Trust Card · Static snapshot

examples/vulnerable-mcp-server F

33/100 · 5 findings (3 critical) · scope excessive · Self-scan / fixture: excluded from external rankings.

Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream eulogik/OpenTrustBench @ 00d5021 (2026-10-19)

Score breakdown

security 2

permissions 20

provenance 50

reliability 85

stability 75

Score constrained by 3 critical and 1 high-severity findings. Limited to the supported static rule scope; not proof of safety.

Coverage: sufficient

Static-heuristic scope: 2 analyzed / 2 discovered files; 0 unsupported source files; 0 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.

Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.
Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.
Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.
Ignored directories, declarations, and non-implementation assets are outside rule scope.

File coverage, applied rules and scan limits

{
  "mode": "static-heuristic",
  "status": "sufficient",
  "reasons": [],
  "limitations": [
    "Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
    "Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
    "Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
    "Ignored directories, declarations, and non-implementation assets are outside rule scope."
  ],
  "discoveredFiles": 2,
  "analyzedFiles": [
    {
      "path": "package.json",
      "scope": "data",
      "bytes": 239,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "server.ts",
      "scope": "code",
      "bytes": 1338,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    }
  ],
  "unsupportedSourceFiles": [],
  "excludedFiles": [],
  "readErrors": [],
  "truncation": [],
  "limits": {
    "maxFiles": 4000,
    "maxDepth": 12,
    "maxFileBytes": 1048576
  }
}

Fix first (4 critical/high)

Severity	Rule	Finding	Remediation
CRITICAL	`AT-SEC-001` (LLM01)	Direct Prompt Concatenation (Injection Vulnerability) `server.ts:24` Evidence: `const systemPrompt = "You are an assistant. " + args.userInput;`	Use parameterized messages, structured schema validation (Zod), and clear boundary delimiters.
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `server.ts:11` Evidence: `const API_SECRET_TOKEN = "sk-proj-abc123456789012345678901234567890";`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `server.ts:16` Evidence: `exec(args.cmd, (err, stdout) => {`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
HIGH	`AT-SEC-005` (ASI02)	Unrestricted Recursive File Deletion / Modification `server.ts:31` Evidence: `fs.unlinkSync("/data/users/" + args.userId);`	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
MEDIUM	`AT-SEC-007` (LLM02)	Raw Secret Leakage in Debug Logging `server.ts:25` Evidence: `console.log("Debug logging token: " + API_SECRET_TOKEN); // VULNERABILITY 4: Secret leakage (AT-SEC-007)`	Implement PII/secret redaction masks before writing to log streams.

Permissions

Scope: excessive · Shell: enabled · Network egress: no · File deletion: enabled · Human approval: none

Provenance

License: none detected · Lockfile: no · Security policy: no · Signals: unverified origin

OpenTrustBench self-scan / local fixture Excluded from external target rankings and statistics. Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/eulogik/OpenTrustBench. Scores move with every upstream commit; pages refresh weekly. How scoring works.