← All scanned servers

Trust Card · Static snapshot

modelcontextprotocol__go-sdk U

Ungraded — insufficient static coverage · 0 findings (0 critical) · scope minimal · Not ranked: insufficient static coverage.

Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream modelcontextprotocol/go-sdk @ 3e9d812 (2026-10-16)

Score breakdown

No numeric score or breakdown: insufficient static coverage. Findings remain actionable; absence of findings is not evidence of safety.

Insufficient static coverage: No non-empty supported source analyzed; documentation and data alone provide limited coverage; Unsupported source present. Findings remain actionable; absence of findings is not evidence of safety.

Coverage: limited

Static-heuristic scope: 13 analyzed / 227 discovered files; 168 unsupported source files; 215 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.

File coverage, applied rules and scan limits
{
  "mode": "static-heuristic",
  "status": "limited",
  "reasons": [
    "No non-empty supported source analyzed; documentation and data alone provide limited coverage",
    "Unsupported source present"
  ],
  "limitations": [
    "Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
    "Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
    "Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
    "Ignored directories, declarations, and non-implementation assets are outside rule scope."
  ],
  "discoveredFiles": 227,
  "analyzedFiles": [
    {
      "path": ".devcontainer/devcontainer.json",
      "scope": "data",
      "bytes": 764,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/dependabot.yml",
      "scope": "data",
      "bytes": 508,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/codeql.yml",
      "scope": "data",
      "bytes": 1269,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/conformance.yml",
      "scope": "data",
      "bytes": 2799,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/docs-check.yml",
      "scope": "data",
      "bytes": 1198,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/nightly.yml",
      "scope": "data",
      "bytes": 1182,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/publish-docs.yml",
      "scope": "data",
      "bytes": 965,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/scorecard.yml",
      "scope": "data",
      "bytes": 3476,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/test.yml",
      "scope": "data",
      "bytes": 1790,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "conformance/baseline.yml",
      "scope": "data",
      "bytes": 459,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "mkdocs.yaml",
      "scope": "data",
      "bytes": 2478,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "oauthex/testdata/client-auth-meta.json",
      "scope": "data",
      "bytes": 188,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "oauthex/testdata/google-auth-meta.json",
      "scope": "data",
      "bytes": 1268,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    }
  ],
  "unsupportedSourceFiles": [
    "auth/auth.go",
    "auth/auth_example_test.go",
    "auth/auth_test.go",
    "auth/authorization_code.go",
    "auth/authorization_code_test.go",
    "auth/client.go",
    "auth/extauth/client_credentials.go",
    "auth/extauth/client_credentials_test.go",
    "auth/extauth/enterprise_handler.go",
    "auth/extauth/enterprise_handler_test.go",
    "auth/extauth/oidc_login.go",
    "auth/extauth/oidc_login_test.go",
    "auth/shared.go",
    "auth/shared_test.go",
    "conformance/everything-client/main.go",
    "conformance/everything-server/main.go",
    "copyright_test.go",
    "docs/CNAME",
    "examples/auth/client/main.go",
    "examples/auth/enterprise/main.go",
    "examples/auth/server/main.go",
    "examples/client/listfeatures/main.go",
    "examples/client/loadtest/main.go",
    "examples/client/middleware/main.go",
    "examples/http/logging_middleware.go",
    "examples/http/main.go",
    "examples/server/auth-middleware/go.mod",
    "examples/server/auth-middleware/go.sum",
    "examples/server/auth-middleware/main.go",
    "examples/server/basic/main.go",
    "examples/server/completion/main.go",
    "examples/server/custom-method/main.go",
    "examples/server/custom-transport/main.go",
    "examples/server/distributed/main.go",
    "examples/server/elicitation/main.go",
    "examples/server/everything/main.go",
    "examples/server/hello/main.go",
    "examples/server/memory/kb.go",
    "examples/server/memory/kb_test.go",
    "examples/server/memory/main.go",
    "examples/server/middleware/main.go",
    "examples/server/proxy/main.go",
    "examples/server/rate-limiting/go.mod",
    "examples/server/rate-limiting/go.sum",
    "examples/server/rate-limiting/main.go",
    "examples/server/sequentialthinking/main.go",
    "examples/server/sequentialthinking/main_test.go",
    "examples/server/sse/main.go",
    "examples/server/toolschemas/main.go",
    "examples/server/toolschemas/main_test.go",
    "go.mod",
    "go.sum",
    "internal/authutil/scopes.go",
    "internal/authutil/scopes_test.go",
    "internal/authutil/util.go",
    "internal/authutil/util_test.go",
    "internal/docs/doc.go",
    "internal/docs/toc_test.go",
    "internal/json/json.go",
    "internal/json/json_test.go",
    "internal/jsonrpc2/conn.go",
    "internal/jsonrpc2/conn_test.go",
    "internal/jsonrpc2/jsonrpc2.go",
    "internal/jsonrpc2/messages.go",
    "internal/jsonrpc2/wire.go",
    "internal/jsonrpc2/wire_test.go",
    "internal/mcpgodebug/mcpgodebug.go",
    "internal/mcpgodebug/mcpgodebug_test.go",
    "internal/oauthtest/fake_authorization_server.go",
    "internal/oauthtest/fake_idp_server.go",
    "internal/readme/client/client.go",
    "internal/readme/doc.go",
    "internal/readme/server/server.go",
    "internal/util/errors.go",
    "internal/util/net.go",
    "internal/util/net_test.go",
    "internal/xcontext/xcontext.go",
    "jsonrpc/jsonrpc.go",
    "mcp/cache.go",
    "mcp/capabilities_test.go",
    "mcp/client.go",
    "mcp/client_example_test.go",
    "mcp/client_list_test.go",
    "mcp/client_test.go",
    "mcp/cmd.go",
    "mcp/cmd_export_test.go",
    "mcp/cmd_test.go",
    "mcp/conformance_test.go",
    "mcp/content.go",
    "mcp/content_nil_test.go",
    "mcp/content_test.go",
    "mcp/elicitation_test.go",
    "mcp/error_test.go",
    "mcp/event.go",
    "mcp/event_test.go",
    "mcp/features.go",
    "mcp/features_test.go",
    "mcp/logging.go",
    "mcp/mcp.go",
    "mcp/mcp_example_test.go",
    "mcp/mcp_test.go",
    "mcp/mrtr.go",
    "mcp/mrtr_test.go",
    "mcp/prompt.go",
    "mcp/protocol.go",
    "mcp/protocol_test.go",
    "mcp/requests.go",
    "mcp/resource.go",
    "mcp/resource_test.go",
    "mcp/sampling_test.go",
    "mcp/schema_cache.go",
    "mcp/schema_cache_test.go",
    "mcp/server.go",
    "mcp/server_example_test.go",
    "mcp/server_test.go",
    "mcp/session.go",
    "mcp/shared.go",
    "mcp/shared_test.go",
    "mcp/sse.go",
    "mcp/sse_example_test.go",
    "mcp/sse_test.go",
    "mcp/streamable.go",
    "mcp/streamable_bench_test.go",
    "mcp/streamable_client.go",
    "mcp/streamable_client_test.go",
    "mcp/streamable_example_test.go",
    "mcp/streamable_headers.go",
    "mcp/streamable_headers_test.go",
    "mcp/streamable_keepalive_test.go",
    "mcp/streamable_server.go",
    "mcp/streamable_test.go",
    "mcp/structured_content_presence_test.go",
    "mcp/testdata/conformance/server/bad_requests.txtar",
    "mcp/testdata/conformance/server/discover.txtar",
    "mcp/testdata/conformance/server/lifecycle.txtar",
    "mcp/testdata/conformance/server/mrtr.txtar",
    "mcp/testdata/conformance/server/prompts.txtar",
    "mcp/testdata/conformance/server/resources.txtar",
    "mcp/testdata/conformance/server/spec-sep-973-additional-metadata.txtar",
    "mcp/testdata/conformance/server/tools.txtar",
    "mcp/testdata/conformance/server/version-latest.txtar",
    "mcp/testdata/conformance/server/version-older.txtar",
    "mcp/tool.go",
    "mcp/tool_example_test.go",
    "mcp/tool_test.go",
    "mcp/transport.go",
    "mcp/transport_example_test.go",
    "mcp/transport_test.go",
    "mcp/util.go",
    "oauthex/audience.go",
    "oauthex/audience_test.go",
    "oauthex/auth_meta.go",
    "oauthex/auth_meta_test.go",
    "oauthex/client.go",
    "oauthex/client_test.go",
    "oauthex/dcr.go",
    "oauthex/dcr_test.go",
    "oauthex/discovery_test.go",
    "oauthex/oauth2.go",
    "oauthex/oauthex.go",
    "oauthex/oauthex_test.go",
    "oauthex/resource_meta.go",
    "oauthex/resource_meta_test.go",
    "oauthex/token_exchange.go",
    "oauthex/token_exchange_test.go",
    "oauthex/url_scheme_test.go",
    "scripts/client-conformance.sh",
    "scripts/server-conformance.sh"
  ],
  "excludedFiles": [
    {
      "path": ".git",
      "reason": "ignored-directory"
    },
    {
      "path": ".agents/skills/fix-bug/SKILLS.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".gitattributes",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".github/ISSUE_TEMPLATE/bug_report.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".github/ISSUE_TEMPLATE/enhancement.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".github/pull_request_template.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".gitignore",
      "reason": "outside-rule-scope"
    },
    {
      "path": "AGENTS.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "CONTRIBUTING.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "LICENSE",
      "reason": "outside-rule-scope"
    },
    {
      "path": "README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "ROADMAP.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "SECURITY.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "auth/auth.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "auth/auth_example_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "auth/auth_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "auth/authorization_code.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "auth/authorization_code_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "auth/client.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "auth/extauth/client_credentials.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "auth/extauth/client_credentials_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "auth/extauth/enterprise_handler.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "auth/extauth/enterprise_handler_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "auth/extauth/oidc_login.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "auth/extauth/oidc_login_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "auth/shared.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "auth/shared_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "conformance/everything-client/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "conformance/everything-server/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "copyright_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "design/design.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "design/mrtr.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/CNAME",
      "reason": "unsupported-implementation"
    },
    {
      "path": "docs/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/client.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/contributing.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/images/logo-dark.svg",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/images/logo-light.svg",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/mcpgodebug.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/protocol.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/quick_start.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/rough_edges.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/server.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/troubleshooting.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "examples/auth/client/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/auth/enterprise/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/auth/server/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/client/listfeatures/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/client/loadtest/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/client/middleware/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/http/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "examples/http/logging_middleware.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/http/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/auth-middleware/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "examples/server/auth-middleware/go.mod",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/auth-middleware/go.sum",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/auth-middleware/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/basic/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/completion/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/custom-method/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/custom-transport/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/distributed/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/elicitation/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/everything/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/everything/mcp.png",
      "reason": "outside-rule-scope"
    },
    {
      "path": "examples/server/hello/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/memory/kb.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/memory/kb_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/memory/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/middleware/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/proxy/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "examples/server/proxy/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/rate-limiting/go.mod",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/rate-limiting/go.sum",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/rate-limiting/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/sequentialthinking/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "examples/server/sequentialthinking/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/sequentialthinking/main_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/sse/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/toolschemas/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "examples/server/toolschemas/main_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "go.mod",
      "reason": "unsupported-implementation"
    },
    {
      "path": "go.sum",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/authutil/scopes.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/authutil/scopes_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/authutil/util.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/authutil/util_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/docs/README.src.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "internal/docs/client.src.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "internal/docs/doc.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/docs/mcpgodebug.src.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "internal/docs/protocol.src.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "internal/docs/quick_start.src.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "internal/docs/rough_edges.src.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "internal/docs/server.src.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "internal/docs/toc_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/docs/troubleshooting.src.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "internal/json/json.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/json/json_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/jsonrpc2/conn.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/jsonrpc2/conn_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/jsonrpc2/jsonrpc2.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/jsonrpc2/messages.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/jsonrpc2/wire.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/jsonrpc2/wire_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/mcpgodebug/mcpgodebug.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/mcpgodebug/mcpgodebug_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/oauthtest/fake_authorization_server.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/oauthtest/fake_idp_server.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/readme/README.src.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "internal/readme/client/client.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/readme/contributing.src.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "internal/readme/doc.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/readme/server/server.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/util/errors.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/util/net.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/util/net_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/xcontext/xcontext.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "jsonrpc/jsonrpc.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/cache.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/capabilities_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/client.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/client_example_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/client_list_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/client_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/cmd.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/cmd_export_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/cmd_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/conformance_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/content.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/content_nil_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/content_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/elicitation_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/error_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/event.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/event_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/features.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/features_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/logging.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/mcp.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/mcp_example_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/mcp_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/mrtr.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/mrtr_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/prompt.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/protocol.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/protocol_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/requests.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/resource.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/resource_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/sampling_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/schema_cache.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/schema_cache_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/server.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/server_example_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/server_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/session.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/shared.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/shared_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/sse.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/sse_example_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/sse_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/streamable.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/streamable_bench_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/streamable_client.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/streamable_client_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/streamable_example_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/streamable_headers.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/streamable_headers_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/streamable_keepalive_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/streamable_server.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/streamable_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/structured_content_presence_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/testdata/conformance/server/bad_requests.txtar",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/testdata/conformance/server/discover.txtar",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/testdata/conformance/server/lifecycle.txtar",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/testdata/conformance/server/mrtr.txtar",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/testdata/conformance/server/prompts.txtar",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/testdata/conformance/server/resources.txtar",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/testdata/conformance/server/spec-sep-973-additional-metadata.txtar",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/testdata/conformance/server/tools.txtar",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/testdata/conformance/server/version-latest.txtar",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/testdata/conformance/server/version-older.txtar",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/testdata/files/info.txt",
      "reason": "outside-rule-scope"
    },
    {
      "path": "mcp/testdata/files/template.txt",
      "reason": "outside-rule-scope"
    },
    {
      "path": "mcp/testdata/private.txt",
      "reason": "outside-rule-scope"
    },
    {
      "path": "mcp/testdata/public/dir/file3.txt",
      "reason": "outside-rule-scope"
    },
    {
      "path": "mcp/testdata/public/file1.txt",
      "reason": "outside-rule-scope"
    },
    {
      "path": "mcp/testdata/public/file2.txt",
      "reason": "outside-rule-scope"
    },
    {
      "path": "mcp/tool.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/tool_example_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/tool_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/transport.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/transport_example_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/transport_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "mcp/util.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/audience.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/audience_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/auth_meta.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/auth_meta_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/client.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/client_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/dcr.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/dcr_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/discovery_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/oauth2.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/oauthex.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/oauthex_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/resource_meta.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/resource_meta_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/token_exchange.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/token_exchange_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "oauthex/url_scheme_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "scripts/client-conformance.sh",
      "reason": "unsupported-implementation"
    },
    {
      "path": "scripts/server-conformance.sh",
      "reason": "unsupported-implementation"
    }
  ],
  "readErrors": [],
  "truncation": [],
  "limits": {
    "maxFiles": 4000,
    "maxDepth": 12,
    "maxFileBytes": 1048576
  }
}

Fix first (0 critical/high)

No findings in scope of the 8-rule static suite.

Permissions

Scope: minimal · Shell: disabled · Network egress: no · File deletion: none · Human approval: none

Provenance

License: none detected · Lockfile: no · Security policy: yes · Signals: unverified origin

Independently scanned by the OpenTrustBench registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/modelcontextprotocol/go-sdk. Scores move with every upstream commit; pages refresh weekly. How scoring works.