Only 3 of 6 checks could run, which is below the bar to certify — nothing that ran raised a red flag.
- Publisher
- io.github.Arjun0606
- Repository
- github.com/Arjun0606/smolanalytics
- Install
- oci:ghcr.io/arjun0606/smolanalytics:v0.8.2, oci:ghcr.io/arjun0606/smolanalytics:v0.14.4, oci:ghcr.io/arjun0606/smolanalytics:v0.18.0, oci:ghcr.io/arjun0606/smolanalytics:v0.20.6, oci:ghcr.io/arjun0606/smolanalytics:v0.20.7, oci:ghcr.io/arjun0606/smolanalytics:v0.20.8, oci:ghcr.io/arjun0606/smolanalytics:v0.20.9, oci:ghcr.io/arjun0606/smolanalytics:v0.21.0, oci:ghcr.io/arjun0606/smolanalytics:v0.21.1, oci:ghcr.io/arjun0606/smolanalytics:v0.22.0, oci:ghcr.io/arjun0606/smolanalytics:v0.23.0, oci:ghcr.io/arjun0606/smolanalytics:v0.24.0, oci:ghcr.io/arjun0606/smolanalytics:v0.25.0, oci:ghcr.io/arjun0606/smolanalytics:v0.26.0, oci:ghcr.io/arjun0606/smolanalytics:v0.27.0, oci:ghcr.io/arjun0606/smolanalytics:v0.28.0, oci:ghcr.io/arjun0606/smolanalytics:v0.29.0, oci:ghcr.io/arjun0606/smolanalytics:v0.30.0, oci:ghcr.io/arjun0606/smolanalytics:v0.31.0, oci:ghcr.io/arjun0606/smolanalytics:v0.31.1, oci:ghcr.io/arjun0606/smolanalytics:v0.32.0, oci:ghcr.io/arjun0606/smolanalytics:v0.33.0, oci:ghcr.io/arjun0606/smolanalytics:v0.34.0, oci:ghcr.io/arjun0606/smolanalytics:v0.35.0, oci:ghcr.io/arjun0606/smolanalytics:v0.35.1, oci:ghcr.io/arjun0606/smolanalytics:v0.36.0, oci:ghcr.io/arjun0606/smolanalytics:v0.37.0, oci:ghcr.io/arjun0606/smolanalytics:v0.38.0, oci:ghcr.io/arjun0606/smolanalytics:v0.38.1, oci:ghcr.io/arjun0606/smolanalytics:v0.38.2, oci:ghcr.io/arjun0606/smolanalytics:v0.39.0, oci:ghcr.io/arjun0606/smolanalytics:v0.40.0, oci:ghcr.io/arjun0606/smolanalytics:v0.41.0, oci:ghcr.io/arjun0606/smolanalytics:v0.42.0, oci:ghcr.io/arjun0606/smolanalytics:v0.43.0, oci:ghcr.io/arjun0606/smolanalytics:v0.44.0, oci:ghcr.io/arjun0606/smolanalytics:v0.44.1, oci:ghcr.io/arjun0606/smolanalytics:v0.45.0, oci:ghcr.io/arjun0606/smolanalytics:v0.46.0, oci:ghcr.io/arjun0606/smolanalytics:v0.47.0, oci:ghcr.io/arjun0606/smolanalytics:v0.48.0, oci:ghcr.io/arjun0606/smolanalytics:v0.49.0, oci:ghcr.io/arjun0606/smolanalytics:v0.50.0, oci:ghcr.io/arjun0606/smolanalytics:v0.50.1, oci:ghcr.io/arjun0606/smolanalytics:v0.50.2, oci:ghcr.io/arjun0606/smolanalytics:v0.51.0, oci:ghcr.io/arjun0606/smolanalytics:v0.52.0, oci:ghcr.io/arjun0606/smolanalytics:v0.53.0, oci:ghcr.io/arjun0606/smolanalytics:v0.54.0, oci:ghcr.io/arjun0606/smolanalytics:v0.55.0, oci:ghcr.io/arjun0606/smolanalytics:v0.56.0, oci:ghcr.io/arjun0606/smolanalytics:v0.57.0, oci:ghcr.io/arjun0606/smolanalytics:v0.58.0, oci:ghcr.io/arjun0606/smolanalytics:v0.59.0, oci:ghcr.io/arjun0606/smolanalytics:v0.60.0, oci:ghcr.io/arjun0606/smolanalytics:v0.61.0, oci:ghcr.io/arjun0606/smolanalytics:v0.62.1, oci:ghcr.io/arjun0606/smolanalytics:v0.63.0, oci:ghcr.io/arjun0606/smolanalytics:v0.64.0, oci:ghcr.io/arjun0606/smolanalytics:v0.65.0, oci:ghcr.io/arjun0606/smolanalytics:v0.65.1, oci:ghcr.io/arjun0606/smolanalytics:v0.65.2, oci:ghcr.io/arjun0606/smolanalytics:v0.65.3, oci:ghcr.io/arjun0606/smolanalytics:v0.65.4, oci:ghcr.io/arjun0606/smolanalytics:v0.65.5, oci:ghcr.io/arjun0606/smolanalytics:v0.66.1, oci:ghcr.io/arjun0606/smolanalytics:v0.66.2, oci:ghcr.io/arjun0606/smolanalytics:v0.66.3, oci:ghcr.io/arjun0606/smolanalytics:v0.66.4, oci:ghcr.io/arjun0606/smolanalytics:v0.68.0, oci:ghcr.io/arjun0606/smolanalytics:v0.69.0, oci:ghcr.io/arjun0606/smolanalytics:v0.70.0, oci:ghcr.io/arjun0606/smolanalytics:v0.71.0, oci:ghcr.io/arjun0606/smolanalytics:v0.72.0, oci:ghcr.io/arjun0606/smolanalytics:v0.73.0, oci:ghcr.io/arjun0606/smolanalytics:v0.74.0, oci:ghcr.io/arjun0606/smolanalytics:v0.74.1, oci:ghcr.io/arjun0606/smolanalytics:v0.75.0, oci:ghcr.io/arjun0606/smolanalytics:v0.76.0, oci:ghcr.io/arjun0606/smolanalytics:v0.78.0, oci:ghcr.io/arjun0606/smolanalytics:v0.79.0, oci:ghcr.io/arjun0606/smolanalytics:v0.80.0, oci:ghcr.io/arjun0606/smolanalytics:v0.81.0, oci:ghcr.io/arjun0606/smolanalytics:v0.82.0, oci:ghcr.io/arjun0606/smolanalytics:v0.83.0, oci:ghcr.io/arjun0606/smolanalytics:v0.84.0, oci:ghcr.io/arjun0606/smolanalytics:v0.85.0, oci:ghcr.io/arjun0606/smolanalytics:v0.85.1, oci:ghcr.io/arjun0606/smolanalytics:v0.85.2, oci:ghcr.io/arjun0606/smolanalytics:v0.86.0, oci:ghcr.io/arjun0606/smolanalytics:v0.87.0, oci:ghcr.io/arjun0606/smolanalytics:v0.88.0, oci:ghcr.io/arjun0606/smolanalytics:v0.89.0, oci:ghcr.io/arjun0606/smolanalytics:v0.90.0, oci:ghcr.io/arjun0606/smolanalytics:v0.91.0
- Versions
- 96
- Inspected
- 3 of 6 checks · 45%
- Scored
- 2026-09-04 · rubric 1.0.0
What we checked
Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.
Injection surface
unscannable25% of gradeTool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).
No tool descriptions, server instructions, prompts, or resources were fetched; nothing to scan for injection.
Supply chain
pass25% of gradePackage provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.
repository linkage verified
Credential hygiene
unscannable15% of gradeHow the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.
No source files, package manifest, or tool schemas were fetched; cannot assess credential handling.
Permission scope
unscannable15% of gradeDeclared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.
No source files, package.json, or pyproject were fetched; cannot infer capability scope.
Version behavior
pass10% of gradeDiff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).
tool surface, capabilities, install scripts, and publisher unchanged vs prior version 0.90.0 (minor bump); no rug-pull drift.
Transport config
pass10% of gradeRemote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.
remote endpoint "https://smolanalytics.com/api/mcp" uses TLS (https); remote endpoint uses static token / bearer auth (acceptable)
Version history
Each release plotted by grade against the safe line at B. A version that sinks below the line has lost its trusted standing — the shape of a rug-pull.
| Version | Published | Grade | Score | Inspected | Change |
|---|---|---|---|---|---|
| v0.91.0 · current | 2026-09-02 | insufficient | — | 3/6 · 45% | ±0 |
| v0.90.0 | 2026-08-23 | insufficient | — | 3/6 · 45% | ±0 |
| v0.88.0 | 2026-08-21 | insufficient | — | 3/6 · 45% | ±0 |
| v0.85.2 | 2026-08-20 | insufficient | — | 2/6 · 35% | ±0 |
| v0.76.0 | 2026-08-19 | insufficient | — | 3/6 · 45% | ±0 |
| v0.66.4 | 2026-08-18 | insufficient | — | 3/6 · 45% | ±0 |
| v0.64.0 | 2026-08-17 | insufficient | — | 3/6 · 45% | ±0 |
| v0.61.0 | 2026-08-16 | insufficient | — | 2/6 · 35% | ±0 |
| v0.53.0 | 2026-08-12 | insufficient | — | 3/6 · 45% | ±0 |
| v0.52.0 | 2026-08-12 | insufficient | — | 3/6 · 45% | ±0 |
| v0.50.2 | 2026-08-09 | insufficient | — | 3/6 · 45% | ±0 |
| v0.50.1 | 2026-08-07 | insufficient | — | 3/6 · 45% | ±0 |
| v0.38.2 | 2026-08-06 | insufficient | — | 3/6 · 45% | ±0 |
| v0.28.0 | 2026-08-04 | insufficient | — | 3/6 · 45% | ±0 |
| v0.20.9 | 2026-08-02 | insufficient | — | 3/6 · 45% | ±0 |
| v0.20.6 | 2026-08-02 | insufficient | — | 3/6 · 45% | ±0 |
| v0.14.5 | 2026-07-28 | insufficient | — | 2/6 · 35% | ±0 |
| v0.8.2 | 2026-07-05 | insufficient | — | 1/6 · 25% | — |