io.github.navapbc/rebar

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  unscannable25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  No tool descriptions, server instructions, prompts, or resources were fetched; nothing to scan for injection.

• Supply chain

  fail25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  Python build script executes at build time: subprocess in build script

• Credential hygiene

  warn15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  tests/external/test_llm_trace.py: assigns a literal to API_KEY (hard…et (len 16)) — non-provider secret literal; prefer environment intake. tests/external/test_pydantic_ai_cutover_live.py: assigns a literal to API_KEY (hard…et (len 16)) — non-provider secret literal; prefer environment intake. tests/interfaces/facades/test_mcp_auth.py: assigns a literal to token (s3cr…89 (len 38)) — non-provider secret literal; prefer environment intake. tests/interfaces/facades/test_mcp_auth.py: assigns a literal to token (env-…88 (len 43)) — non-provider secret literal; prefer environment intake. tests/interfaces/facades/test_mcp_auth.py: assigns a literal to token (dige…66 (len 47)) — non-provider secret literal; prefer environment intake. tests/interfaces/facades/test_mcp_auth.py: assigns a literal to token (anot…21 (len 39)) — non-provider secret literal; prefer environment intake. tests/interfaces/facades/test_mcp_auth.py: assigns a literal to secret (supe…99 (len 51)) — non-provider secret literal; prefer environment intake. tests/interfaces/facades/test_mcp_auth.py: assigns a literal to token (inte…22 (len 45)) — non-provider secret literal; prefer environment intake. tests/interfaces/facades/test_mcp_auth.py: assigns a literal to token (prm-…22 (len 39)) — non-provider secret literal; prefer environment intake. tests/interfaces/facades/test_mcp_auth.py: assigns a literal to token (sess…11 (len 43)) — non-provider secret literal; prefer environment intake. tests/interfaces/facades/test_mcp_auth_proxy.py: assigns a literal to SECRET (prox…3t (len 19)) — non-provider secret literal; prefer environment intake. tests/interfaces/facades/test_mcp_auth_proxy.py: assigns a literal to token (stat…56 (len 46)) — non-provider secret literal; prefer environment intake. Reads secrets from the environment (e.g. src/rebar/_config_sources.py) — the recommended intake shape.

• Permission scope

  fail15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  HIGH: shell/exec capability AND network egress together — download-and-execute risk (src/rebar/_config_sources.py: subprocess.* call; src/rebar/_mcp_auth.py: outbound HTTP/socket call). HIGH: shell/exec capability AND destructive filesystem writes together (src/rebar/_config_sources.py: subprocess.* call; src/rebar/_ids.py: path traversal ('../') combined with file access). discloses shell/exec capability: src/rebar/_config_sources.py: subprocess.* call discloses shell/exec capability: src/rebar/_lib_ops.py: subprocess.* call discloses shell/exec capability: src/rebar/_opcert_signing.py: subprocess.* call discloses shell/exec capability: src/rebar/signing.py: subprocess.* call discloses shell/exec capability: src/rebar/_cli/__init__.py: subprocess.* call discloses shell/exec capability: src/rebar/_cli/_init.py: subprocess.* call discloses shell/exec capability: src/rebar/_commands/_seam.py: subprocess.* call discloses shell/exec capability: src/rebar/_commands/compact.py: subprocess.* call with shell=True (command-injection prone) discloses shell/exec capability: src/rebar/_commands/delete.py: subprocess.* call discloses shell/exec capability: src/rebar/_commands/fsck.py: subprocess.* call discloses shell/exec capability: src/rebar/_commands/fsck_repair.py: subprocess.* call discloses shell/exec capability: src/rebar/_commands/identity.py: subprocess.* call discloses shell/exec capability: src/rebar/_commands/init.py: subprocess.* call discloses shell/exec capability: src/rebar/_commands/purge_bridge.py: subprocess.* call discloses shell/exec capability: src/rebar/_commands/transition_close.py: subprocess.* call discloses shell/exec capability: src/rebar/_commands/txn.py: subprocess.* call discloses shell/exec capability: src/rebar/_commands/verify_authorship.py: subprocess.* call discloses shell/exec capability: src/rebar/_commands/verify_commit.py: subprocess.* call discloses shell/exec capability: src/rebar/_commands/verify_opcert.py: subprocess.* call discloses shell/exec capability: src/rebar/_engine/rebar_reconciler/acli_subprocess.py: subprocess.* call discloses shell/exec capability: src/rebar/_engine/rebar_reconciler/applier.py: subprocess.* call discloses shell/exec capability: src/rebar/_engine/rebar_reconciler/git_adapter.py: subprocess.* call discloses shell/exec capability: src/rebar/_engine_support/bridge_fsck.py: subprocess.* call discloses shell/exec capability: src/rebar/_engine_support/reads.py: subprocess.* call discloses shell/exec capability: src/rebar/_snapshot/repo_snapshot.py: subprocess.* call discloses shell/exec capability: src/rebar/_store/event_append.py: subprocess.* call discloses shell/exec capability: src/rebar/_store/gitutil.py: subprocess.* call with shell=True (command-injection prone) discloses shell/exec capability: src/rebar/_store/push.py: subprocess.* call discloses shell/exec capability: src/rebar/attest/authorship.py: subprocess.* call discloses shell/exec capability: src/rebar/attest/opcert.py: subprocess.* call discloses shell/exec capability: src/rebar/attest/sshsig.py: subprocess.* call discloses shell/exec capability: src/rebar/grounding/harness.py: subprocess.* call discloses shell/exec capability: src/rebar/llm/enrich_drain.py: subprocess.* call discloses shell/exec capability: src/rebar/llm/fs_tools.py: subprocess.* call discloses shell/exec capability: src/rebar/llm/code_review/finalize.py: subprocess.* call discloses shell/exec capability: src/rebar/llm/code_review/workflow_ops.py: subprocess.* call discloses shell/exec capability: src/rebar/llm/evals/eval_solver.py: subprocess.* call discloses shell/exec capability: src/rebar/llm/plan_review/drift_floor.py: subprocess.* call discloses shell/exec capability: src/rebar/llm/plan_review/sidecar.py: subprocess.* call discloses shell/exec capability: src/rebar/llm/workflow/criterion_preview.py: subprocess.* call discloses shell/exec capability: src/rebar/llm/workflow/snapshot.py: subprocess.* call discloses shell/exec capability: src/rebar/metrics/blame.py: subprocess.* call discloses shell/exec capability: src/rebar/metrics/git_metrics.py: subprocess.* call discloses shell/exec capability: src/rebar/opcert_service/workspace.py: subprocess.* call discloses shell/exec capability: src/rebar/review_bot/gerrit_client.py: subprocess.* call discloses shell/exec capability: src/rebar/schemas/gen_types.py: subprocess.* call discloses shell/exec capability: tests/_git_counts.py: subprocess.* call discloses shell/exec capability: tests/_isolation.py: subprocess.* call discloses shell/exec capability: tests/e2e/conftest.py: subprocess.* call discloses shell/exec capability: tests/external/conftest.py: subprocess.* call discloses shell/exec capability: tests/external/test_completion_pass_live.py: subprocess.* call discloses shell/exec capability: tests/integration/test_concurrency_regression.py: subprocess.* call discloses shell/exec capability: tests/integration/test_stdout_purity.py: subprocess.* call discloses shell/exec capability: tests/integration/test_store_concurrency.py: subprocess.* call discloses shell/exec capability: tests/integration/rebar_reconciler/test_reconcile_idempotency.py: subprocess.* call discloses shell/exec capability: tests/interfaces/adapters.py: subprocess.* call discloses shell/exec capability: tests/interfaces/conftest.py: subprocess.* call discloses shell/exec capability: tests/interfaces/test_metrics_cli.py: subprocess.* call discloses shell/exec capability: tests/interfaces/test_metrics_cli_heldout.py: subprocess.* call discloses shell/exec capability: tests/interfaces/contracts/test_error_envelope.py: subprocess.* call discloses shell/exec capability: tests/interfaces/contracts/test_event_schema_forward_compat.py: subprocess.* call discloses shell/exec capability: tests/interfaces/contracts/test_schema_coverage.py: subprocess.* call discloses shell/exec capability: tests/interfaces/contracts/test_schema_outputs.py: subprocess.* call discloses shell/exec capability: tests/interfaces/contracts/test_store_compat_gate.py: subprocess.* call discloses shell/exec capability: tests/interfaces/contracts/test_tombstone_registry.py: subprocess.* call discloses shell/exec capability: tests/interfaces/facades/test_cli.py: subprocess.* call discloses shell/exec capability: tests/interfaces/facades/test_creation_channel.py: subprocess.* call discloses shell/exec capability: tests/interfaces/facades/test_mcp_auth_custom.py: subprocess.* call discloses shell/exec capability: tests/interfaces/facades/test_mcp_auth_introspection.py: subprocess.* call discloses shell/exec capability: tests/interfaces/facades/test_mcp_auth_jwks.py: subprocess.* call discloses shell/exec capability: tests/interfaces/facades/test_mcp_auth_proxy.py: subprocess.* call discloses shell/exec capability: tests/interfaces/facades/test_mcp_http_transport.py: subprocess.* call discloses shell/exec capability: tests/interfaces/facades/test_parity.py: subprocess.* call discloses shell/exec capability: tests/interfaces/facades/test_surface.py: subprocess.* call discloses shell/exec capability: tests/interfaces/facades/test_title_corpus.py: subprocess.* call discloses shell/exec capability: tests/interfaces/facades/test_title_validation.py: subprocess.* call discloses shell/exec capability: tests/interfaces/io/test_creation_channel_import.py: subprocess.* call discloses shell/exec capability: tests/interfaces/io/test_import_batch_resume.py: subprocess.* call discloses shell/exec capability: tests/interfaces/io/test_import_batching.py: subprocess.* call discloses shell/exec capability: tests/interfaces/io/test_import_idempotency.py: subprocess.* call discloses shell/exec capability: tests/interfaces/io/test_import_ndjson.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_attestation_rendering.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_attestations_integration.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_attested_signing.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_block_loop_remediation.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_bug_close_class.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_bug_close_class_heldout.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_caused_by_autoderive.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_caused_by_autoderive_heldout.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_close_gate_subtree.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_close_gate_subtree_heldout.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_compact_index_lock.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_compact_process_death.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_completion_gate.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_delete_init_index_lock.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_exit_codes.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_gate_rubric_consistency.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_idea_close_bypass.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_idea_command.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_plan_review_gate.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_ref_coherence.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_session_log_capture.py: subprocess.* call discloses shell/exec capability: tests/interfaces/lifecycle/test_signature.py: subprocess.* call discloses shell/exec capability: tests/interfaces/queries/test_list_filters.py: subprocess.* call discloses shell/exec capability: tests/interfaces/queries/test_next_batch_compute.py: subprocess.* call discloses shell/exec capability: tests/interfaces/queries/test_ready_output.py: subprocess.* call discloses shell/exec capability: tests/interfaces/queries/test_recent_session_logs.py: subprocess.* call discloses dynamic code execution: src/rebar/_engine/rebar_reconciler/reconcile.py: uses eval/exec/__import__ discloses dynamic code execution: src/rebar/_engine/rebar_reconciler/reconcile_helpers.py: uses eval/exec/__import__ discloses dynamic code execution: src/rebar/llm/evals/eval_solver.py: uses eval/exec/__import__ discloses dynamic code execution: src/rebar/llm/plan_review/det_floor.py: uses eval/exec/__import__ discloses dynamic code execution: tests/e2e/js/browser_batch_library.mjs: uses eval(…) discloses dynamic code execution: tests/e2e/js/browser_morph.mjs: uses eval(…) discloses broad/destructive filesystem access: src/rebar/_ids.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/rebar/_opcert_signing.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: src/rebar/_opcert_signing.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/signing.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_cli/_jira_onboard.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/rebar/_commands/compact.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_commands/compact.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/rebar/_commands/delete.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_commands/fsck_repair.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_commands/init.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_commands/purge_bridge.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_commands/purge_bridge.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/rebar/_commands/scratch.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_commands/txn.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_commands/verify_commit.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/rebar/_engine/rebar_reconciler/acli_cli_ops.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_engine/rebar_reconciler/acli_graph.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_engine/rebar_reconciler/apply_planning.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_engine/rebar_reconciler/binding_store.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_engine/rebar_reconciler/pass_io.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_engine/rebar_reconciler/sync_logger.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: src/rebar/_engine_support/reads.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: src/rebar/_engine_support/validate_checks.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/rebar/_snapshot/janitor.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_snapshot/repo_snapshot.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_store/event_append.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_store/fsutil.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: src/rebar/_store/fsutil.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_store/gitutil.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/_store/lock.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/attest/sshsig.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: src/rebar/grounding/resolve.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/rebar/llm/enrich_drain.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/llm/enrich_drain.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/rebar/llm/prompting/prompts.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/rebar/llm/workflow/editor_server.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/rebar/llm/workflow/snapshot.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/opcert_service/keyprov.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/opcert_service/workspace.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/reducer/_cache.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/reducer/_processors.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/reducer/marker.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: src/rebar/reducer/marker.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/rebar/review_bot/gerrit_client.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/rebar/review_bot/voter.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: tests/conftest.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: tests/e2e/conftest.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: tests/e2e/test_editor_batch_library.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: tests/e2e/test_editor_e2e.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: tests/e2e/test_editor_library.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: tests/external/test_link_sync_roundtrip_live.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: tests/integration/test_concurrency_regression.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: tests/interfaces/lifecycle/test_signature.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) Capability DISCLOSURE, not a verdict: static analysis sees the primitive is present and reachable, not whether its use is attacker-controlled.

• Version behavior

  unscannable10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  no prior version to diff (first sight of io.github.navapbc/[email protected]); version-drift / rug-pull cannot be evaluated. Cold-start risk is covered by point-in-time checks (injection_surface, supply_chain, credential_hygiene), not here.

• Transport config

  warn10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  manifest/source references Tracking behavior — disclosure