@agentsid/scanner 0.1.0

package/reports/modelcontextprotocol-server-memory.json

@@ -0,0 +1,117 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T19:39:08.762Z",
+  "server": {
+    "name": "memory-server",
+    "version": "0.6.3"
+  },
+  "toolCount": 9,
+  "grade": {
+    "overall": "F",
+    "score": 0,
+    "categories": {
+      "permissions": "F",
+      "validation": "B",
+      "auth": "B",
+      "output": "A",
+      "hallucination": "A"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 4,
+    "MEDIUM": 5,
+    "LOW": 2,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 2,
+    "mutation": 2,
+    "destructive": 3,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "permissions",
+      "severity": "MEDIUM",
+      "tool": "create_entities",
+      "rule": "dangerous_tool_mutation",
+      "detail": "Tool \"create_entities\" classified as mutation — requires permission controls"
+    },
+    {
+      "category": "permissions",
+      "severity": "MEDIUM",
+      "tool": "create_relations",
+      "rule": "dangerous_tool_mutation",
+      "detail": "Tool \"create_relations\" classified as mutation — requires permission controls"
+    },
+    {
+      "category": "permissions",
+      "severity": "HIGH",
+      "tool": "delete_entities",
+      "rule": "dangerous_tool_destructive",
+      "detail": "Tool \"delete_entities\" classified as destructive — requires permission controls"
+    },
+    {
+      "category": "permissions",
+      "severity": "HIGH",
+      "tool": "delete_observations",
+      "rule": "dangerous_tool_destructive",
+      "detail": "Tool \"delete_observations\" classified as destructive — requires permission controls"
+    },
+    {
+      "category": "permissions",
+      "severity": "HIGH",
+      "tool": "delete_relations",
+      "rule": "dangerous_tool_destructive",
+      "detail": "Tool \"delete_relations\" classified as destructive — requires permission controls"
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "read_graph",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"read_graph\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "read_graph",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"read_graph\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "search_nodes",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"search_nodes\""
+    },
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    },
+    {
+      "category": "output",
+      "severity": "LOW",
+      "tool": "read_graph",
+      "rule": "unfiltered_file_output",
+      "detail": "File reading tool \"read_graph\" may output sensitive file contents without filtering"
+    },
+    {
+      "category": "hallucination",
+      "severity": "MEDIUM",
+      "tool": "delete_entities + delete_relations",
+      "rule": "conflicting_tool_descriptions",
+      "detail": "Tools \"delete_entities\" and \"delete_relations\" have 100% description overlap. LLM may choose between them unpredictably."
+    }
+  ]
+}

package/reports/modelcontextprotocol-server-postgres.json

@@ -0,0 +1,43 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T20:21:36.552Z",
+  "server": {
+    "name": "unknown",
+    "version": "?"
+  },
+  "toolCount": 0,
+  "grade": {
+    "overall": "B",
+    "score": 85,
+    "categories": {
+      "auth": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 0,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    }
+  ]
+}

package/reports/modelcontextprotocol-server-puppeteer.json

@@ -0,0 +1,101 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T20:21:42.712Z",
+  "server": {
+    "name": "example-servers/puppeteer",
+    "version": "0.1.0"
+  },
+  "toolCount": 7,
+  "grade": {
+    "overall": "F",
+    "score": 21,
+    "categories": {
+      "validation": "D",
+      "auth": "B",
+      "hallucination": "A"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 8,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "puppeteer_navigate",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"puppeteer_navigate\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "puppeteer_screenshot",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"puppeteer_screenshot\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "puppeteer_click",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"puppeteer_click\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "puppeteer_fill",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"puppeteer_fill\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "puppeteer_select",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"puppeteer_select\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "puppeteer_hover",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"puppeteer_hover\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "puppeteer_evaluate",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"puppeteer_evaluate\""
+    },
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    },
+    {
+      "category": "hallucination",
+      "severity": "MEDIUM",
+      "tool": "puppeteer_navigate",
+      "rule": "description_too_short",
+      "detail": "Tool \"puppeteer_navigate\" description is only 17 chars. LLM will hallucinate capabilities based on the name alone."
+    }
+  ]
+}

package/reports/modelcontextprotocol-server-sequential-thinking.json

@@ -0,0 +1,67 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T18:00:28.654Z",
+  "server": {
+    "name": "sequential-thinking-server",
+    "version": "0.2.0"
+  },
+  "toolCount": 1,
+  "grade": {
+    "overall": "D",
+    "score": 54,
+    "categories": {
+      "injection": "A",
+      "validation": "A",
+      "auth": "B",
+      "secrets": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 2,
+    "MEDIUM": 2,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "injection",
+      "severity": "MEDIUM",
+      "tool": "sequentialthinking",
+      "rule": "excessive_description_length",
+      "detail": "Tool description is 2781 chars — unusually long, may contain hidden instructions"
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "sequentialthinking",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"sequentialthinking\""
+    },
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    },
+    {
+      "category": "secrets",
+      "severity": "HIGH",
+      "tool": "sequentialthinking",
+      "rule": "potential_secret_exposure",
+      "detail": "Tool \"sequentialthinking\" may expose secrets in its output based on description"
+    }
+  ]
+}

package/reports/mongodb-mcp-server.json

@@ -0,0 +1,43 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T19:42:00.767Z",
+  "server": {
+    "name": "unknown",
+    "version": "?"
+  },
+  "toolCount": 0,
+  "grade": {
+    "overall": "B",
+    "score": 85,
+    "categories": {
+      "auth": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 0,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    }
+  ]
+}

package/reports/mseep-linear-mcp-server.json

@@ -0,0 +1,43 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T19:50:29.173Z",
+  "server": {
+    "name": "unknown",
+    "version": "?"
+  },
+  "toolCount": 0,
+  "grade": {
+    "overall": "B",
+    "score": 85,
+    "categories": {
+      "auth": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 0,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    }
+  ]
+}

package/reports/mseep-mcp-server-sqlite-npx.json

@@ -0,0 +1,43 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T18:10:16.494Z",
+  "server": {
+    "name": "unknown",
+    "version": "?"
+  },
+  "toolCount": 0,
+  "grade": {
+    "overall": "B",
+    "score": 85,
+    "categories": {
+      "auth": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 0,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    }
+  ]
+}

package/reports/n8n-mcp.json

@@ -0,0 +1,123 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T19:45:08.896Z",
+  "server": {
+    "name": "n8n-documentation-mcp",
+    "version": "2.41.3"
+  },
+  "toolCount": 7,
+  "grade": {
+    "overall": "F",
+    "score": 0,
+    "categories": {
+      "validation": "D",
+      "auth": "B",
+      "secrets": "C",
+      "hallucination": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 3,
+    "MEDIUM": 7,
+    "LOW": 2,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 4,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "tools_documentation",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"tools_documentation\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "tools_documentation",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"tools_documentation\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "search_nodes",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"search_nodes\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "get_node",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"get_node\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "validate_node",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"validate_node\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "search_templates",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"search_templates\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "search_templates",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"search_templates\""
+    },
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    },
+    {
+      "category": "secrets",
+      "severity": "HIGH",
+      "tool": "search_nodes",
+      "rule": "potential_secret_exposure",
+      "detail": "Tool \"search_nodes\" may expose secrets in its output based on description"
+    },
+    {
+      "category": "secrets",
+      "severity": "HIGH",
+      "tool": "get_node",
+      "rule": "potential_secret_exposure",
+      "detail": "Tool \"get_node\" may expose secrets in its output based on description"
+    },
+    {
+      "category": "hallucination",
+      "severity": "MEDIUM",
+      "tool": "search_nodes",
+      "rule": "missing_scope_boundary",
+      "detail": "Tool \"search_nodes\" references database, config, key, webhook without specifying scope boundaries. LLM will attempt to access the broadest possible scope."
+    },
+    {
+      "category": "hallucination",
+      "severity": "MEDIUM",
+      "tool": "validate_node",
+      "rule": "missing_scope_boundary",
+      "detail": "Tool \"validate_node\" references config without specifying scope boundaries. LLM will attempt to access the broadest possible scope."
+    }
+  ]
+}

package/reports/notepost-mcp.json

@@ -0,0 +1,43 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T19:44:35.818Z",
+  "server": {
+    "name": "unknown",
+    "version": "?"
+  },
+  "toolCount": 0,
+  "grade": {
+    "overall": "B",
+    "score": 85,
+    "categories": {
+      "auth": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 0,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    }
+  ]
+}