io.github.craigmbrown/blindoracle

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  pass25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  Scanned 158 text field(s); no instruction-injection patterns found. PASS = no static red flag. A server can serve different tool descriptions at runtime (the rug-pull class), which static scanning cannot see.

• Supply chain

  pass25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  repository linkage verified

• Credential hygiene

  pass15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  No hardcoded secrets, secret-shaped tool parameters, or leaked keys found. PASS = no static red flag; static analysis cannot prove the code honors env-based secret handling at runtime.

• Permission scope

  unscannable15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  No source files, package.json, or pyproject were fetched; cannot infer capability scope.

• Version behavior

  fail10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  vs prior 2.0.1 (patch bump): new tool "health_check" appeared; new tool "agent.prehire-check" appeared; new tool "agent.trust-badge" appeared; new tool "arbitration.dispute-settlement" appeared; new tool "attestation.single-use-seal" appeared; new tool "content.youtube-research" appeared; new tool "crypto.investment-plays" appeared; new tool "crypto.market-analyzer" touches a sensitive surface (email/exec/net/fs); new tool "data.business-registry" touches a sensitive surface (email/exec/net/fs); new tool "data.sec-edgar-filing" appeared; new tool "data.web-extract" touches a sensitive surface (email/exec/net/fs); new tool "deliberation.multi-agent-debate" appeared; new tool "finops.token-spend-audit" appeared; new tool "ops.due-diligence-scan" touches a sensitive surface (email/exec/net/fs); new tool "ops.link-integrity" touches a sensitive surface (email/exec/net/fs); new tool "oracle.alert-generator" appeared; new tool "oracle.comprehensive-report" touches a sensitive surface (email/exec/net/fs); new tool "oracle.cross-chain-prices" touches a sensitive surface (email/exec/net/fs); new tool "oracle.historical-analysis" touches a sensitive surface (email/exec/net/fs); new tool "oracle.market-arbitrage" appeared; new tool "oracle.price-feed" touches a sensitive surface (email/exec/net/fs); new tool "oracle.sentiment-analysis" touches a sensitive surface (email/exec/net/fs); new tool "oracle.volatility-monitor" touches a sensitive surface (email/exec/net/fs); new tool "prediction.blindoracle" appeared; new tool "procurement.council" appeared; new tool "procurement.trust-layer" touches a sensitive surface (email/exec/net/fs); new tool "procurement.vendor-vetting" appeared; new tool "reputation.lookup" appeared; new tool "research.topic-deep-researcher" touches a sensitive surface (email/exec/net/fs); new tool "research.topic-news-scanner" appeared; new tool "research.topic-sentiment-analyzer" appeared; new tool "security.audit-attestation" touches a sensitive surface (email/exec/net/fs); new tool "security.concordium-card-verify" touches a sensitive surface (email/exec/net/fs); new tool "security.enterprise-audit" appeared; new tool "security.injection-resilience" appeared; new tool "security.massat-audit" appeared; new tool "security.massat-conformance" appeared; new tool "security.process-attestation" appeared; new tool "social.verified_introduction" appeared; new tool "translation.zh-en" appeared.

• Transport config

  fail10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  remote MCP endpoint declares NO authentication (unauthenticated remote — nginx-ui/CVE-2026-33032 class)