io.github.team-telnyx/telnyx

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  unscannable25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  No tool descriptions, server instructions, prompts, or resources were fetched; nothing to scan for injection.

• Supply chain

  pass25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  repository linkage verified

• Credential hygiene

  fail15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  resources/rooms/actions.js: contains a hardcoded JWT (eyJh…pQ (len 591)). resources/mobile-push-credentials.js: embeds a PRIVATE KEY block. resources/rooms/actions.mjs: contains a hardcoded JWT (eyJh…pQ (len 591)). resources/credential-connections/credential-connections.js: assigns a literal to password (my12…89 (len 25)) — non-provider secret literal; prefer environment intake. resources/integration-secrets.js: assigns a literal to token (my_s…ue (len 15)) — non-provider secret literal; prefer environment intake. Reads secrets from the environment (e.g. client.js) — the recommended intake shape.

• Permission scope

  warn15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  discloses broad/destructive filesystem access: resources/access-ip-address.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/access-ip-ranges.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/accounts.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/action-requirements.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/actions/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/addresses/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/calls/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/conferences/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/credential-connections/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/faxes/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/managed-accounts/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-hosted-number-orders/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/number-reservations/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/operator-connect/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-numbers/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/recordings/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/rooms/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/rooms/sessions/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/sim-card-groups/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/sim-cards/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/storage/migrations/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verifications/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verifications/by-phone-number/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verified-numbers/actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/activation-jobs.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/additional-documents.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/addresses.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/addresses/addresses.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/advanced-orders.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging/rcs/agents.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/ai.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: core/api-promise.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/assistants.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/assistants/assistants.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/associated-phone-numbers.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/audio.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/audit-events.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/authentication-providers.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/payment/auto-recharge-prefs.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-profiles/autoresp-configs.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/available-phone-number-blocks.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/available-phone-numbers.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/balance.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: internal/utils/base64.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/reporting/batch-detail-records.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/reporting/batch-detail-records/batch-detail-records.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/bundle-pricing/billing-bundles.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/billing-groups.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/brand.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/brand/brand.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/campaign-builder/brand.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/embeddings/buckets.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/storage/buckets.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/storage/buckets/buckets.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/bulk-sim-card-actions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/bundle-pricing.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/bundle-pricing/bundle-pricing.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verifications/by-phone-number.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verifications/by-phone-number/by-phone-number.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/call-control-applications.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/call-events.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/calls.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/calls/calls.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/queues/calls.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/calls.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/calls/calls.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/calls.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/campaign-builder.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/campaign-builder/campaign-builder.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/campaign.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/campaign/campaign.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/assistants/canary-deploys.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/reports/cdr-usage-reports.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/channel-zones.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/charges-breakdown.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/charges-summary.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/chat.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/external-connections/civic-addresses.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/clusters.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/comments.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/comments.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/portouts/comments.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/conferences.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/conferences/conferences.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/conferences.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/conferences/conferences.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/connections.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/conversations.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/conversations/conversations.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/country-coverage.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/credential-connections.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/credential-connections/credential-connections.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-numbers/csv-downloads.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/custom-storage-credentials.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/customer-service-records.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/networks/default-gateway.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/wireless/detail-records-reports.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/detail-records.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: internal/detect-platform.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/dialogflow-connections.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/document-links.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/documents.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/dynamic-emergency-addresses.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/dynamic-emergency-endpoints.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/embeddings.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/embeddings/embeddings.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/enum.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: core/error.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting/events.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/portouts/events.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/external-connections.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/external-connections/external-connections.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/brand/external-vetting.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/fax-applications.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/faxes.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/faxes/faxes.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/fine-tuning.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/fine-tuning/fine-tuning.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/fqdn-connections.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/fqdns.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/global-ip-allowed-ports.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/global-ip-assignment-health.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/global-ip-assignments-usage.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/global-ip-assignments.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/global-ip-health-check-types.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/global-ip-health-checks.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/global-ip-latency.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/global-ip-protocols.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/global-ip-usage.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/global-ips.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/inbound-channels.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/index.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/conversations/insight-groups.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/conversations/insight-groups/insight-groups.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/conversations/insight-groups/insights.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/conversations/insights.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/integration-secrets.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/inventory-coverage.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/invoices.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ip-connections.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ips.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/fine-tuning/jobs.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-number-blocks/jobs.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-numbers/jobs.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/recordings/json.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/transcriptions/json.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ledger-billing-group-reports.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/legacy.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/list.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting/loa-configurations.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/external-connections/log-messages.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/managed-accounts.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/managed-accounts/managed-accounts.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/reports/mdr-usage-reports.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/media.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/conversations/messages.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messages.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messages/messages.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-hosted-number-orders.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-hosted-number-orders/messaging-hosted-number-orders.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-hosted-numbers.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-numbers-bulk-updates.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-optouts.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-profiles.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-profiles/messaging-profiles.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-tollfree.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-tollfree/messaging-tollfree.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-url-domains.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/reporting/batch-detail-records/messaging.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/reporting/usage-reports/messaging.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging/messaging.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-numbers/messaging.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messsages.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/storage/migration-sources.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/storage/migrations.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/storage/migrations/migrations.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/mobile-network-operators.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/mobile-push-credentials.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/network-coverage.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/networks.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/networks/networks.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/notification-channels.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/notification-event-conditions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/notification-events.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/notification-profiles.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/notification-settings.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/number-block-orders.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/reporting/usage-reports/number-lookup.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/number-lookup.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/number-order-phone-numbers.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/number-orders.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/number-reservations.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/number-reservations/number-reservations.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/numbers-features.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/oauth-clients.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/oauth-grants.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/oauth.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/operator-connect.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/operator-connect/operator-connect.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/campaign/osr.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ota-updates.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/outbound-voice-profiles.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/conferences/participants.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/partner-campaigns.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: internal/utils/path.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/payment.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/payment/payment.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-number-assignment-by-profile.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-number-blocks.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-number-blocks/phone-number-blocks.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/phone-number-blocks.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-number-campaigns.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/phone-number-configurations.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/phone-number-extensions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-numbers-regulatory-requirements.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/external-connections/phone-numbers.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-numbers.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-numbers/phone-numbers.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/portability-checks.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/porting-orders.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-phone-numbers.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting/porting.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/portouts.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/portouts/portouts.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/private-wireless-gateways.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/public-internet-gateways.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/actions/purchase.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/queues.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/queues/queues.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/rcs-agents.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messages/rcs.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging/rcs.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging/rcs/rcs.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/recording-transcriptions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/calls/recordings-json.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/recordings.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/recordings/recordings.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/calls/recordings.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/recordings.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/recordings/recordings.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/regions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/actions/register.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/regulatory-requirements.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/external-connections/releases.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/reporting.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/reporting/reporting.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting/reports.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/portouts/reports.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/reports.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/reports/reports.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-tollfree/verification/requests.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/requirement-groups.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/requirement-types.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/requirements.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/room-compositions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/room-participants.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/room-recordings.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/rooms.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/rooms/rooms.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/assistants/tests/runs.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/assistants/tests/test-suites/runs.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/assistants/scheduled-events.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/rooms/sessions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/rooms/sessions/sessions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/seti.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/short-codes.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/sim-card-data-usage-notifications.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/sim-card-groups.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/sim-card-groups/sim-card-groups.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/sim-card-order-preview.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/sim-card-orders.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/sim-cards.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/sim-cards/sim-cards.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/siprec-connectors.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/calls/siprec.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/reporting/batch-detail-records/speech-to-text.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/storage/buckets/ssl-certificate.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/storage.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/storage/storage.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/calls/streams.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: internal/qs/stringify.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/sub-number-orders-report.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/sub-number-orders.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/portouts/supporting-documents.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/telephony-credentials.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/assistants/tests/test-suites.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/assistants/tests/test-suites/test-suites.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/assistants/tests.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/assistants/tests/tests.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml-applications.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/texml.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/text-to-speech.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/assistants/tools.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/transcriptions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/transcriptions/transcriptions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: core/uploads.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/external-connections/uploads.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/reporting/usage-reports.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/reporting/usage-reports/usage-reports.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/usage-reports.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/storage/buckets/usage.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/campaign/usecase.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/user-addresses.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/bundle-pricing/user-bundles.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/user-tags.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: internal/qs/utils.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: internal/utils/values.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/verification-codes.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-tollfree/verification.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-tollfree/verification/verification.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verifications.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verifications/verifications.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verified-numbers.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verified-numbers/verified-numbers.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verify-profiles.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/assistants/versions.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/virtual-cross-connects-coverage.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/virtual-cross-connects.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/reporting/batch-detail-records/voice.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/reporting/usage-reports/voice.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-numbers/voice.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-numbers/voicemail.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/webhook-deliveries.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/webhooks.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/well-known.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/wireguard-interfaces.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/wireguard-peers.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/wireless-blocklist-values.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/wireless-blocklists.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/wireless.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/wireless/wireless.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/access-ip-address.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/access-ip-ranges.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/texml/accounts/accounts.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/action-requirements.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/actions/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/addresses/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/calls/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/conferences/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/credential-connections/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/faxes/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/managed-accounts/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-hosted-number-orders/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/number-reservations/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/operator-connect/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/phone-numbers/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/recordings/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/rooms/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/rooms/sessions/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/sim-card-groups/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/sim-cards/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/storage/migrations/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verifications/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verifications/by-phone-number/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verified-numbers/actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/activation-jobs.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/additional-documents.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/addresses/addresses.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/advanced-orders.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging/rcs/agents.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/ai.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: core/api-promise.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/assistants/assistants.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/porting-orders/associated-phone-numbers.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/audio.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/audit-events.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/authentication-providers.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/payment/auto-recharge-prefs.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/messaging-profiles/autoresp-configs.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/available-phone-number-blocks.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/available-phone-numbers.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/balance.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: internal/utils/base64.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/legacy/reporting/batch-detail-records/batch-detail-records.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/bundle-pricing/billing-bundles.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/billing-groups.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/brand/brand.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/campaign-builder/brand.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/ai/embeddings/buckets.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/storage/buckets/buckets.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/bulk-sim-card-actions.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/bundle-pricing/bundle-pricing.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/verifications/by-phone-number/by-phone-number.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/call-control-applications.mjs: path traversal ('../') combined with file access discloses broad/destructive filesystem access: resources/call-events.mjs: path traversal ('../') combined with file access Capability DISCLOSURE, not a verdict: static analysis sees the primitive is present and reachable, not whether its use is attacker-controlled.

• Version behavior

  unscannable10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  no prior version to diff (first sight of io.github.team-telnyx/[email protected]); version-drift / rug-pull cannot be evaluated. Cold-start risk is covered by point-in-time checks (injection_surface, supply_chain, credential_hygiene), not here.

• Transport config

  unscannable10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  local stdio server: no remote transport or auth surface, and no phone-home/telemetry signal found in source. Absence of transport findings is NOT a safety guarantee — phone-home hosts can be constructed at runtime and defeat static analysis.