MCPgrade

MCP server · trust report

io.github.ggozad/haiku-rag

Published by io.github.ggozad

searchversion-control

1 check that ran failed — version behavior — so this release can’t be trusted as-is.

Publisher
io.github.ggozad
Repository
github.com/ggozad/haiku.rag
Install
pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag, pypi:haiku-rag
Versions
127
Inspected
5 of 6 checks · 75%
Scored
2026-09-04 · rubric 1.0.0

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

6 checks2 clean3 flagged1 not inspected

  • Injection surface

    unscannable25% of grade

    Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

    No tool descriptions, server instructions, prompts, or resources were fetched; nothing to scan for injection.

  • Supply chain

    pass25% of grade

    Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

    Python build script has no build-time network/exec; repository linkage verified

  • Credential hygiene

    pass15% of grade

    How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

    Reads secrets from the environment (e.g. app/frontend/app/api/copilotkit/route.ts) — the recommended intake shape. PASS = no static red flag; static analysis cannot prove the code honors env-based secret handling at runtime.

  • Permission scope

    warn15% of grade

    Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

    has both shell/exec and network egress — capable of download-and-run, though no such path was observed (scripts/bump_version.py: subprocess.* call; .claude/skills/debug-evals/lf-query.sh: outbound HTTP/socket call). has both shell/exec and destructive filesystem writes (scripts/bump_version.py: subprocess.* call; evaluations/scripts/build_t2_submission.py: open(…, 'w'/'a'/'x') write-mode file access). discloses shell/exec capability: scripts/bump_version.py: subprocess.* call discloses broad/destructive filesystem access: evaluations/scripts/build_t2_submission.py: open(…, 'w'/'a'/'x') write-mode file access Capability DISCLOSURE, not a verdict: static analysis sees the primitive is present and reachable, not whether its use is attacker-controlled.

  • Version behavior

    fail10% of grade

    Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

    vs prior 0.81.0 (minor bump): new capability primitive(s) in source: fs-write, http-client, subprocess; new hardcoded outbound host/BCC destination(s): backend, frontend, ggozad.github.io, github, github.com, host.docker.internal, logfire-, logfire-eu.pydantic.dev, t2ragbench.demo.hcds.uni-hamburg.de.

  • Transport config

    warn10% of grade

    Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

    manifest/source references telemetry behavior — disclosure

Version history

Each release plotted by grade against the safe line at B. A version that sinks below the line has lost its trusted standing — the shape of a rug-pull.

VersionPublishedGradeScoreInspectedChange
v0.82.1 · current2026-09-03 B77.55/6 · 75%±0
v0.81.02026-09-01 B1004/6 · 65%±0
v0.80.02026-08-31 B1004/6 · 65%±0
v0.79.02026-08-28 B1004/6 · 65%±0
v0.78.02026-08-24 B1004/6 · 65%±0
v0.77.02026-08-21 B1004/6 · 65%±0
v0.75.02026-08-19 B1004/6 · 65%±0
v0.74.02026-08-13 B1003/6 · 55%±0
v0.73.02026-08-06 B92.54/6 · 65%±0
v0.72.12026-07-31 B92.53/6 · 55%±0
v0.71.02026-07-29 B92.54/6 · 65%±0
v0.70.02026-07-25 B87.55/6 · 75%±0
v0.69.02026-07-24 B87.54/6 · 65%±0
v0.67.32026-07-23 B87.54/6 · 65%±0
v0.67.12026-07-22 B92.54/6 · 65%±0
v0.67.02026-07-16 B92.53/6 · 55%±0
v0.65.12026-07-10 B1003/6 · 55%±0
v0.53.02026-06-03 B92.54/6 · 65%±0
v0.52.02026-06-01 B92.53/6 · 55%±0
v0.48.02026-05-20 B1003/6 · 55%±0
v0.44.02026-04-29 B92.53/6 · 55%±0
v0.31.12026-02-20 B92.54/6 · 65%±0
v0.31.02026-02-20 B92.53/6 · 55%±0
v0.19.42025-11-28 B92.53/6 · 55%±0
v0.13.32025-10-30 B92.53/6 · 55%—