io.github.UnityNodes/canton-ccpedia

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  fail25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  tool "get_upcoming_deadlines" description: URL on a cheap/abused TLD (ccpedia.xyz) — postmark-mcp used giftshop.club. server instructions: URL on a cheap/abused TLD (ccpedia.xyz) — postmark-mcp used giftshop.club. tool "get_validator_fleet" description: bare 'IMPORTANT:' prose in a description (tag form is high-confidence; prose is warn).

• Supply chain

  warn25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  install hook "postinstall" present and not a recognized benign build command

• Credential hygiene

  pass15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  No hardcoded secrets, secret-shaped tool parameters, or leaked keys found. PASS = no static red flag; static analysis cannot prove the code honors env-based secret handling at runtime.

• Permission scope

  pass15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  No shell-exec, unbounded/sensitive filesystem, or download-and-run primitives found in scanned source. PASS = no static red flag. Static scanning is blind to code fetched or executed at runtime.

• Version behavior

  fail10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  vs prior 1.0.0 (patch bump): tool "search" description changed (wording only, no injection pattern); tool "search" gained input property(ies): offset; tool "list_cips" description changed (wording only, no injection pattern); tool "list_cips" gained input property(ies): offset; tool "get_discussion" description changed (wording only, no injection pattern); tool "get_trending" description changed (wording only, no injection pattern); tool "get_radar" description changed (wording only, no injection pattern); tool "get_radar" gained input property(ies): limit, offset; tool "get_proposals" description changed (wording only, no injection pattern); tool "get_proposals" gained input property(ies): offset; tool "get_doc" description changed (wording only, no injection pattern); tool "get_cip_history" description changed (wording only, no injection pattern); tool "get_cip_attachments" description changed (wording only, no injection pattern); tool "get_cip_mentions" description changed (wording only, no injection pattern); tool "get_recent_changes" description changed (wording only, no injection pattern); tool "get_network_stats" description changed (wording only, no injection pattern); tool "get_token_market" description changed (wording only, no injection pattern); tool "list_ecosystem_projects" description changed (wording only, no injection pattern); tool "list_ecosystem_projects" gained input property(ies): liveness, offset; tool "get_network_state" description changed (wording only, no injection pattern); tool "list_repos" description changed (wording only, no injection pattern); tool "list_github_discussions" description changed (wording only, no injection pattern); tool "get_github_discussion" description changed (wording only, no injection pattern); tool "get_video" description changed (wording only, no injection pattern); tool "get_video" gained input property(ies): transcript_chars; tool "list_videos" description changed (wording only, no injection pattern); tool "list_governance_votes" gained input property(ies): offset; tool "get_cip_vote_outcome" gained input property(ies): limit; tool "get_cip_votes" description changed (wording only, no injection pattern); tool "get_cip_votes" gained input property(ies): limit, offset; tool "list_mailing_threads" description changed (wording only, no injection pattern); tool "get_mailing_thread" description changed (wording only, no injection pattern); tool "get_mailing_thread" gained input property(ies): limit, offset; tool "check_deprecation" description changed (wording only, no injection pattern); tool "get_started_guide" description changed (wording only, no injection pattern); tool "get_api_reference" description changed (wording only, no injection pattern); tool "get_current_versions" description changed (wording only, no injection pattern); tool "get_cip_citations" description changed (wording only, no injection pattern); tool "get_kb_drift" description changed (wording only, no injection pattern); tool "diagnose_error" description changed (wording only, no injection pattern); tool "get_breaking_changes" description changed (wording only, no injection pattern); tool "get_recurring_issue_fingerprint" description changed (wording only, no injection pattern); tool "get_app_metrics" description changed (wording only, no injection pattern); tool "get_recent_deployments" gained input property(ies): offset; tool "compare_governance_outcomes" description changed (wording only, no injection pattern); tool "search_github_issues" description changed (wording only, no injection pattern); tool "search_github_issues" gained input property(ies): offset; tool "search_talks" gained input property(ies): offset; tool "get_cip_implementation_status" gained input property(ies): cip_id; tool "get_latest_release" description changed (wording only, no injection pattern); tool "get_npm_packages" gained input property(ies): offset; tool "find_similar_projects" description changed (wording only, no injection pattern); tool "find_similar_projects" gained input property(ies): offset; tool "search_mailing_list" gained input property(ies): offset; tool "find_code_examples" gained input property(ies): offset; tool "get_ecosystem_gaps" description changed (wording only, no injection pattern); tool "detect_builder_overlap" description changed (wording only, no injection pattern); tool "full_context" description changed (wording only, no injection pattern); tool "community_consensus" description changed (wording only, no injection pattern); tool "outdated_guidance_detector" description changed (wording only, no injection pattern); tool "find_collaboration_opportunities" description changed (wording only, no injection pattern); new tool "get_validator" appeared; new install hook(s) not present in prior version: postinstall.

• Transport config

  fail10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  remote MCP endpoint declares NO authentication (unauthenticated remote — nginx-ui/CVE-2026-33032 class)