npm - @agentsid/scanner - Versions diffs - 0.1.0 - Mend

@agentsid/scanner 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (116) hide show

package/README.md +205 -0
package/action/action.yml +42 -0
package/action/index.mjs +179 -0
package/docs/state-of-agent-security-2026.md +377 -0
package/examples/security-scan.yml +57 -0
package/package.json +37 -0
package/reports/aashari-mcp-server-atlassian-confluence.json +110 -0
package/reports/aashari-mcp-server-atlassian-jira.json +138 -0
package/reports/aashari-mcp-server-aws-sso.json +122 -0
package/reports/agentdeskai-browser-tools-mcp.json +361 -0
package/reports/ahmetkca-mcp-server-postgres.json +43 -0
package/reports/aiondadotcom-mcp-ssh.json +166 -0
package/reports/apify-actors-mcp-server.json +43 -0
package/reports/azure-mcp.json +43 -0
package/reports/boilerplate-mcp-tool.json +43 -0
package/reports/browserstack-mcp-server.json +43 -0
package/reports/canvas-mcp-server.json +43 -0
package/reports/canvas-mcp-tool.json +43 -0
package/reports/chrome-devtools-mcp.json +300 -0
package/reports/chrome-local-mcp.json +222 -0
package/reports/claude-flow-mcp.json +43 -0
package/reports/cloudflare-mcp-server.json +43 -0
package/reports/code-canvas-server.json +43 -0
package/reports/cognitionai-metabase-mcp-server.json +43 -0
package/reports/composio-mcp.json +43 -0
package/reports/contentful-mcp-server.json +43 -0
package/reports/dbhub.json +43 -0
package/reports/desktop-commander.json +43 -0
package/reports/dynatrace-oss-dynatrace-mcp-server.json +43 -0
package/reports/e2b-mcp-server.json +67 -0
package/reports/eslint-mcp.json +51 -0
package/reports/european-parliament-mcp-server.json +1467 -0
package/reports/exa-mcp-server.json +74 -0
package/reports/executeautomation-playwright-mcp-server.json +418 -0
package/reports/fast-kit-spec-kit.json +43 -0
package/reports/felores-airtable-mcp-server.json +43 -0
package/reports/figma-mcp.json +103 -0
package/reports/forestadmin-mcp-server.json +43 -0
package/reports/fullrun-mcp.json +43 -0
package/reports/gemini-mcp-tool.json +43 -0
package/reports/gitlab-mcp-agent-server.json +186 -0
package/reports/grackle-ai-mcp.json +43 -0
package/reports/heroku-mcp-server.json +333 -0
package/reports/hisma-server-puppeteer.json +93 -0
package/reports/hubspot-mcp-server.json +43 -0
package/reports/hyper-mcp-shell.json +59 -0
package/reports/iflow-mcp-server-github.json +327 -0
package/reports/jpisnice-shadcn-ui-mcp-server.json +149 -0
package/reports/jsonresume-mcp.json +43 -0
package/reports/mapbox-mcp-server.json +43 -0
package/reports/mcp-framework.json +43 -0
package/reports/mcp-from-openapi.json +43 -0
package/reports/mcp-handler.json +43 -0
package/reports/mcp-proxy.json +43 -0
package/reports/mcp-server-docker.json +59 -0
package/reports/mcp-server-github-gist.json +108 -0
package/reports/mcp-server-google-calendar.json +43 -0
package/reports/mcp-server-jira-cloud.json +43 -0
package/reports/mcp-server-kubernetes.json +43 -0
package/reports/mcp-server-slack.json +411 -0
package/reports/mcp-server-sqlite-npx.json +43 -0
package/reports/mcp-server.json +43 -0
package/reports/mcp-starter.json +59 -0
package/reports/mcp-tool-lint.json +43 -0
package/reports/mcporter.json +43 -0
package/reports/mcptoolshop-mcp-tool-registry.json +43 -0
package/reports/microsoft-devbox-mcp.json +43 -0
package/reports/mobilenext-mobile-mcp.json +214 -0
package/reports/modelcontextprotocol-server-brave-search.json +43 -0
package/reports/modelcontextprotocol-server-everything.json +165 -0
package/reports/modelcontextprotocol-server-fetch.json +43 -0
package/reports/modelcontextprotocol-server-filesystem.json +259 -0
package/reports/modelcontextprotocol-server-github.json +391 -0
package/reports/modelcontextprotocol-server-memory.json +117 -0
package/reports/modelcontextprotocol-server-postgres.json +43 -0
package/reports/modelcontextprotocol-server-puppeteer.json +101 -0
package/reports/modelcontextprotocol-server-sequential-thinking.json +67 -0
package/reports/mongodb-mcp-server.json +43 -0
package/reports/mseep-linear-mcp-server.json +43 -0
package/reports/mseep-mcp-server-sqlite-npx.json +43 -0
package/reports/n8n-mcp.json +123 -0
package/reports/notepost-mcp.json +43 -0
package/reports/notionhq-notion-mcp-server.json +220 -0
package/reports/nx-mcp.json +59 -0
package/reports/obsidian-mcp-server.json +43 -0
package/reports/opengraph-io-mcp.json +130 -0
package/reports/payloadcms-plugin-mcp.json +43 -0
package/reports/peac-mappings-mcp.json +43 -0
package/reports/playwright-mcp.json +236 -0
package/reports/puppeteer-mcp-server.json +43 -0
package/reports/railway-mcp-server.json +194 -0
package/reports/razorpay-blade-mcp.json +182 -0
package/reports/rekog-mcp-nest.json +43 -0
package/reports/remotion-mcp.json +51 -0
package/reports/rollbar-mcp-server.json +43 -0
package/reports/sap-ux-fiori-mcp-server.json +80 -0
package/reports/sentry-mcp-server.json +43 -0
package/reports/server-filesystem.json +43 -0
package/reports/server-memory.json +43 -0
package/reports/shortcut-mcp.json +43 -0
package/reports/supabase-mcp-server-supabase.json +43 -0
package/reports/tavily-mcp.json +79 -0
package/reports/thelord-mcp-server-docker-npx.json +43 -0
package/reports/tyk-technologies-api-to-mcp.json +43 -0
package/reports/tyk-technologies-tyk-dashboard-mcp.json +43 -0
package/reports/ui5-mcp-server.json +157 -0
package/reports/upstash-context7-mcp.json +82 -0
package/reports/vantasdk-vanta-mcp-server.json +43 -0
package/reports/winor30-mcp-server-datadog.json +43 -0
package/reports/wonderwhy-er-desktop-commander.json +43 -0
package/reports/xzxzzx-bilibili-mcp.json +58 -0
package/src/grader.mjs +66 -0
package/src/index.mjs +108 -0
package/src/reporter.mjs +158 -0
package/src/rules.mjs +363 -0
package/src/scanner.mjs +208 -0

package/reports/microsoft-devbox-mcp.json ADDED Viewed

@@ -0,0 +1,43 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T19:50:00.893Z",
+  "server": {
+    "name": "unknown",
+    "version": "?"
+  },
+  "toolCount": 0,
+  "grade": {
+    "overall": "B",
+    "score": 85,
+    "categories": {
+      "auth": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 0,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    }
+  ]
+}

package/reports/mobilenext-mobile-mcp.json ADDED Viewed

@@ -0,0 +1,214 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T18:07:16.402Z",
+  "server": {
+    "name": "mobile-mcp",
+    "version": "0.0.50"
+  },
+  "toolCount": 21,
+  "grade": {
+    "overall": "F",
+    "score": 0,
+    "categories": {
+      "permissions": "B",
+      "validation": "F",
+      "auth": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 2,
+    "MEDIUM": 22,
+    "LOW": 1,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0,
+    "credential_access": 1
+  },
+  "findings": [
+    {
+      "category": "permissions",
+      "severity": "HIGH",
+      "tool": "mobile_type_keys",
+      "rule": "dangerous_tool_credential_access",
+      "detail": "Tool \"mobile_type_keys\" classified as credential_access — requires permission controls"
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_list_available_devices",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"mobile_list_available_devices\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "mobile_list_available_devices",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"mobile_list_available_devices\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_list_apps",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_list_apps\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_launch_app",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_launch_app\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_terminate_app",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_terminate_app\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_install_app",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_install_app\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_uninstall_app",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_uninstall_app\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_get_screen_size",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_get_screen_size\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_click_on_screen_at_coordinates",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_click_on_screen_at_coordinates\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_double_tap_on_screen",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_double_tap_on_screen\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_long_press_on_screen_at_coordinates",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_long_press_on_screen_at_coordinates\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_list_elements_on_screen",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_list_elements_on_screen\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_press_button",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_press_button\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_open_url",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_open_url\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_swipe_on_screen",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_swipe_on_screen\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_type_keys",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_type_keys\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_save_screenshot",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_save_screenshot\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_take_screenshot",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_take_screenshot\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_set_orientation",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_set_orientation\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_get_orientation",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_get_orientation\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_start_screen_recording",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_start_screen_recording\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "mobile_stop_screen_recording",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"mobile_stop_screen_recording\""
+    },
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    },
+    {
+      "category": "permissions",
+      "severity": "MEDIUM",
+      "tool": "*",
+      "rule": "large_tool_surface",
+      "detail": "Server exposes 21 tools — large attack surface without per-tool permission controls"
+    }
+  ]
+}

package/reports/modelcontextprotocol-server-brave-search.json ADDED Viewed

@@ -0,0 +1,43 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T17:56:08.091Z",
+  "server": {
+    "name": "unknown",
+    "version": "?"
+  },
+  "toolCount": 0,
+  "grade": {
+    "overall": "B",
+    "score": 85,
+    "categories": {
+      "auth": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 0,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    }
+  ]
+}

package/reports/modelcontextprotocol-server-everything.json ADDED Viewed

@@ -0,0 +1,165 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T18:00:15.971Z",
+  "server": {
+    "name": "mcp-servers/everything",
+    "title": "Everything Reference Server",
+    "version": "2.0.0"
+  },
+  "toolCount": 13,
+  "grade": {
+    "overall": "F",
+    "score": 0,
+    "categories": {
+      "validation": "F",
+      "auth": "B",
+      "output": "A"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 7,
+    "LOW": 10,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 7,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "echo",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"echo\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "get-env",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"get-env\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "get-env",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"get-env\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "get-resource-links",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"get-resource-links\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "get-resource-reference",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"get-resource-reference\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "get-tiny-image",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"get-tiny-image\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "get-tiny-image",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"get-tiny-image\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "gzip-file-as-resource",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"gzip-file-as-resource\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "gzip-file-as-resource",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"gzip-file-as-resource\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "toggle-simulated-logging",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"toggle-simulated-logging\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "toggle-simulated-logging",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"toggle-simulated-logging\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "toggle-subscriber-updates",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"toggle-subscriber-updates\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "toggle-subscriber-updates",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"toggle-subscriber-updates\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "trigger-long-running-operation",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"trigger-long-running-operation\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "simulate-research-query",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"simulate-research-query\""
+    },
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    },
+    {
+      "category": "output",
+      "severity": "LOW",
+      "tool": "get-structured-content",
+      "rule": "unfiltered_file_output",
+      "detail": "File reading tool \"get-structured-content\" may output sensitive file contents without filtering"
+    },
+    {
+      "category": "output",
+      "severity": "LOW",
+      "tool": "gzip-file-as-resource",
+      "rule": "unfiltered_file_output",
+      "detail": "File reading tool \"gzip-file-as-resource\" may output sensitive file contents without filtering"
+    }
+  ]
+}

package/reports/modelcontextprotocol-server-fetch.json ADDED Viewed

@@ -0,0 +1,43 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T20:21:59.002Z",
+  "server": {
+    "name": "unknown",
+    "version": "?"
+  },
+  "toolCount": 0,
+  "grade": {
+    "overall": "B",
+    "score": 85,
+    "categories": {
+      "auth": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 0,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    }
+  ]
+}