Trust Card · Static snapshot

elastic__mcp-server-elasticsearch U

Ungraded — insufficient static coverage · 0 findings (0 critical) · scope minimal · Not ranked: insufficient static coverage.

Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream elastic/mcp-server-elasticsearch @ 9e64b84 (2026-06-23)

Score breakdown

No numeric score or breakdown: insufficient static coverage. Findings remain actionable; absence of findings is not evidence of safety.

Insufficient static coverage: No non-empty supported source analyzed; documentation and data alone provide limited coverage; Unsupported source present. Findings remain actionable; absence of findings is not evidence of safety.

Coverage: limited

Static-heuristic scope: 8 analyzed / 38 discovered files; 21 unsupported source files; 31 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.

No non-empty supported source analyzed; documentation and data alone provide limited coverage
Unsupported source present
Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.
Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.
Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.
Ignored directories, declarations, and non-implementation assets are outside rule scope.

File coverage, applied rules and scan limits

{
  "mode": "static-heuristic",
  "status": "limited",
  "reasons": [
    "No non-empty supported source analyzed; documentation and data alone provide limited coverage",
    "Unsupported source present"
  ],
  "limitations": [
    "Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
    "Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
    "Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
    "Ignored directories, declarations, and non-implementation assets are outside rule scope."
  ],
  "discoveredFiles": 38,
  "analyzedFiles": [
    {
      "path": ".buildkite/docker.yml",
      "scope": "data",
      "bytes": 239,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".buildkite/pipeline.yml",
      "scope": "data",
      "bytes": 1253,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".buildkite/pull-requests.json",
      "scope": "data",
      "bytes": 715,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/auto-comment.yml",
      "scope": "data",
      "bytes": 1191,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/build.yml",
      "scope": "data",
      "bytes": 3017,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/stale.yml",
      "scope": "data",
      "bytes": 858,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "catalog-info.yaml",
      "scope": "data",
      "bytes": 2188,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "renovate.json",
      "scope": "data",
      "bytes": 172,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    }
  ],
  "unsupportedSourceFiles": [
    ".buildkite/diff",
    ".env-example",
    "Dockerfile",
    "Dockerfile-8000",
    "Makefile",
    "elastic-mcp.json5",
    "scripts/cargo-run.sh",
    "src/bin/elasticsearch-core-mcp-server.rs",
    "src/bin/start_http.rs",
    "src/cli.rs",
    "src/lib.rs",
    "src/protocol/http.rs",
    "src/protocol/mod.rs",
    "src/protocol/stdio.rs",
    "src/servers/elasticsearch/base_tools.rs",
    "src/servers/elasticsearch/mod.rs",
    "src/servers/mod.rs",
    "src/utils/interpolator.rs",
    "src/utils/mod.rs",
    "src/utils/rmcp_ext.rs",
    "tests/http_tests.rs"
  ],
  "excludedFiles": [
    {
      "path": ".git",
      "reason": "ignored-directory"
    },
    {
      "path": ".buildkite/diff",
      "reason": "unsupported-implementation"
    },
    {
      "path": ".dockerignore",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".env-example",
      "reason": "unsupported-implementation"
    },
    {
      "path": ".gitignore",
      "reason": "outside-rule-scope"
    },
    {
      "path": "Cargo.lock",
      "reason": "outside-rule-scope"
    },
    {
      "path": "Cargo.toml",
      "reason": "outside-rule-scope"
    },
    {
      "path": "Dockerfile",
      "reason": "unsupported-implementation"
    },
    {
      "path": "Dockerfile-8000",
      "reason": "unsupported-implementation"
    },
    {
      "path": "LICENSE",
      "reason": "outside-rule-scope"
    },
    {
      "path": "Makefile",
      "reason": "unsupported-implementation"
    },
    {
      "path": "NOTICE.txt",
      "reason": "outside-rule-scope"
    },
    {
      "path": "README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/CONTRIBUTING.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "elastic-mcp.json5",
      "reason": "unsupported-implementation"
    },
    {
      "path": "rustfmt.toml",
      "reason": "outside-rule-scope"
    },
    {
      "path": "scripts/cargo-run.sh",
      "reason": "unsupported-implementation"
    },
    {
      "path": "src/bin/elasticsearch-core-mcp-server.rs",
      "reason": "unsupported-implementation"
    },
    {
      "path": "src/bin/start_http.rs",
      "reason": "unsupported-implementation"
    },
    {
      "path": "src/cli.rs",
      "reason": "unsupported-implementation"
    },
    {
      "path": "src/lib.rs",
      "reason": "unsupported-implementation"
    },
    {
      "path": "src/protocol/http.rs",
      "reason": "unsupported-implementation"
    },
    {
      "path": "src/protocol/mod.rs",
      "reason": "unsupported-implementation"
    },
    {
      "path": "src/protocol/stdio.rs",
      "reason": "unsupported-implementation"
    },
    {
      "path": "src/servers/elasticsearch/base_tools.rs",
      "reason": "unsupported-implementation"
    },
    {
      "path": "src/servers/elasticsearch/mod.rs",
      "reason": "unsupported-implementation"
    },
    {
      "path": "src/servers/mod.rs",
      "reason": "unsupported-implementation"
    },
    {
      "path": "src/utils/interpolator.rs",
      "reason": "unsupported-implementation"
    },
    {
      "path": "src/utils/mod.rs",
      "reason": "unsupported-implementation"
    },
    {
      "path": "src/utils/rmcp_ext.rs",
      "reason": "unsupported-implementation"
    },
    {
      "path": "tests/http_tests.rs",
      "reason": "unsupported-implementation"
    }
  ],
  "readErrors": [],
  "truncation": [],
  "limits": {
    "maxFiles": 4000,
    "maxDepth": 12,
    "maxFileBytes": 1048576
  }
}

Fix first (0 critical/high)

No findings in scope of the 8-rule static suite.

Permissions

Scope: minimal · Shell: disabled · Network egress: no · File deletion: none · Human approval: none

Provenance

License: none detected · Lockfile: no · Security policy: no · Signals: unverified origin

Independently scanned by the OpenTrustBench registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/elastic/mcp-server-elasticsearch. Scores move with every upstream commit; pages refresh weekly. How scoring works.