MCPgrade

MCP server · trust report

io.github.AdrienHq/lowlanddata-eu-real-estate

Published by io.github.AdrienHq

version-control

Only 3 of 6 checks could run, which is below the bar to certify, and supply chain raised a soft flag.

Publisher
io.github.AdrienHq
Repository
—
Install
remote only
Versions
2
Inspected
3 of 6 checks · 45%
Scored
2026-09-04 · rubric 1.0.0

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

6 checks2 clean1 flagged3 not inspected

  • Injection surface

    unscannable25% of grade

    Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

    No tool descriptions, server instructions, prompts, or resources were fetched; nothing to scan for injection.

  • Supply chain

    warn25% of grade

    Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

    no resolvable repository linked to the package (provenance unverifiable)

  • Credential hygiene

    unscannable15% of grade

    How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

    No source files, package manifest, or tool schemas were fetched; cannot assess credential handling.

  • Permission scope

    unscannable15% of grade

    Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

    No source files, package.json, or pyproject were fetched; cannot infer capability scope.

  • Version behavior

    pass10% of grade

    Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

    tool surface, capabilities, install scripts, and publisher unchanged vs prior version 1.0.0 (minor bump); no rug-pull drift.

  • Transport config

    pass10% of grade

    Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

    remote endpoint "https://mcp.apify.com/?actors=lowlanddata/rightmove-scraper,lowlanddata/rightmove-price-reductions,lowlanddata/immoweb-scraper,lowlanddata/otodom-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com/?actors=lowlanddata/rightmove-scraper,lowlanddata/rightmove-price-reductions,lowlanddata/rightmove-new-listings-alert,lowlanddata/rightmove-bmv-deal-finder,lowlanddata/rightmove-yield-scanner,lowlanddata/immoweb-scraper,lowlanddata/otodom-scraper,lowlanddata/otodom-price-stats,lowlanddata/subito-real-estate-scraper" uses TLS (https); remote endpoint uses OAuth (strongest auth mode)

Version history

Each release plotted by grade against the safe line at B. A version that sinks below the line has lost its trusted standing — the shape of a rug-pull.

VersionPublishedGradeScoreInspectedChange
v1.1.0 · current2026-09-01 insufficient—3/6 · 45%±0
v1.0.02026-08-25 insufficient—2/6 · 35%—