io.github.rafaelgaspar/longhorn-mcp

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  warn25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  tool "volume_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_create" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_delete" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_attach" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_detach" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_activate" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_expand" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_cancel_expansion" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_engine_upgrade" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_salvage" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_replica_remove" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_trim_filesystem" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_update_setting" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_snapshot_create" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_snapshot_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_snapshot_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_snapshot_delete" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_snapshot_revert" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_snapshot_purge" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_snapshot_backup" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_snapshot_cr_create" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_snapshot_cr_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_snapshot_cr_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_snapshot_cr_delete" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_recurring_job_add" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_recurring_job_delete" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_recurring_job_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_pv_create" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "volume_pvc_create" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "snapshot_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "snapshot_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backup_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backup_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backupvolume_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backupvolume_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backupvolume_update" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backupvolume_delete" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backupvolume_backup_delete" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backupvolume_backup_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backupvolume_backup_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backupvolume_backup_list_by_volume" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backupvolume_sync" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backuptarget_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backuptarget_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backuptarget_create" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backuptarget_update" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backuptarget_delete" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backuptarget_sync" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backuptarget_update_name" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backingimage_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backingimage_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backingimage_create" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backingimage_delete" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backingimage_cleanup" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backingimage_update_min_copies" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backingimage_upload" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backingimage_backup_create" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backupbackingimage_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backupbackingimage_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backupbackingimage_delete" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "backupbackingimage_restore" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "node_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "node_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "node_update" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "node_disk_update" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "setting_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "setting_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "setting_update" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "engineimage_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "engineimage_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "engineimage_create" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "engineimage_delete" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "recurringjob_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "recurringjob_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "recurringjob_create" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "recurringjob_update" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "recurringjob_delete" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "orphan_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "orphan_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "supportbundle_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "supportbundle_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "systembackup_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "systembackup_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "systembackup_create" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "systembackup_delete" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "systemrestore_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "systemrestore_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "systemrestore_create" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "systemrestore_delete" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "longhorn_list_tags" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "shard_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "shard_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "shardgroup_list" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes. tool "shardgroup_get" description: off-vendor URL in a description (longhorn.io); capability text should not name where data goes.

• Supply chain

  warn25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  dependency "@modelcontextprotocol/node" is edit-distance 2 from popular package "@babel/core" (typosquat candidate); dependency "@modelcontextprotocol/server" is edit-distance 1 from popular package "semver" (typosquat candidate)

• Credential hygiene

  fail15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  tool "volume_pv_create" has a secret-shaped input parameter "secretName" — secrets must never be tool parameters (the model would supply/handle the credential). tool "volume_pv_create" has a secret-shaped input parameter "secretNamespace" — secrets must never be tool parameters (the model would supply/handle the credential). tool "backuptarget_update" has a secret-shaped input parameter "credentialSecret" — secrets must never be tool parameters (the model would supply/handle the credential). tool "backupbackingimage_restore" has a secret-shaped input parameter "secret" — secrets must never be tool parameters (the model would supply/handle the credential). tool "backupbackingimage_restore" has a secret-shaped input parameter "secretNamespace" — secrets must never be tool parameters (the model would supply/handle the credential).

• Permission scope

  pass15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  No shell-exec, unbounded/sensitive filesystem, or download-and-run primitives found in scanned source. PASS = no static red flag. Static scanning is blind to code fetched or executed at runtime.

• Version behavior

  warn10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  vs prior 0.1.6 (patch bump): new tool "volume_job_list" appeared.

• Transport config

  unscannable10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  local stdio server: no remote transport or auth surface, and no phone-home/telemetry signal found in source. Absence of transport findings is NOT a safety guarantee — phone-home hosts can be constructed at runtime and defeat static analysis.