io.github.Schoasch/backtesting-arena

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  warn25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  tool "arena_subscribe_signal_alerts" description: cross-tool redirection ('instead of call…'). tool "arena_subscribe_cycle_changes" description: cross-tool redirection ('instead of call…'). tool "arena_subscribe_pulse_changes" description: cross-tool redirection ('instead of call…'). tool "arena_subscribe_bullmarket_stage" description: cross-tool redirection ('instead of call…'). tool "arena_dip_decision" description: off-vendor URL in a description (tradingstrategies.work); capability text should not name where data goes. tool "arena_dip_scenario" description: off-vendor URL in a description (tradingstrategies.work); capability text should not name where data goes.

• Supply chain

  pass25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  repository linkage verified

• Credential hygiene

  pass15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  No hardcoded secrets, secret-shaped tool parameters, or leaked keys found. PASS = no static red flag; static analysis cannot prove the code honors env-based secret handling at runtime.

• Permission scope

  unscannable15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  No source files, package.json, or pyproject were fetched; cannot infer capability scope.

• Version behavior

  warn10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  vs prior 1.3.0 (minor bump): tool "arena_get_cycle" description changed (wording only, no injection pattern); tool "arena_get_etf_flows" description changed (wording only, no injection pattern); tool "arena_get_fear_greed" description changed (wording only, no injection pattern); tool "arena_get_fear_greed" gained input property(ies): end_date; tool "arena_get_bullmarket_ampel" description changed (wording only, no injection pattern); tool "arena_get_bullmarket_ampel" gained input property(ies): history_days; tool "arena_get_funding_rate" description changed (wording only, no injection pattern); tool "arena_get_macro_regime" description changed (wording only, no injection pattern); tool "arena_get_iv_snapshot" description changed (wording only, no injection pattern); tool "arena_get_pulse_history" description changed (wording only, no injection pattern); tool "arena_get_pulse_history" gained input property(ies): include_components; tool "arena_get_cycle_history" description changed (wording only, no injection pattern); tool "arena_get_funding_rate_history" description changed (wording only, no injection pattern); tool "arena_list_onchain_series" description changed (wording only, no injection pattern); tool "arena_get_sth_cost_basis" description changed (wording only, no injection pattern); tool "arena_get_halvings" description changed (wording only, no injection pattern); tool "arena_get_max_pain" description changed (wording only, no injection pattern); tool "arena_get_max_pain" gained input property(ies): include_strike_ladder, include_gex; tool "arena_get_max_pain_history" description changed (wording only, no injection pattern); tool "arena_get_drift_log" description changed (wording only, no injection pattern); tool "arena_list_strategies" description changed (wording only, no injection pattern); tool "arena_get_platform_activity" description changed (wording only, no injection pattern); tool "arena_get_platform_activity" gained input property(ies): detail; tool "arena_get_strategy_performance_by_regime" description changed (wording only, no injection pattern); tool "arena_get_backtest_trades" description changed (wording only, no injection pattern); tool "arena_run_backtest" description changed (wording only, no injection pattern); tool "arena_run_universe_backtest" description changed (wording only, no injection pattern); tool "arena_get_gem_scores" description changed (wording only, no injection pattern); tool "arena_get_gem_validation" description changed (wording only, no injection pattern); tool "arena_get_volatility_history" description changed (wording only, no injection pattern); tool "arena_get_historical_analog" description changed (wording only, no injection pattern); tool "arena_is_distinguishable" description changed (wording only, no injection pattern); tool "arena_get_trend_channels" description changed (wording only, no injection pattern); tool "arena_get_indicator_snapshot" description changed (wording only, no injection pattern); new tool "arena_get_signal_events" appeared; new tool "arena_get_taker_imbalance" appeared; new tool "arena_get_kimchi_premium" appeared; new tool "arena_get_cost_basis_spread" appeared; new tool "arena_status" touches a sensitive surface (email/exec/net/fs); new tool "arena_batch" touches a sensitive surface (email/exec/net/fs); new tool "arena_get_chart" touches a sensitive surface (email/exec/net/fs).

• Transport config

  fail10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  remote MCP endpoint declares NO authentication (unauthenticated remote — nginx-ui/CVE-2026-33032 class)