/fs); new tool "get_api_key_info" touches a sensitive surface (email/exec/net/fs); new tool "rotate_api_key" touches a sensitive surface (email/exec/net/fs); new tool "mint_child_api_key" touches a sensitive surface (email/exec/net/fs); new tool "list_invoices" appeared; new tool "get_invoice" touches a sensitive surface (email/exec/net/fs); new tool "get_invoice_aging" touches a sensitive surface (email/exec/net/fs); new tool "create_invoice" touches a sensitive surface (email/exec/net/fs); new tool "update_invoice" appeared; new tool "add_invoice_line_item" appeared; new tool "send_invoice" touches a sensitive surface (email/exec/net/fs); new tool "mark_invoice_paid" appeared; new tool "void_invoice" touches a sensitive surface (email/exec/net/fs); new tool "convert_deal_to_invoice" appeared; new tool "preview_accounting_ticket_sync" touches a sensitive surface (email/exec/net/fs); new tool "sync_accounting_tickets" touches a sensitive surface (email/exec/net/fs); new tool "ticket_plan" touches a sensitive surface (email/exec/net/fs); new tool "ticket_batch_create" touches a sensitive surface (email/exec/net/fs); new tool "get_ticket_projects" touches a sensitive surface (email/exec/net/fs); new tool "get_workspace_metrics" touches a sensitive surface (email/exec/net/fs); new tool "get_meta_council_platform_metrics" touches a sensitive surface (email/exec/net/fs); new tool "get_site_analytics" touches a sensitive surface (email/exec/net/fs); new tool "get_ticket_burndown" appeared; new tool "list_saved_views" touches a sensitive surface (email/exec/net/fs); new tool "get_saved_view" touches a sensitive surface (email/exec/net/fs); new tool "execute_saved_view" touches a sensitive surface (email/exec/net/fs); new tool "list_portfolio_snapshots" touches a sensitive surface (email/exec/net/fs); new tool "get_portfolio_snapshot" touches a sensitive surface (email/exec/net/fs); new tool "diff_portfolio_snapshots" touches a sensitive surface (email/exec/net/fs); new tool "list_portfolio_snapshot_notes" touches a sensitive surface (email/exec/net/fs); new tool "create_saved_view" touches a sensitive surface (email/exec/net/fs); new tool "update_saved_view" touches a sensitive surface (email/exec/net/fs); new tool "archive_saved_view" touches a sensitive surface (email/exec/net/fs); new tool "restore_saved_view" touches a sensitive surface (email/exec/net/fs); new tool "share_saved_view" touches a sensitive surface (email/exec/net/fs); new tool "unshare_saved_view" touches a sensitive surface (email/exec/net/fs); new tool "delete_saved_view" touches a sensitive surface (email/exec/net/fs); new tool "create_portfolio_snapshot" touches a sensitive surface (email/exec/net/fs); new tool "create_portfolio_snapshot_note" touches a sensitive surface (email/exec/net/fs); new tool "ticket_validation_finalize" touches a sensitive surface (email/exec/net/fs); new tool "ticket_scenario_create" touches a sensitive surface (email/exec/net/fs); new tool "ticket_scenario_revise" touches a sensitive surface (email/exec/net/fs); new tool "ticket_scenario_list" touches a sensitive surface (email/exec/net/fs); new tool "ticket_dependency_add" appeared; new tool "ticket_dependency_remove" appeared; new tool "ticket_dependency_list" touches a sensitive surface (email/exec/net/fs); new tool "ticket_archive" touches a sensitive surface (email/exec/net/fs); new tool "submit_meta_council_feedback" touches a sensitive surface (email/exec/net/fs); new tool "list_meta_council_feedback" appeared; new tool "triage_meta_council_feedback" appeared; new tool "create_workflow_template" touches a sensitive surface (email/exec/net/fs); new tool "update_workflow_template" touches a sensitive surface (email/exec/net/fs); new tool "delete_workflow_template" touches a sensitive surface (email/exec/net/fs); new tool "create_monitor" touches a sensitive surface (email/exec/net/fs); new tool "list_monitors" touches a sensitive surface (email/exec/net/fs); new tool "delete_monitor" touches a sensitive surface (email/exec/net/fs); new tool "list_approvals" touches a sensitive surface (email/exec/net/fs); new tool "decide_approval" touches a sensitive surface (email/exec/net/fs); new tool "audit_export" touches a sensitive surface (email/exec/net/fs); new tool "account_export" touches a sensitive surface (email/exec/net/fs).

• Transport config

  fail10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  remote MCP endpoint declares NO authentication (unauthenticated remote — nginx-ui/CVE-2026-33032 class)