⚠️ This snapshot is over 30 days old — treat the grade as stale until the next refresh. Re-scan locally to verify.
Trust Card · Static snapshot
mendableai__firecrawl-mcp-server U
Ungraded — insufficient static coverage · 7 findings (3 critical) · scope excessive · Not ranked: insufficient static coverage.
Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream mendableai/firecrawl-mcp-server @ 0b93f4e (2026-10-19)
Score breakdown
No numeric score or breakdown: insufficient static coverage. Findings remain actionable; absence of findings is not evidence of safety.
Insufficient static coverage: Unsupported source present. Findings remain actionable; absence of findings is not evidence of safety.
Coverage: limited
Static-heuristic scope: 84 analyzed / 99 discovered files; 2 unsupported source files; 16 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.
- Unsupported source present
- Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.
- Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.
- Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.
- Ignored directories, declarations, and non-implementation assets are outside rule scope.
File coverage, applied rules and scan limits
{
"mode": "static-heuristic",
"status": "limited",
"reasons": [
"Unsupported source present"
],
"limitations": [
"Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
"Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
"Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
"Ignored directories, declarations, and non-implementation assets are outside rule scope."
],
"discoveredFiles": 99,
"analyzedFiles": [
{
"path": ".eslintrc.json",
"scope": "data",
"bytes": 778,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".github/workflows/ci.yml",
"scope": "data",
"bytes": 530,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".github/workflows/image.yml",
"scope": "data",
"bytes": 1284,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".github/workflows/publish.yml",
"scope": "data",
"bytes": 6833,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "gemini-extension.json",
"scope": "data",
"bytes": 694,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "glama.json",
"scope": "data",
"bytes": 101,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "package.json",
"scope": "data",
"bytes": 2442,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "pnpm-lock.yaml",
"scope": "data",
"bytes": 105687,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "pnpm-workspace.yaml",
"scope": "data",
"bytes": 110,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "scripts/agent-metadata-policy.mjs",
"scope": "code",
"bytes": 12626,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "server.json",
"scope": "data",
"bytes": 1211,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "smithery.yaml",
"scope": "data",
"bytes": 812,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "src/alexandria-feedback.ts",
"scope": "code",
"bytes": 3240,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/alexandria-output.ts",
"scope": "code",
"bytes": 3483,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/alexandria.ts",
"scope": "code",
"bytes": 10139,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/core-http-error.ts",
"scope": "code",
"bytes": 446,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/developer.ts",
"scope": "code",
"bytes": 4898,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/gov.ts",
"scope": "code",
"bytes": 3635,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/headers.ts",
"scope": "code",
"bytes": 379,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/index.ts",
"scope": "code",
"bytes": 4672,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/integration.ts",
"scope": "code",
"bytes": 1251,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/keyless-signup-link.ts",
"scope": "code",
"bytes": 1970,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/monitor.ts",
"scope": "code",
"bytes": 18061,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/origin.ts",
"scope": "code",
"bytes": 9345,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/recovery.ts",
"scope": "code",
"bytes": 9049,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/research.ts",
"scope": "code",
"bytes": 17440,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/server.ts",
"scope": "code",
"bytes": 120786,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/service/auth.ts",
"scope": "code",
"bytes": 23264,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/service/index.ts",
"scope": "code",
"bytes": 2699,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/service/introspection-cache.ts",
"scope": "code",
"bytes": 3109,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/service/profiles.ts",
"scope": "code",
"bytes": 9430,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/service/search-surface.ts",
"scope": "code",
"bytes": 9893,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/service/session-credential.ts",
"scope": "code",
"bytes": 5842,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/service/session.ts",
"scope": "code",
"bytes": 516,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/service/tool-guard.ts",
"scope": "code",
"bytes": 2222,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/service/www-authenticate.ts",
"scope": "code",
"bytes": 130,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tool-arguments.ts",
"scope": "code",
"bytes": 3708,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tool-helpers.ts",
"scope": "code",
"bytes": 14567,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tool-output.ts",
"scope": "code",
"bytes": 21771,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/usage.ts",
"scope": "code",
"bytes": 4904,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/agent-metadata-policy.test.mjs",
"scope": "code",
"bytes": 6412,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/build-bundle.test.mjs",
"scope": "code",
"bytes": 2240,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/contract-snapshot.test.mjs",
"scope": "code",
"bytes": 16128,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/contract-snapshots/hosted-account.json",
"scope": "data",
"bytes": 5924,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tests/contract-snapshots/hosted-full.json",
"scope": "data",
"bytes": 8089,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tests/contract-snapshots/hosted-search-companion.json",
"scope": "data",
"bytes": 4817,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tests/contract-snapshots/hosted-search-primary.json",
"scope": "data",
"bytes": 5047,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tests/contract-snapshots/http-self-hosted.json",
"scope": "data",
"bytes": 5206,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tests/contract-snapshots/stdio-api-key.json",
"scope": "data",
"bytes": 6358,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tests/contract-snapshots/stdio-keyless.json",
"scope": "data",
"bytes": 3099,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tests/contract-snapshots/stdio-self-hosted.json",
"scope": "data",
"bytes": 2925,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tests/contract-snapshots/tool-definitions.json",
"scope": "data",
"bytes": 252774,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tests/embed-package.test.mjs",
"scope": "code",
"bytes": 4756,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/fixtures/embed/embed-types.ts",
"scope": "code",
"bytes": 3222,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/fixtures/embed/embed.mjs",
"scope": "code",
"bytes": 1700,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/fixtures/embed/package.json",
"scope": "data",
"bytes": 83,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tests/fixtures/embed/tsconfig.json",
"scope": "data",
"bytes": 237,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tests/helpers/alexandria-metadata.mjs",
"scope": "code",
"bytes": 2004,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/helpers/description-budget.mjs",
"scope": "code",
"bytes": 207,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/helpers/exchange-api.mjs",
"scope": "code",
"bytes": 8738,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/helpers/exchange-mcp.mjs",
"scope": "code",
"bytes": 6922,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/integration-tag.test.mjs",
"scope": "code",
"bytes": 4029,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/introspection-cache.test.mjs",
"scope": "code",
"bytes": 7156,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/keyless-signup-link.test.mjs",
"scope": "code",
"bytes": 2540,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/mcp-alexandria-auth.test.mjs",
"scope": "code",
"bytes": 4279,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/mcp-alexandria-discovery.test.mjs",
"scope": "code",
"bytes": 3534,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/mcp-alexandria-feedback-hints.test.mjs",
"scope": "code",
"bytes": 4175,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/mcp-alexandria-scrape.test.mjs",
"scope": "code",
"bytes": 6836,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/mcp-alexandria-search.test.mjs",
"scope": "code",
"bytes": 7195,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/mcp-alexandria-terms.test.mjs",
"scope": "code",
"bytes": 5295,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/mcp-argument-shapes.test.mjs",
"scope": "code",
"bytes": 9521,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/mcp-crawl-polling.test.mjs",
"scope": "code",
"bytes": 3567,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/mcp-description-budget.test.mjs",
"scope": "code",
"bytes": 1812,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/mcp-read-only-scrape.test.mjs",
"scope": "code",
"bytes": 7672,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/mcp-scrape-images.test.mjs",
"scope": "code",
"bytes": 1536,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/mcp-search-profile.test.mjs",
"scope": "code",
"bytes": 54677,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/mcp-smoke.test.mjs",
"scope": "code",
"bytes": 145339,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/origin.test.mjs",
"scope": "code",
"bytes": 12017,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/readme-security.test.mjs",
"scope": "code",
"bytes": 535,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/server-hooks.test.mjs",
"scope": "code",
"bytes": 20660,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/service-boundary.test.mjs",
"scope": "code",
"bytes": 2844,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/www-authenticate.test.mjs",
"scope": "code",
"bytes": 599,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tsconfig.json",
"scope": "data",
"bytes": 329,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tsup.config.ts",
"scope": "code",
"bytes": 1240,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
}
],
"unsupportedSourceFiles": [
"Dockerfile",
"patches/fastmcp@4.3.2.patch"
],
"excludedFiles": [
{
"path": ".git",
"reason": "ignored-directory"
},
{
"path": ".dockerignore",
"reason": "outside-rule-scope"
},
{
"path": ".gitignore",
"reason": "outside-rule-scope"
},
{
"path": ".prettierrc",
"reason": "outside-rule-scope"
},
{
"path": "CHANGELOG.md",
"reason": "outside-rule-scope"
},
{
"path": "Dockerfile",
"reason": "unsupported-implementation"
},
{
"path": "LICENSE",
"reason": "outside-rule-scope"
},
{
"path": "README.md",
"reason": "outside-rule-scope"
},
{
"path": "VERSIONING.md",
"reason": "outside-rule-scope"
},
{
"path": "docs/search-profile.md",
"reason": "outside-rule-scope"
},
{
"path": "img/fire.png",
"reason": "outside-rule-scope"
},
{
"path": "img/firecrawl-logo.png",
"reason": "outside-rule-scope"
},
{
"path": "img/firecrawl-wordmark.png",
"reason": "outside-rule-scope"
},
{
"path": "patches/fastmcp@4.3.2.patch",
"reason": "unsupported-implementation"
},
{
"path": "reports/alexandria-mcp-validation.md",
"reason": "outside-rule-scope"
},
{
"path": "src/legacy/index.md",
"reason": "outside-rule-scope"
}
],
"readErrors": [],
"truncation": [],
"limits": {
"maxFiles": 4000,
"maxDepth": 12,
"maxFileBytes": 1048576
}
}Fix first (7 critical/high)
| Severity | Rule | Finding | Remediation |
|---|---|---|---|
| CRITICAL | AT-SEC-002 (LLM02) | Hardcoded Credential or API Secrettests/mcp-search-profile.test.mjs:128Evidence: apiKeyFromIntrospection = 'fc-from-introspection', | Move credentials to secure environment variables or a key vault. Never commit API keys. |
| CRITICAL | AT-SEC-002 (LLM02) | Hardcoded Credential or API Secrettests/mcp-smoke.test.mjs:605Evidence: apiKeyFromIntrospection = 'fc-from-introspection', | Move credentials to secure environment variables or a key vault. Never commit API keys. |
| CRITICAL | AT-SEC-002 (LLM02) | Hardcoded Credential or API Secrettests/mcp-smoke.test.mjs:2932Evidence: const resolvedApiKey = 'fc-resolved-api-key-value'; | Move credentials to secure environment variables or a key vault. Never commit API keys. |
| HIGH | AT-SEC-006 (LLM06) | Unfiltered SSRF / Arbitrary Network Egresssrc/monitor.ts:85Evidence: const response = await fetch(url, { | Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254). |
| HIGH | AT-SEC-006 (LLM06) | Unfiltered SSRF / Arbitrary Network Egresstests/mcp-search-profile.test.mjs:78Evidence: const response = await fetch(url); | Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254). |
| HIGH | AT-SEC-006 (LLM06) | Unfiltered SSRF / Arbitrary Network Egresstests/mcp-smoke.test.mjs:38Evidence: const response = await fetch(url); | Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254). |
| HIGH | AT-SEC-006 (LLM06) | Unfiltered SSRF / Arbitrary Network Egresstests/server-hooks.test.mjs:510Evidence: return realFetch(input, init); | Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254). |
Permissions
Scope: excessive · Shell: enabled · Network egress: yes · File deletion: enabled · Human approval: operator-confirmation-gate
Provenance
License: MIT · Lockfile: yes · Security policy: no · Signals: present (documentary, not a safety verdict)
Independently scanned by the OpenTrustBench registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/mendableai/firecrawl-mcp-server. Scores move with every upstream commit; pages refresh weekly. How scoring works.