io.github.steve228uk/metro-mcp

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  warn25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  tool "open_deeplink" param "url" description: off-vendor URL in a description (example.com); capability text should not name where data goes.

• Supply chain

  warn25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  install hook "prepare" present and not a recognized benign build command; dependency "@modelcontextprotocol/node" is edit-distance 2 from popular package "@babel/core" (typosquat candidate); dependency "@modelcontextprotocol/client" is edit-distance 2 from popular package "@aws-sdk/client-s3" (typosquat candidate); dependency "@modelcontextprotocol/server" is edit-distance 1 from popular package "semver" (typosquat candidate)

• Credential hygiene

  pass15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  No hardcoded secrets, secret-shaped tool parameters, or leaked keys found. PASS = no static red flag; static analysis cannot prove the code honors env-based secret handling at runtime.

• Permission scope

  pass15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  No shell-exec, unbounded/sensitive filesystem, or download-and-run primitives found in scanned source. PASS = no static red flag. Static scanning is blind to code fetched or executed at runtime.

• Version behavior

  warn10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  vs prior 0.14.0 (minor bump): new tool "get_console_logs" appeared; new tool "clear_console_logs" appeared; new tool "get_network_requests" appeared; new tool "get_request_details" appeared; new tool "get_response_body" appeared; new tool "search_network" touches a sensitive surface (email/exec/net/fs); new tool "clear_network_requests" appeared; new tool "get_network_stats" appeared; new tool "get_errors" appeared; new tool "clear_errors" appeared; new tool "get_bundle_errors" appeared; new tool "evaluate_js" appeared; new tool "list_devices" appeared; new tool "get_app_info" touches a sensitive surface (email/exec/net/fs); new tool "get_connection_status" appeared; new tool "reload_app" appeared; new tool "symbolicate" appeared; new tool "get_redux_state" appeared; new tool "dispatch_redux_action" appeared; new tool "get_redux_actions" appeared; new tool "get_component_tree" appeared; new tool "find_components" appeared; new tool "inspect_component" appeared; new tool "get_testable_elements" appeared; new tool "get_storage_keys" appeared; new tool "get_storage_item" touches a sensitive surface (email/exec/net/fs); new tool "get_all_storage" touches a sensitive surface (email/exec/net/fs); new tool "take_screenshot" appeared; new tool "list_simulators" appeared; new tool "install_certificate" appeared; new tool "get_native_logs" appeared; new tool "app_lifecycle" appeared; new tool "get_screen_orientation" appeared; new tool "open_deeplink" touches a sensitive surface (email/exec/net/fs); new tool "list_url_schemes" touches a sensitive surface (email/exec/net/fs); new tool "list_permissions" appeared; new tool "grant_permission" appeared; new tool "revoke_permission" appeared; new tool "reset_permissions" appeared; new tool "open_app_settings" appeared; new tool "list_elements" appeared; new tool "tap_element" appeared; new tool "type_text" appeared; new tool "long_press" appeared; new tool "swipe" appeared; new tool "press_button" appeared; new tool "get_navigation_state" appeared; new tool "get_current_route" appeared; new tool "get_route_history" appeared; new tool "list_routes" appeared; new tool "audit_accessibility" appeared; new tool "check_element_accessibility" appeared; new tool "get_accessibility_summary" appeared; new tool "list_commands" appeared; new tool "run_command" touches a sensitive surface (email/exec/net/fs); new tool "start_test_recording" appeared; new tool "stop_test_recording" appeared; new tool "generate_test_from_recording" touches a sensitive surface (email/exec/net/fs); new tool "generate_wdio_config" touches a sensitive surface (email/exec/net/fs); new tool "add_recording_annotation" appeared; new tool "save_test_recording" appeared; new tool "load_test_recording" appeared; new tool "list_test_recordings" appeared; new tool "start_profiling" appeared; new tool "stop_profiling" appeared; new tool "get_profile_status" appeared; new tool "get_flamegraph" appeared; new tool "get_react_renders" touches a sensitive surface (email/exec/net/fs); new tool "get_memory_info" appeared; new tool "profile_action" appeared; new tool "start_heap_sampling" appeared; new tool "stop_heap_sampling" appeared; new tool "wait_for_element" appeared; new tool "wait_for_condition" appeared; new tool "wait_for_navigation" appeared; new tool "setup_statusline" appeared; new tool "list_debug_globals" appeared; new tool "inspect_at_point" appeared; new tool "open_devtools" appeared; new tool "get_app_directories" touches a sensitive surface (email/exec/net/fs); new tool "list_directory" appeared; new tool "read_file" touches a sensitive surface (email/exec/net/fs); new tool "get_file_info" touches a sensitive surface (email/exec/net/fs); new tool "delete_file" touches a sensitive surface (email/exec/net/fs); new tool "get_build_info" appeared; new tool "get_env_vars" touches a sensitive surface (email/exec/net/fs); new tool "get_platform_constants" appeared; new tool "get_expo_config" appeared.

• Transport config

  unscannable10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  local stdio server: no remote transport or auth surface, and no phone-home/telemetry signal found in source. Absence of transport findings is NOT a safety guarantee — phone-home hosts can be constructed at runtime and defeat static analysis.