Trust Card · Static snapshot

tavily-ai__tavily-mcp U

Ungraded — insufficient static coverage · 0 findings (0 critical) · scope minimal · Not ranked: insufficient static coverage.

Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream tavily-ai/tavily-mcp @ 688b0f7 (2026-10-15)

Score breakdown

No numeric score or breakdown: insufficient static coverage. Findings remain actionable; absence of findings is not evidence of safety.

Insufficient static coverage: Unsupported source present. Findings remain actionable; absence of findings is not evidence of safety.

Coverage: limited

Static-heuristic scope: 7 analyzed / 15 discovered files; 1 unsupported source files; 9 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.

Unsupported source present
Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.
Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.
Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.
Ignored directories, declarations, and non-implementation assets are outside rule scope.

File coverage, applied rules and scan limits

{
  "mode": "static-heuristic",
  "status": "limited",
  "reasons": [
    "Unsupported source present"
  ],
  "limitations": [
    "Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
    "Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
    "Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
    "Ignored directories, declarations, and non-implementation assets are outside rule scope."
  ],
  "discoveredFiles": 15,
  "analyzedFiles": [
    {
      "path": "package-lock.json",
      "scope": "data",
      "bytes": 58627,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "package.json",
      "scope": "data",
      "bytes": 1408,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "smithery.yaml",
      "scope": "data",
      "bytes": 563,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "src/format-results.ts",
      "scope": "code",
      "bytes": 2351,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/index.ts",
      "scope": "code",
      "bytes": 47840,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "tests/format-results.test.mjs",
      "scope": "code",
      "bytes": 3074,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "tsconfig.json",
      "scope": "data",
      "bytes": 340,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    }
  ],
  "unsupportedSourceFiles": [
    "Dockerfile"
  ],
  "excludedFiles": [
    {
      "path": ".git",
      "reason": "ignored-directory"
    },
    {
      "path": ".gitignore",
      "reason": "outside-rule-scope"
    },
    {
      "path": "Dockerfile",
      "reason": "unsupported-implementation"
    },
    {
      "path": "LICENCE",
      "reason": "outside-rule-scope"
    },
    {
      "path": "README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "assets/Banner_NEW.png",
      "reason": "outside-rule-scope"
    },
    {
      "path": "assets/claude-desktop-ref.png",
      "reason": "outside-rule-scope"
    },
    {
      "path": "assets/cursor-reference.png",
      "reason": "outside-rule-scope"
    },
    {
      "path": "assets/demo_new.gif",
      "reason": "outside-rule-scope"
    }
  ],
  "readErrors": [],
  "truncation": [],
  "limits": {
    "maxFiles": 4000,
    "maxDepth": 12,
    "maxFileBytes": 1048576
  }
}

Fix first (0 critical/high)

No findings in scope of the 8-rule static suite.

Permissions

Scope: minimal · Shell: disabled · Network egress: yes · File deletion: none · Human approval: none

Provenance

License: MIT · Lockfile: yes · Security policy: no · Signals: unverified origin

Independently scanned by the OpenTrustBench registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/tavily-ai/tavily-mcp. Scores move with every upstream commit; pages refresh weekly. How scoring works.