← All scanned servers

Trust Card · Static snapshot

wong2__mcp-cli A

96/100 · 0 findings (0 critical) · scope minimal · Ranked #1 of 1 graded external targets.

Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream wong2/mcp-cli @ 7d12b46 (2026-06-08)

Score breakdown

security 100
permissions 100
provenance 90
reliability 85
stability 100

No critical or high-severity findings; grade reflects permissions and provenance signals. Limited to the supported static rule scope; not proof of safety.

Coverage: sufficient

Static-heuristic scope: 9 analyzed / 14 discovered files; 0 unsupported source files; 6 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.

File coverage, applied rules and scan limits
{
  "mode": "static-heuristic",
  "status": "sufficient",
  "reasons": [],
  "limitations": [
    "Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
    "Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
    "Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
    "Ignored directories, declarations, and non-implementation assets are outside rule scope."
  ],
  "discoveredFiles": 14,
  "analyzedFiles": [
    {
      "path": "package.json",
      "scope": "data",
      "bytes": 1167,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "pnpm-lock.yaml",
      "scope": "data",
      "bytes": 34638,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "src/cli.js",
      "scope": "code",
      "bytes": 2433,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/config.js",
      "scope": "code",
      "bytes": 130,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/eventsource-polyfill.js",
      "scope": "code",
      "bytes": 82,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/mcp.js",
      "scope": "code",
      "bytes": 9539,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/oauth/callback.js",
      "scope": "code",
      "bytes": 626,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/oauth/provider.js",
      "scope": "code",
      "bytes": 1473,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/utils.js",
      "scope": "code",
      "bytes": 3613,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    }
  ],
  "unsupportedSourceFiles": [],
  "excludedFiles": [
    {
      "path": ".git",
      "reason": "ignored-directory"
    },
    {
      "path": ".gitignore",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".prettierrc",
      "reason": "outside-rule-scope"
    },
    {
      "path": "CHANGELOG.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "LICENSE",
      "reason": "outside-rule-scope"
    },
    {
      "path": "README.md",
      "reason": "outside-rule-scope"
    }
  ],
  "readErrors": [],
  "truncation": [],
  "limits": {
    "maxFiles": 4000,
    "maxDepth": 12,
    "maxFileBytes": 1048576
  }
}

Fix first (0 critical/high)

No findings in scope of the 8-rule static suite.

Permissions

Scope: minimal · Shell: disabled · Network egress: no · File deletion: none · Human approval: none

Provenance

License: none detected · Lockfile: yes · Security policy: no · Signals: present (documentary, not a safety verdict)

Independently scanned by the OpenTrustBench registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/wong2/mcp-cli. Scores move with every upstream commit; pages refresh weekly. How scoring works.