rocks.iching/hexagram-mcp

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  warn25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  tool "search_hexagrams" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. tool "get_hexagrams" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. tool "list_hexagrams" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. tool "get_reading_context" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. tool "get_trigram" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. tool "get_all_hexagrams" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. tool "list_trigrams" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. tool "get_hexagram" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. tool "list_sequences" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram index" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 1 — The Creative (乾)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 2 — The Receptive (坤)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 3 — Difficulty at the Beginning (屯)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 4 — Immaturity (蒙)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 5 — Waiting (Nourishment) (需)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 6 — Conflict (訟)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 7 — The Army (師)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 8 — Holding Together (比)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 9 — Small Accumulation (小畜)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 10 — Treading (履)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 11 — Peace (泰)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 12 — Standstill (否)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 13 — Union of People (同人)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 14 — Great Possession (大有)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 15 — Leveling (謙)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 16 — Mobilized Readiness (豫)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 17 — Following (隨)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 18 — Correction of Decay (蠱)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 19 — Approaching (臨)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 20 — Viewing (觀)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 21 — Biting Through (噬嗑)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 22 — Adornment (賁)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 23 — Stripping Away (剝)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 24 — Return (復)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 25 — Without Contrivance (無妄)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 26 — Great Accumulation (大畜)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 27 — Nourishment (頤)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 28 — Great Excess (大過)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 29 — Repeated Hazard (坎)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 30 — Radiance (離)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 31 — Resonance (咸)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 32 — Continuity (恆)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 33 — Withdrawal (遯)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 34 — Great Force (大壯)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 35 — Advancement (晉)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 36 — Obscured Light (明夷)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 37 — Household Order (家人)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 38 — Divergence (睽)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 39 — Impediment (蹇)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 40 — Release (解)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 41 — Decrease (損)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 42 — Increase (益)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 43 — Resolution (夬)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 44 — Encounter (姤)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 45 — Gathering (萃)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 46 — Ascending (升)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 47 — Oppression (困)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 48 — The Well (井)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 49 — Recasting (革)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 50 — The Cauldron (鼎)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 51 — Shock (震)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 52 — Stillness (艮)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 53 — Development (漸)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 54 — Secondary Marriage (歸妹)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 55 — Peak Fullness (豐)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 56 — Sojourning (旅)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 57 — Penetration (巽)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 58 — Joyous Exchange (兌)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 59 — Dissolution (渙)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 60 — Limitation (節)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 61 — Inner Alignment (中孚)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 62 — Small Exceeding (小過)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 63 — After Completion (既濟)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram 64 — Before Completion (未濟)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Trigram index" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Trigram 000 — Heaven (Qián)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Trigram 001 — Lake (Duì)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Trigram 010 — Fire (Lí)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Trigram 011 — Thunder (Zhèn)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Trigram 100 — Wind (Xùn)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Trigram 101 — Water (Kǎn)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Trigram 110 — Mountain (Gèn)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Trigram 111 — Earth (Kūn)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Hexagram sequences" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Sequence — King Wen" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Full hexagram dataset (King Wen order)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Sequence — Mawangdui" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Full hexagram dataset (Mawangdui order)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Sequence — Eight Palaces" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Full hexagram dataset (Eight Palaces order)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Sequence — Binary" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes. resource "Full hexagram dataset (Binary order)" description: off-vendor URL in a description (iching.rocks); capability text should not name where data goes.

• Supply chain

  warn25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  no resolvable repository linked to the package (provenance unverifiable)

• Credential hygiene

  pass15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  No hardcoded secrets, secret-shaped tool parameters, or leaked keys found. PASS = no static red flag; static analysis cannot prove the code honors env-based secret handling at runtime.

• Permission scope

  unscannable15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  No source files, package.json, or pyproject were fetched; cannot infer capability scope.

• Version behavior

  unscannable10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  no prior version to diff (first sight of rocks.iching/[email protected]); version-drift / rug-pull cannot be evaluated. Cold-start risk is covered by point-in-time checks (injection_surface, supply_chain, credential_hygiene), not here.

• Transport config

  fail10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  remote MCP endpoint declares NO authentication (unauthenticated remote — nginx-ui/CVE-2026-33032 class)