dev.reapx/public-sources

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  unscannable25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  No tool descriptions, server instructions, prompts, or resources were fetched; nothing to scan for injection.

• Supply chain

  warn25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  no resolvable repository linked to the package (provenance unverifiable)

• Credential hygiene

  unscannable15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  No source files, package manifest, or tool schemas were fetched; cannot assess credential handling.

• Permission scope

  unscannable15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  No source files, package.json, or pyproject were fetched; cannot infer capability scope.

• Version behavior

  pass10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  tool surface, capabilities, install scripts, and publisher unchanged vs prior version 1.6.0 (minor bump); no rug-pull drift.

• Transport config

  pass10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  remote endpoint "https://mcp.apify.com/?actors=reapx/app-store-reviews-scraper,reapx/arbeitsagentur-scraper,reapx/arxiv-papers-scraper,reapx/clinicaltrials-scraper,reapx/coingecko-scraper,reapx/crossref-scraper,reapx/discogs-scraper,reapx/docker-hub-scraper,reapx/federal-register-scraper,reapx/github-repo-scraper,reapx/greenhouse-jobs-scraper,reapx/mastodon-scraper,reapx/nofluffjobs-scraper,reapx/npm-package-scraper,reapx/open-library-scraper,reapx/openalex-scraper,reapx/openfda-scraper,reapx/reed-jobs-scraper,reapx/remoteok-jobs-scraper,reapx/sec-edgar-scraper,reapx/shopify-app-store-scraper,reapx/shopify-store-products-scraper,reapx/stackoverflow-scraper,reapx/weworkremotely-scraper,reapx/workable-jobs-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com/?actors=reapx/brand-collab-detector,reapx/branded-mention-tracker,reapx/creator-contact-finder,reapx/creator-credibility-scorer,reapx/deleted-content-archive,reapx/engagement-benchmark-by-niche,reapx/follower-loss-tracker,reapx/instagram-comment-authenticity,reapx/instagram-creator-discovery,reapx/instagram-disclosure-checker,reapx/instagram-fake-follower-audit,reapx/instagram-follower-growth-monitor,reapx/linkedin-company-discovery,reapx/linkedin-company-headcount-monitor,reapx/linkedin-company-tracker,reapx/linkedin-jobs-monitor,reapx/linkedin-jobs-scraper,reapx/linkedin-posts-monitor,reapx/linkedin-profile-discovery,reapx/tiktok-comment-authenticity,reapx/tiktok-comments,reapx/tiktok-creator-check,reapx/tiktok-creator-discovery,reapx/tiktok-disclosure-checker,reapx/tiktok-follower-growth-monitor,reapx/tiktok-trends,reapx/x-creator-check,reapx/youtube-creator-discovery,reapx/youtube-shorts,reapx/youtube-video-search" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=reapx%2Flinkedin-job-scraper%2Creapx%2Flinkedin-post-scraper%2Creapx%2Flinkedin-search-scraper%2Creapx%2Ftiktok-profile-scraper%2Creapx%2Fyoutube-transcript-scraper%2Creapx%2Ftiktok-data-export-scraper%2Creapx%2Fyoutube-channel-scraper%2Creapx%2Fthreads-post-scraper%2Creapx%2Ftelegram-search-scraper%2Creapx%2Finstagram-transcript-scraper%2Creapx%2Finstagram-lead-scraper%2Creapx%2Ftiktok-hashtag-scraper%2Creapx%2Flinkedin-employee-scraper%2Creapx%2Freddit-profile-scraper%2Creapx%2Ffacebook-review-scraper%2Creapx%2Ftelegram-data-export-scraper%2Creapx%2Fyoutube-data-export-scraper%2Creapx%2Ffacebook-page-scraper%2Creapx%2Freddit-post-scraper%2Creapx%2Fyoutube-comment-scraper%2Creapx%2Ftiktok-transcript-scraper%2Creapx%2Ftwitter-data-export-scraper%2Creapx%2Finstagram-bulk-export-scraper%2Creapx%2Finstagram-video-scraper%2Creapx%2Ftiktok-user-scraper%2Creapx%2Flinkedin-comment-scraper%2Creapx%2Flinkedin-lead-scraper%2Creapx%2Ftwitter-profile-scraper%2Creapx%2Fthreads-profile-scraper%2Creapx%2Ftiktok-email-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=reapx%2Ftelegram-profile-scraper%2Creapx%2Fapollo-lead-scraper%2Creapx%2Finstagram-mention-scraper%2Creapx%2Ftwitter-article-scraper%2Creapx%2Finstagram-reel-scraper%2Creapx%2Fetsy-listing-scraper%2Creapx%2Ffacebook-post-scraper%2Creapx%2Flinkedin-search-scraper%2Creapx%2Flinkedin-post-scraper%2Creapx%2Findeed-job-export-scraper%2Creapx%2Flinkedin-job-scraper%2Creapx%2Findeed-job-search-scraper%2Creapx%2Fwebsite-profile-scraper%2Creapx%2Ftelegram-search-scraper%2Creapx%2Finstagram-hashtag-scraper%2Creapx%2Fnaver-search-data-scraper%2Creapx%2Ftiktok-user-scraper%2Creapx%2Fthreads-post-scraper%2Creapx%2Famazon-product-scraper%2Creapx%2Fgoogle-image-scraper%2Creapx%2Flinkedin-lead-scraper%2Creapx%2Fwebsite-contact-scraper%2Creapx%2Ftelegram-data-export-scraper%2Creapx%2Ffacebook-page-scraper%2Creapx%2Fzillow-lead-scraper%2Creapx%2Ftiktok-transcript-scraper%2Creapx%2Famazon-search-scraper%2Creapx%2Fwalmart-product-scraper%2Creapx%2Fgoogle-play-review-scraper%2Creapx%2Faliexpress-review-scraper%2Creapx%2Finstagram-bulk-export-scraper%2Creapx%2Fzillow-search-scraper%2Creapx%2Ftwitter-post-scraper%2Creapx%2Flinkedin-comment-scraper%2Creapx%2Finstagram-highlight-scraper%2Creapx%2Fyoutube-data-export-scraper%2Creapx%2Fgoogle-ad-data-scraper%2Creapx%2Ftwitter-profile-scraper%2Creapx%2Fpinterest-search-scraper%2Creapx%2Finstagram-download-scraper%2Creapx%2Finstagram-video-scraper%2Creapx%2Ftwitter-search-scraper%2Creapx%2Ftiktok-video-scraper%2Creapx%2Fgoogle-maps-data-scraper%2Creapx%2Ftiktok-email-scraper%2Creapx%2Famazon-product-export-scraper%2Creapx%2Ftelegram-channel-scraper%2Creapx%2Fgoogle-maps-review-scraper%2Creapx%2Flinkedin-email-scraper%2Creapx%2Fzillow-property-scraper%2Creapx%2Faliexpress-rating-scraper%2Creapx%2Fglassdoor-job-scraper%2Creapx%2Faliexpress-product-scraper%2Creapx%2Fzillow-detail-scraper%2Creapx%2Fyoutube-email-scraper%2Creapx%2Fsnapchat-data-scraper%2Creapx%2Fquora-answer-data-scraper%2Creapx%2Fspotify-music-scraper%2Creapx%2Fgoogle-search-price-scraper%2Creapx%2Fshopify-rating-scraper%2Creapx%2Fyoutube-profile-scraper%2Creapx%2Fzillow-data-scraper%2Creapx%2Ftiktok-sound-scraper%2Creapx%2Frednote-profile-scraper%2Creapx%2Flinkedin-ad-scraper%2Creapx%2Fairbnb-review-scraper%2Creapx%2Faliexpress-listing-scraper%2Creapx%2Faliexpress-search-scraper%2Creapx%2Findeed-review-scraper%2Creapx%2Finstagram-email-scraper%2Creapx%2Fmaps-place-data-scraper%2Creapx%2Fthreads-search-scraper%2Creapx%2Fweb-event-data-scraper%2Creapx%2Fgoogle-play-app-scraper%2Creapx%2Fwebsite-lead-scraper%2Creapx%2Famazon-rating-scraper%2Creapx%2Fgoogle-product-scraper%2Creapx%2Fairbnb-price-scraper%2Creapx%2Fgoogle-job-data-scraper%2Creapx%2Fshopify-lead-scraper%2Creapx%2Fgoogle-maps-place-scraper%2Creapx%2Fgoogle-play-data-scraper%2Creapx%2Fbooking-travel-data-scraper%2Creapx%2Flinkedin-account-scraper%2Creapx%2Fyoutube-shorts-scraper%2Creapx%2Fthreads-data-scraper%2Creapx%2Ftwitter-follower-scraper%2Creapx%2Fspotify-data-scraper%2Creapx%2Fwebsite-email-scraper%2Creapx%2Ftwitter-tweet-scraper%2Creapx%2Fwalmart-review-scraper%2Creapx%2Faliexpress-image-scraper%2Creapx%2Fgoogle-flight-scraper%2Creapx%2Fgoogle-maps-contact-scraper%2Creapx%2Frednote-detail-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=reapx/telegram-profile-scraper,reapx/facebook-review-scraper,reapx/tiktok-email-scraper,reapx/instagram-profile-scraper,reapx/linkedin-post-scraper,reapx/instagram-transcript-scraper,reapx/instagram-mention-scraper,reapx/instagram-reel-scraper,reapx/twitter-profile-scraper,reapx/linkedin-search-scraper,reapx/linkedin-company-scraper,reapx/twitter-user-scraper,reapx/tiktok-review-scraper,reapx/quora-answer-data-scraper,reapx/youtube-profile-scraper,reapx/rednote-data-scraper,reapx/twitter-follower-scraper,reapx/twitter-tweet-scraper,reapx/tiktok-following-scraper,reapx/threads-search-scraper,reapx/instagram-email-scraper,reapx/rednote-profile-scraper,reapx/facebook-comment-scraper,reapx/threads-data-scraper,reapx/youtube-shorts-scraper,reapx/tiktok-sound-scraper,reapx/snapchat-data-scraper,reapx/tiktok-post-scraper,reapx/linkedin-account-scraper,reapx/facebook-contact-scraper,reapx/pinterest-data-scraper,reapx/rednote-detail-scraper,reapx/facebook-data-export-scraper,reapx/tiktok-live-scraper,reapx/pinterest-profile-scraper,reapx/facebook-search-scraper,reapx/instagram-shorts-scraper,reapx/instagram-follower-scraper,reapx/youtube-follower-scraper,reapx/facebook-profile-scraper,reapx/instagram-following-scraper,reapx/telegram-phone-scraper,reapx/facebook-company-scraper,reapx/facebook-email-scraper,reapx/facebook-follower-scraper,reapx/quora-search-scraper,reapx/instagram-story-scraper,reapx/tiktok-follower-scraper,reapx/facebook-reel-scraper,reapx/tiktok-product-scraper,reapx/facebook-video-scraper,reapx/instagram-ad-scraper,reapx/twitter-comment-scraper,reapx/rednote-search-scraper,reapx/tiktok-comment-scraper,reapx/youtube-video-scraper,reapx/tiktok-transcript-scraper,reapx/tiktok-hashtag-scraper,reapx/twitter-post-scraper,reapx/telegram-search-scraper,reapx/facebook-event-scraper,reapx/youtube-search-scraper,reapx/instagram-download-scraper,reapx/twitter-data-export-scraper,reapx/reddit-profile-scraper,reapx/instagram-bulk-export-scraper,reapx/telegram-channel-scraper,reapx/tiktok-data-export-scraper,reapx/pinterest-search-scraper,reapx/reddit-data-export-scraper,reapx/youtube-data-export-scraper,reapx/instagram-lead-scraper,reapx/instagram-hashtag-scraper,reapx/youtube-channel-scraper,reapx/reddit-search-scraper,reapx/facebook-group-scraper,reapx/tiktok-video-scraper,reapx/twitter-search-scraper,reapx/linkedin-email-scraper,reapx/instagram-video-scraper,reapx/linkedin-data-export-scraper,reapx/linkedin-ad-scraper,reapx/youtube-email-scraper,reapx/reddit-comment-scraper,reapx/youtube-transcript-scraper,reapx/tiktok-search-scraper,reapx/tiktok-profile-scraper,reapx/linkedin-job-scraper,reapx/twitter-article-scraper,reapx/instagram-user-scraper,reapx/youtube-comment-scraper,reapx/telegram-data-export-scraper,reapx/instagram-comment-scraper,reapx/linkedin-lead-scraper,reapx/linkedin-employee-scraper" uses TLS (https); remote endpoint uses OAuth (strongest auth mode)