io.github.aitrailblazer/deltasignal-atlas-7

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  warn25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  tool "deltasignal_list_article_tripcodes" description: cross-tool redirection ('instead of call…').

• Supply chain

  pass25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  repository linkage verified

• Credential hygiene

  pass15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  No hardcoded secrets, secret-shaped tool parameters, or leaked keys found. PASS = no static red flag; static analysis cannot prove the code honors env-based secret handling at runtime.

• Permission scope

  unscannable15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  No source files, package.json, or pyproject were fetched; cannot infer capability scope.

• Version behavior

  warn10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  vs prior 1.0.0 (minor bump): new tool "deltasignal_help" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_morning_brief" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_public_daily_brief" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_company_report" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_issuer_deep_report" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_pressure_board" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_alpha_sweep" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_quick_ticker_check" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_readiness" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_top_stressed" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_top_stressed_natural" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_covenant_stress" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_covenant_stress_natural" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_morning_brief_natural" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_peer_ranking" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_alpha_signals" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_alpha_opportunities" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_alpha_opportunities_audit" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_company_fundamentals" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_atlas_history" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_atlas7_calculation_history" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_atlas7_companyfacts_history" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_atlas7_point_in_time_history" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_atlas7_audit_status" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_atlas7_four_level_applicability" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_risk_distribution" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_daily_changes" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_daily_change_evidence" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_spectra_field_map" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_coinbase_perp_constituents" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_coinbase_perp_calculation_history" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_coinbase_perp_factors" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_coinbase_perp_rankings" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_coinbase_perp_market_spectra" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_synthetic_etf_pressure_state" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_synthetic_etf_audit" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_thesis_readiness" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_thesis_create" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_generate_article_tripcode" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_list_article_tripcodes" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_resolve_article_tripcode" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_resolve_tripcode_research_packet" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_resolve_river_tripcode" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_reverse_search_river" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_search_by_claim" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_search_by_issuer" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_compare_claim_to_evidence" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_generate_filing_tripcode" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_resolve_filing_tripcode" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_compare_article_to_filing_evidence" touches a sensitive surface (email/exec/net/fs); new tool "deltasignal_article_thesis_map" touches a sensitive surface (email/exec/net/fs); new tool "strategix_diagram_validate" appeared; new tool "strategix_diagram_render" appeared; new tool "strategix_visual_spec_package" appeared; new tool "strategix_visual_spec_search" appeared; new tool "atlas7_model_catalog" appeared; new tool "atlas7_field_catalog" appeared; new tool "atlas7_issuer_identity" appeared; new tool "atlas7_metadata_health" appeared; new tool "atlas7_compile_query" appeared; new tool "atlas7_readiness" appeared; new tool "atlas7_signal_board" appeared; new tool "atlas7_issuer_signal" appeared; new tool "atlas7_pressure_board" appeared; new tool "atlas7_top_stress" appeared; new tool "atlas7_alpha_candidates" appeared; new tool "atlas7_quick_ticker_check" appeared; new tool "atlas7_peer_comparison" appeared; new tool "atlas7_covenant_stress" appeared; new tool "atlas7_company_fundamentals" appeared; new tool "atlas7_recent_history" appeared; new tool "atlas7_market_context" appeared; new tool "atlas7_explain_signal" appeared; new tool "atlas7_company_report_inputs" appeared; new tool "atlas7_morning_brief_inputs" appeared; new tool "atlas7_theme_discovery" appeared; new tool "atlas7_evidence_lineage" appeared; new tool "atlas7_lineage_audit" appeared; new tool "atlas7_semantic_query" appeared; new tool "atlas7_archive_search" appeared; new tool "atlas7_portfolio_watchlist" appeared.

• Transport config

  fail10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  remote MCP endpoint declares NO authentication (unauthenticated remote — nginx-ui/CVE-2026-33032 class)