⚠️ This snapshot is over 30 days old — treat the grade as stale until the next refresh. Re-scan locally to verify.
Trust Card · Static snapshot
exa-labs__exa-mcp-server U
Ungraded — insufficient static coverage · 0 findings (0 critical) · scope broad · Not ranked: insufficient static coverage.
Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream exa-labs/exa-mcp-server @ e9c3b01 (2026-10-07)
Score breakdown
No numeric score or breakdown: insufficient static coverage. Findings remain actionable; absence of findings is not evidence of safety.
Insufficient static coverage: Unsupported source present. Findings remain actionable; absence of findings is not evidence of safety.
Coverage: limited
Static-heuristic scope: 65 analyzed / 87 discovered files; 3 unsupported source files; 23 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.
- Unsupported source present
- Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.
- Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.
- Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.
- Ignored directories, declarations, and non-implementation assets are outside rule scope.
File coverage, applied rules and scan limits
{
"mode": "static-heuristic",
"status": "limited",
"reasons": [
"Unsupported source present"
],
"limitations": [
"Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
"Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
"Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
"Ignored directories, declarations, and non-implementation assets are outside rule scope."
],
"discoveredFiles": 87,
"analyzedFiles": [
{
"path": ".claude-plugin/marketplace.json",
"scope": "data",
"bytes": 1075,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".claude-plugin/plugin.json",
"scope": "data",
"bytes": 475,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".github/workflows/ci.yml",
"scope": "data",
"bytes": 465,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".github/workflows/publish-agentcore.yml",
"scope": "data",
"bytes": 4478,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".github/workflows/publish-mcp-registry.yml",
"scope": "data",
"bytes": 2770,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".github/workflows/publish.yml",
"scope": "data",
"bytes": 1726,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".prettierrc.json",
"scope": "data",
"bytes": 116,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "api/mcp-oauth.ts",
"scope": "code",
"bytes": 347,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "api/mcp.ts",
"scope": "code",
"bytes": 29237,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "api/well-known-mcp-config.ts",
"scope": "code",
"bytes": 1877,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "api/well-known-oauth-protected-resource.ts",
"scope": "code",
"bytes": 1689,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "api/well-known-openai-apps-challenge.ts",
"scope": "code",
"bytes": 1975,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "gemini-extension.json",
"scope": "data",
"bytes": 233,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "mcp.json",
"scope": "data",
"bytes": 275,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "package-lock.json",
"scope": "data",
"bytes": 238479,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "package.json",
"scope": "data",
"bytes": 2388,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "plugin.json",
"scope": "data",
"bytes": 725,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "server.json",
"scope": "data",
"bytes": 452,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "src/mcp-handler.ts",
"scope": "code",
"bytes": 9723,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/runtime-server.ts",
"scope": "code",
"bytes": 3346,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/stdio-cli.ts",
"scope": "code",
"bytes": 201,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/stdio.ts",
"scope": "code",
"bytes": 2382,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/toolRegistry.ts",
"scope": "code",
"bytes": 5146,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/agentProgress.ts",
"scope": "code",
"bytes": 10533,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/agentRun.ts",
"scope": "code",
"bytes": 21629,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/agentSchemaTemplates.ts",
"scope": "code",
"bytes": 862,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/companyResearch.ts",
"scope": "code",
"bytes": 4133,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/config.ts",
"scope": "code",
"bytes": 2675,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/deepResearchCheck.ts",
"scope": "code",
"bytes": 6611,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/deepResearchStart.ts",
"scope": "code",
"bytes": 4592,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/deepSearch.ts",
"scope": "code",
"bytes": 8677,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/exaCode.ts",
"scope": "code",
"bytes": 4592,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/linkedInSearch.ts",
"scope": "code",
"bytes": 4468,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/peopleSearch.ts",
"scope": "code",
"bytes": 4107,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/validation.ts",
"scope": "code",
"bytes": 1374,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/webFetch.ts",
"scope": "code",
"bytes": 5300,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/webSearch.ts",
"scope": "code",
"bytes": 5697,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/webSearchAdvanced.ts",
"scope": "code",
"bytes": 10442,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/types.ts",
"scope": "code",
"bytes": 6579,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/utils/agentErrorHandler.ts",
"scope": "code",
"bytes": 1748,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/utils/agentSkill.ts",
"scope": "code",
"bytes": 1161,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/utils/auth.ts",
"scope": "code",
"bytes": 1942,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/utils/errorHandler.ts",
"scope": "code",
"bytes": 3747,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/utils/exaResponseSanitizer.ts",
"scope": "code",
"bytes": 8610,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/utils/logger.ts",
"scope": "code",
"bytes": 822,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/utils/mcpClientMetadata.ts",
"scope": "code",
"bytes": 4885,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/utils/response.ts",
"scope": "code",
"bytes": 480,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/fixtures/exaResponses.ts",
"scope": "code",
"bytes": 1707,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/helpers/fakeMcpServer.ts",
"scope": "code",
"bytes": 2204,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/unit/api/mcp.test.ts",
"scope": "code",
"bytes": 30494,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/unit/mcp-handler.test.ts",
"scope": "code",
"bytes": 5801,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/unit/stdio.test.ts",
"scope": "code",
"bytes": 4275,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/unit/toolRegistry.test.ts",
"scope": "code",
"bytes": 824,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/unit/tools/agentProgress.test.ts",
"scope": "code",
"bytes": 1524,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/unit/tools/agentRun.test.ts",
"scope": "code",
"bytes": 19996,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/unit/tools/config.test.ts",
"scope": "code",
"bytes": 4214,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/unit/tools/validation.test.ts",
"scope": "code",
"bytes": 7676,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/unit/tools/webFetch.test.ts",
"scope": "code",
"bytes": 2844,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/unit/tools/webSearch.test.ts",
"scope": "code",
"bytes": 3391,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/unit/utils/errorHandler.test.ts",
"scope": "code",
"bytes": 2944,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/unit/utils/exaResponseSanitizer.test.ts",
"scope": "code",
"bytes": 3517,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tsconfig.json",
"scope": "data",
"bytes": 470,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tsconfig.test.json",
"scope": "data",
"bytes": 168,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "vercel.json",
"scope": "data",
"bytes": 1076,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "vitest.config.ts",
"scope": "code",
"bytes": 349,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
}
],
"unsupportedSourceFiles": [
".vercelignore",
"Dockerfile",
"env.example"
],
"excludedFiles": [
{
"path": ".git",
"reason": "ignored-directory"
},
{
"path": ".gitignore",
"reason": "outside-rule-scope"
},
{
"path": ".npmignore",
"reason": "outside-rule-scope"
},
{
"path": ".prettierignore",
"reason": "outside-rule-scope"
},
{
"path": ".vercelignore",
"reason": "unsupported-implementation"
},
{
"path": "Dockerfile",
"reason": "unsupported-implementation"
},
{
"path": "LICENSE",
"reason": "outside-rule-scope"
},
{
"path": "README.md",
"reason": "outside-rule-scope"
},
{
"path": "assets/Exa.svg",
"reason": "outside-rule-scope"
},
{
"path": "env.example",
"reason": "unsupported-implementation"
},
{
"path": "skills/exa-agent/SKILL.md",
"reason": "skill-instructions-not-code-analyzed"
},
{
"path": "skills/search/SKILL.md",
"reason": "skill-instructions-not-code-analyzed"
},
{
"path": "skills/search/references/extraction.md",
"reason": "outside-rule-scope"
},
{
"path": "skills/search/references/filtering.md",
"reason": "outside-rule-scope"
},
{
"path": "skills/search/references/patterns-code.md",
"reason": "outside-rule-scope"
},
{
"path": "skills/search/references/patterns-companies.md",
"reason": "outside-rule-scope"
},
{
"path": "skills/search/references/patterns-news.md",
"reason": "outside-rule-scope"
},
{
"path": "skills/search/references/patterns-papers.md",
"reason": "outside-rule-scope"
},
{
"path": "skills/search/references/patterns-people.md",
"reason": "outside-rule-scope"
},
{
"path": "skills/search/references/patterns-relationships.md",
"reason": "outside-rule-scope"
},
{
"path": "skills/search/references/searching.md",
"reason": "outside-rule-scope"
},
{
"path": "skills/search/references/source-quality.md",
"reason": "outside-rule-scope"
},
{
"path": "skills/search/references/synthesis.md",
"reason": "outside-rule-scope"
}
],
"readErrors": [],
"truncation": [],
"limits": {
"maxFiles": 4000,
"maxDepth": 12,
"maxFileBytes": 1048576
}
}Fix first (0 critical/high)
No findings in scope of the 8-rule static suite.
Permissions
Scope: broad · Shell: disabled · Network egress: no · File deletion: none · Human approval: none
Provenance
License: MIT · Lockfile: yes · Security policy: no · Signals: unverified origin
Independently scanned by the OpenTrustBench registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/exa-labs/exa-mcp-server. Scores move with every upstream commit; pages refresh weekly. How scoring works.