io.github.datacharter/datacharter

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  unscannable25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  No tool descriptions, server instructions, prompts, or resources were fetched; nothing to scan for injection.

• Supply chain

  fail25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  Python build script executes at build time: network call in build script

• Credential hygiene

  warn15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  src/datacharter/server/static/assets/azcli-Y6nb8tq_.js: assigns a literal to token (key.…er (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/bat-BwHxbl9M.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/bat-BwHxbl9M.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/bat-BwHxbl9M.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/bicep-CFznDFnq.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/bicep-CFznDFnq.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/bicep-CFznDFnq.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/bicep-CFznDFnq.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/bicep-CFznDFnq.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/bicep-CFznDFnq.js: assigns a literal to token (stri…pe (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/bicep-CFznDFnq.js: assigns a literal to token (stri…id (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cameligo-Bf6VGUru.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cameligo-Bf6VGUru.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cameligo-Bf6VGUru.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cameligo-Bf6VGUru.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cameligo-Bf6VGUru.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/clojure-Dnu-v4kV.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/clojure-Dnu-v4kV.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/clojure-Dnu-v4kV.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/coffee-Bd8akH9Z.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/coffee-Bd8akH9Z.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/coffee-Bd8akH9Z.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/coffee-Bd8akH9Z.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cpp-BbWJElDN.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cpp-BbWJElDN.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cpp-BbWJElDN.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cpp-BbWJElDN.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cpp-BbWJElDN.js: assigns a literal to token (stri…in (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cpp-BbWJElDN.js: assigns a literal to token (keyw…de (len 25)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cpp-BbWJElDN.js: assigns a literal to token (stri…nd (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cpp-BbWJElDN.js: assigns a literal to token (keyw…nd (len 29)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/csharp-Co3qMtFm.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/csharp-Co3qMtFm.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/csharp-Co3qMtFm.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/csharp-Co3qMtFm.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/csharp-Co3qMtFm.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/css-DdJfP1eB.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/css-DdJfP1eB.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/css-DdJfP1eB.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/css-DdJfP1eB.js: assigns a literal to token (attr…er (len 22)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/css-DdJfP1eB.js: assigns a literal to token (attr…ue (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cypher-cTPe9QuQ.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cypher-cTPe9QuQ.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/cypher-cTPe9QuQ.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/dart-BOtBlQCF.js: assigns a literal to token (rege…ol (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ecl-BEgZUVRK.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ecl-BEgZUVRK.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ecl-BEgZUVRK.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ecl-BEgZUVRK.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/elixir-BkW5O-1t.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/elixir-BkW5O-1t.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/elixir-BkW5O-1t.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/elixir-BkW5O-1t.js: assigns a literal to token (deli…al (len 23)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/elixir-BkW5O-1t.js: assigns a literal to token (cons…er (len 18)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/elixir-BkW5O-1t.js: assigns a literal to token (stri…er (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/elixir-BkW5O-1t.js: assigns a literal to token (rege…er (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/elixir-BkW5O-1t.js: assigns a literal to token (sigi…er (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/elixir-BkW5O-1t.js: assigns a literal to token (comm…on (len 27)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/elixir-BkW5O-1t.js: assigns a literal to token (deli…ed (len 23)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/freemarker2-DM0thzwF.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/freemarker2-DM0thzwF.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/freemarker2-DM0thzwF.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/freemarker2-DM0thzwF.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/freemarker2-DM0thzwF.js: assigns a literal to token (@bra…ve (len 19)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/freemarker2-DM0thzwF.js: assigns a literal to token (deli…ve (len 19)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/freemarker2-DM0thzwF.js: assigns a literal to token (stri…pe (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/freemarker2-DM0thzwF.js: assigns a literal to token (numb…at (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/freemarker2-DM0thzwF.js: assigns a literal to token (@bra…on (len 23)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/freemarker2-DM0thzwF.js: assigns a literal to token (deli…id (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/fsharp-PahG7c26.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/graphql-BxJiqAUM.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/handlebars-BkMf3Qj4.js: assigns a literal to token (deli…ml (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/handlebars-BkMf3Qj4.js: assigns a literal to token (attr…ue (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/handlebars-BkMf3Qj4.js: assigns a literal to token (deli…rs (len 20)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/hcl-DtV1sZF8.js: assigns a literal to token (stri…er (len 24)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/html-KeNy2AFd.js: assigns a literal to token (attr…ue (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/julia-cl7-CwDS.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/julia-cl7-CwDS.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/julia-cl7-CwDS.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/less-9HpZscsL.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/less-9HpZscsL.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/less-9HpZscsL.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/less-9HpZscsL.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/less-9HpZscsL.js: assigns a literal to token (deli…ck (len 18)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/less-9HpZscsL.js: assigns a literal to token (attr…er (len 22)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/less-9HpZscsL.js: assigns a literal to token (stri…er (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/lexon-OrD6JF1K.js: assigns a literal to token (iden…te (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/lexon-OrD6JF1K.js: assigns a literal to token (numb…er (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/liquid-mhqehfbE.js: assigns a literal to token (deli…id (len 23)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/liquid-mhqehfbE.js: assigns a literal to token (deli…id (len 20)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/lua-Cyyb5UIc.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/lua-Cyyb5UIc.js: assigns a literal to token (deli…ay (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/lua-Cyyb5UIc.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/m3-B8OfTtLu.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/m3-B8OfTtLu.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/m3-B8OfTtLu.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/m3-B8OfTtLu.js: assigns a literal to token (cons…$0 (len 20)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/m3-B8OfTtLu.js: assigns a literal to token (type…$0 (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/mdx-69yOd9f1.js: assigns a literal to token (meta…nt (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/mdx-69yOd9f1.js: assigns a literal to token (type…er (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/mdx-69yOd9f1.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/mips-CiqrrVzr.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/msdax-DmeGPVcC.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/msdax-DmeGPVcC.js: assigns a literal to token (deli…ts (len 18)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/msdax-DmeGPVcC.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/msdax-DmeGPVcC.js: assigns a literal to token (comm…te (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/msdax-DmeGPVcC.js: assigns a literal to token (iden…te (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/mysql-C_tMU-Nz.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/mysql-C_tMU-Nz.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/mysql-C_tMU-Nz.js: assigns a literal to token (comm…te (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/mysql-C_tMU-Nz.js: assigns a literal to token (stri…le (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/mysql-C_tMU-Nz.js: assigns a literal to token (iden…te (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pascal-vHIfCaH5.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pascal-vHIfCaH5.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pascal-vHIfCaH5.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pascal-vHIfCaH5.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pascal-vHIfCaH5.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pascaligo-DtZ0uQbO.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pascaligo-DtZ0uQbO.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pascaligo-DtZ0uQbO.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pascaligo-DtZ0uQbO.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pascaligo-DtZ0uQbO.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/perl-Ub6l9XKa.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/perl-Ub6l9XKa.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/perl-Ub6l9XKa.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/perl-Ub6l9XKa.js: assigns a literal to token (stri…im (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/perl-Ub6l9XKa.js: assigns a literal to token (rege…im (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/perl-Ub6l9XKa.js: assigns a literal to token (rege…er (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/perl-Ub6l9XKa.js: assigns a literal to token (stri…er (len 24)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pgsql-BlNEE0v7.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pgsql-BlNEE0v7.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pgsql-BlNEE0v7.js: assigns a literal to token (comm…te (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pgsql-BlNEE0v7.js: assigns a literal to token (iden…te (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/php-BBUBE1dy.js: assigns a literal to token (deli…ml (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/php-BBUBE1dy.js: assigns a literal to token (attr…ue (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/php-BBUBE1dy.js: assigns a literal to token (cons…hp (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/php-BBUBE1dy.js: assigns a literal to token (vari…hp (len 23)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pla-DSh2-awV.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pla-DSh2-awV.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pla-DSh2-awV.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (deli…ce (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (deli…ma (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (deli…on (len 19)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (iden…ym (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (numb…at (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (numb…al (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (numb…al (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/postiats-CocnycG-.js: assigns a literal to token (stri…pe (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/powerquery-tScXyioY.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/powerquery-tScXyioY.js: assigns a literal to token (deli…ts (len 18)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/powerquery-tScXyioY.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/powershell-COWaemsV.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/powershell-COWaemsV.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/powershell-COWaemsV.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/powershell-COWaemsV.js: assigns a literal to token (stri…pe (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/powershell-COWaemsV.js: assigns a literal to token (stri…id (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/powershell-COWaemsV.js: assigns a literal to token (comm…$2 (len 18)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/protobuf-Brw8urJB.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/protobuf-Brw8urJB.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/protobuf-Brw8urJB.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/protobuf-Brw8urJB.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/protobuf-Brw8urJB.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pug-8SOpv6rk.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pug-8SOpv6rk.js: assigns a literal to token (deli…ay (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pug-8SOpv6rk.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pug-8SOpv6rk.js: assigns a literal to token (inte…er (len 23)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pug-8SOpv6rk.js: assigns a literal to token (attr…ue (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pug-8SOpv6rk.js: assigns a literal to token (attr…er (len 19)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pug-8SOpv6rk.js: assigns a literal to token (stri…pe (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/pug-8SOpv6rk.js: assigns a literal to token (stri…id (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/python-C5qpjWC4.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/python-C5qpjWC4.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/python-C5qpjWC4.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/qsharp-Bw9ernYp.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/r-j7ic8hl3.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/r-j7ic8hl3.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/r-j7ic8hl3.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/razor-fg0l3XC9.js: assigns a literal to token (deli…ml (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/razor-fg0l3XC9.js: assigns a literal to token (attr…ue (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/razor-fg0l3XC9.js: assigns a literal to token (iden…cs (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/redis-Bu5POkcn.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/redis-Bu5POkcn.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/redis-Bu5POkcn.js: assigns a literal to token (stri…le (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/redshift-Bs9aos_-.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/redshift-Bs9aos_-.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/redshift-Bs9aos_-.js: assigns a literal to token (comm…te (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/redshift-Bs9aos_-.js: assigns a literal to token (iden…te (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ruby-zBfavPgS.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ruby-zBfavPgS.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ruby-zBfavPgS.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ruby-zBfavPgS.js: assigns a literal to token (stri…er (len 24)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ruby-zBfavPgS.js: assigns a literal to token (stri…im (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ruby-zBfavPgS.js: assigns a literal to token (stri…im (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ruby-zBfavPgS.js: assigns a literal to token (rege…im (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ruby-zBfavPgS.js: assigns a literal to token (stri…im (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ruby-zBfavPgS.js: assigns a literal to token (stri…ly (len 19)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/ruby-zBfavPgS.js: assigns a literal to token (rege…ol (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/rust-BzKRNQWT.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sb-BBc9UKZt.js: assigns a literal to token (deli…ay (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sb-BBc9UKZt.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sb-BBc9UKZt.js: assigns a literal to token (keyw…if (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sb-BBc9UKZt.js: assigns a literal to token (keyw…le (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sb-BBc9UKZt.js: assigns a literal to token (keyw…or (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sb-BBc9UKZt.js: assigns a literal to token (keyw…ub (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/scala-D9hQfWCl.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/scheme-BPhDTwHR.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/scheme-BPhDTwHR.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/scheme-BPhDTwHR.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/scss-CBJaRo0y.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/scss-CBJaRo0y.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/scss-CBJaRo0y.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/scss-CBJaRo0y.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/scss-CBJaRo0y.js: assigns a literal to token (keyw…ow (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/scss-CBJaRo0y.js: assigns a literal to token (stri…er (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/shell-DiJ1NA_G.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/shell-DiJ1NA_G.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/shell-DiJ1NA_G.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/solidity-Db0IVjzk.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/solidity-Db0IVjzk.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/solidity-Db0IVjzk.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/solidity-Db0IVjzk.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sophia-CnS9iZB_.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sophia-CnS9iZB_.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sophia-CnS9iZB_.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sophia-CnS9iZB_.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sparql-CJmd_6j2.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sparql-CJmd_6j2.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sparql-CJmd_6j2.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sparql-CJmd_6j2.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sparql-CJmd_6j2.js: assigns a literal to token (pred…ql (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sql-ClhHkBeG.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sql-ClhHkBeG.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sql-ClhHkBeG.js: assigns a literal to token (comm…te (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sql-ClhHkBeG.js: assigns a literal to token (iden…te (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sql-ClhHkBeG.js: assigns a literal to token (keyw…ch (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sql-ClhHkBeG.js: assigns a literal to token (keyw…ck (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/sql-ClhHkBeG.js: assigns a literal to token (keyw…ce (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/st-CHwy0fLd.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/st-CHwy0fLd.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/st-CHwy0fLd.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/st-CHwy0fLd.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/swift-Bqt4WxQ4.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/systemverilog-Bs9z6M-B.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/systemverilog-Bs9z6M-B.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/systemverilog-Bs9z6M-B.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/systemverilog-Bs9z6M-B.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/systemverilog-Bs9z6M-B.js: assigns a literal to token (keyw…de (len 25)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/systemverilog-Bs9z6M-B.js: assigns a literal to token (stri…er (len 25)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/tcl-Dm6ycUr_.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/tcl-Dm6ycUr_.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/tcl-Dm6ycUr_.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/tcl-Dm6ycUr_.js: assigns a literal to token (keyw…ow (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/tcl-Dm6ycUr_.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/twig-Csy3S7wG.js: assigns a literal to token (deli…ig (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/twig-Csy3S7wG.js: assigns a literal to token (deli…ml (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/twig-Csy3S7wG.js: assigns a literal to token (attr…ml (len 20)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/typescript-CCbVPqil.js: assigns a literal to token (rege…ol (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/typescript-CCbVPqil.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/typespec-Btyra-wh.js: assigns a literal to token (deli…ly (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/typespec-Btyra-wh.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/typespec-Btyra-wh.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/typespec-Btyra-wh.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/typespec-Btyra-wh.js: assigns a literal to token (stri…pe (len 13)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/typespec-Btyra-wh.js: assigns a literal to token (stri…id (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (deli…ay (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (deli…is (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (deli…le (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…er (len 22)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…ss (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…um (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…nt (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…on (len 20)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…et (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…if (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…ce (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…le (len 18)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…or (len 20)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…ty (len 20)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…nt (len 22)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…er (len 25)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…ct (len 18)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…re (len 21)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…ub (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…ck (len 20)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…ry (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…le (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…th (len 16)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…ng (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…do (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…or (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…$1 (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (keyw…$0 (len 14)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/vb-Db0cS2oM.js: assigns a literal to token (stri…te (len 12)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/xml-CIpcyvha.js: assigns a literal to token (deli…ta (len 15)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/yaml-CiikAWeE.js: assigns a literal to token (deli…et (len 17)) — non-provider secret literal; prefer environment intake. src/datacharter/server/static/assets/yaml-CiikAWeE.js: assigns a literal to token (deli…re (len 16)) — non-provider secret literal; prefer environment intake. Reads secrets from the environment (e.g. src/datacharter/agent/llm.py) — the recommended intake shape.

• Permission scope

  warn15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  discloses broad/destructive filesystem access: src/datacharter/engine/session.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/datacharter/server/app.py: open(…, 'w'/'a'/'x') write-mode file access Capability DISCLOSURE, not a verdict: static analysis sees the primitive is present and reachable, not whether its use is attacker-controlled.

• Version behavior

  unscannable10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  no prior version to diff (first sight of io.github.datacharter/[email protected]); version-drift / rug-pull cannot be evaluated. Cold-start risk is covered by point-in-time checks (injection_surface, supply_chain, credential_hygiene), not here.

• Transport config

  warn10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  manifest/source references tracking behavior — disclosure