MCPgrade

MCP server · trust report

io.github.datris/datris

Published by io.github.datris

version-controlsearch

1 check that ran failed — version behavior — so this release can’t be trusted as-is.

Publisher
io.github.datris
Repository
github.com/datris/datris-platform-oss
Install
pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.10.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.11.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.11.1, pypi:datris-mcp-server, pypi:datris-mcp-server, pypi:datris-mcp-server, pypi:datris-mcp-server, pypi:datris-mcp-server, pypi:datris-mcp-server, pypi:datris-mcp-server, pypi:datris-mcp-server, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.5.0, pypi:datris-mcp-server, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.5.2, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.5.3, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.5.4, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.5.5, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.5.6, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.5.7, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.5.8, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.5.9, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.1, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.10, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.11, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.12, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.13, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.14, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.15, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.16, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.17, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.18, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.19, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.2, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.20, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.21, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.3, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.4, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.5, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.6, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.7, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.8, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.6.9, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.7.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.7.2, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.7.3, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.7.4, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.7.5, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.7.6, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.7.8, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.7.9, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.8.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.8.1, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.8.10, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.8.11, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.8.12, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.8.2, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.8.3, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.8.4, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.8.5, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.8.6, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.8.7, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.8.8, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.8.9, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.9.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.11.2, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.11.3, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.12.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.12.1, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.12.2, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.13.1, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.14.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.14.1, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.15.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.16.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.16.1, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.16.2, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.16.3, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.17.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.18.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.19.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.19.1, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.19.2, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.19.3, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.19.4, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.20.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.20.1, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.20.2, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.21.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.22.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.23.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.24.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.24.1, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.25.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.26.0, pypi:datris-mcp-server, oci:docker.io/datrisai/datris-mcp-server:1.26.1
Versions
96
Inspected
5 of 6 checks · 75%
Scored
2026-09-03 · rubric 1.0.0

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

6 checks2 clean3 flagged1 not inspected

  • Injection surface

    unscannable25% of grade

    Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

    No tool descriptions, server instructions, prompts, or resources were fetched; nothing to scan for injection.

  • Supply chain

    pass25% of grade

    Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

    repository linkage verified

  • Credential hygiene

    pass15% of grade

    How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

    Reads secrets from the environment (e.g. cli.py) — the recommended intake shape. PASS = no static red flag; static analysis cannot prove the code honors env-based secret handling at runtime.

  • Permission scope

    warn15% of grade

    Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

    discloses broad/destructive filesystem access: server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) Capability DISCLOSURE, not a verdict: static analysis sees the primitive is present and reachable, not whether its use is attacker-controlled.

  • Version behavior

    fail10% of grade

    Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

    vs prior 1.25.0 (minor bump): new capability primitive(s) in source: http-client; new hardcoded outbound host/BCC destination(s): ., datris-tap-runner, datris.ai, docs.datris.ai, github.com, my-service.example.com, ollama.com, your-resource.openai.azure.com.

  • Transport config

    warn10% of grade

    Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

    manifest/source references ANALYTICS behavior — disclosure

Version history

Each release plotted by grade against the safe line at B. A version that sinks below the line has lost its trusted standing — the shape of a rug-pull.

VersionPublishedGradeScoreInspectedChange
v1.26.1 · current2026-09-02 B77.55/6 · 75%±0
v1.25.02026-09-01 B77.55/6 · 75%±0
v1.24.12026-08-31 B77.55/6 · 75%±0
v1.23.02026-08-28 B77.55/6 · 75%±0
v1.22.02026-08-27 B77.55/6 · 75%±0
v1.21.02026-08-26 B77.55/6 · 75%±0
v1.20.22026-08-25 B77.55/6 · 75%±0
v1.20.02026-08-24 B77.55/6 · 75%±0
v1.19.42026-08-21 B77.55/6 · 75%±0
v1.19.02026-08-19 B87.55/6 · 75%±0
v1.18.02026-08-18 B87.55/6 · 75%±0
v1.17.02026-08-17 B87.55/6 · 75%±0
v1.16.32026-08-14 B87.55/6 · 75%±0
v1.16.22026-08-13 B87.55/6 · 75%±0
v1.16.12026-08-12 B87.55/6 · 75%±0
v1.16.02026-08-11 B87.55/6 · 75%±0
v1.15.02026-08-10 B77.55/6 · 75%±0
v1.14.12026-08-05 B87.55/6 · 75%±0
v1.14.02026-08-04 B77.55/6 · 75%±0
v1.13.12026-07-28 B87.55/6 · 75%±0
v1.12.22026-07-27 B87.55/6 · 75%±0
v1.12.12026-07-24 B87.55/6 · 75%±0
v1.12.02026-07-23 B87.55/6 · 75%±0
v1.11.32026-07-22 B87.55/6 · 75%±0
v1.11.22026-07-21 B87.55/6 · 75%±0
v1.11.12026-07-15 B87.54/6 · 65%±0
v1.9.02026-07-09 B87.54/6 · 65%—