@kryptosai/mcp-observatory 1.29.2 → 1.31.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +66 -7
- package/README.zh-CN.md +66 -7
- package/dist/src/checks/runtime-profile.d.ts +5 -0
- package/dist/src/checks/runtime-profile.js +214 -0
- package/dist/src/checks/runtime-profile.js.map +1 -0
- package/dist/src/checks/security-rules.js +18 -0
- package/dist/src/checks/security-rules.js.map +1 -1
- package/dist/src/checks/skill-scan.d.ts +46 -0
- package/dist/src/checks/skill-scan.js +665 -0
- package/dist/src/checks/skill-scan.js.map +1 -0
- package/dist/src/cli.js +5 -0
- package/dist/src/cli.js.map +1 -1
- package/dist/src/commands/audit.js +3 -0
- package/dist/src/commands/audit.js.map +1 -1
- package/dist/src/commands/enforce.d.ts +12 -0
- package/dist/src/commands/enforce.js +187 -0
- package/dist/src/commands/enforce.js.map +1 -0
- package/dist/src/commands/scan.js +44 -9
- package/dist/src/commands/scan.js.map +1 -1
- package/dist/src/commands/score.js +14 -0
- package/dist/src/commands/score.js.map +1 -1
- package/dist/src/commands/skill-scan.d.ts +6 -0
- package/dist/src/commands/skill-scan.js +62 -0
- package/dist/src/commands/skill-scan.js.map +1 -0
- package/dist/src/commands/test.js +48 -0
- package/dist/src/commands/test.js.map +1 -1
- package/dist/src/discovery.d.ts +15 -1
- package/dist/src/discovery.js +219 -9
- package/dist/src/discovery.js.map +1 -1
- package/dist/src/index.d.ts +3 -1
- package/dist/src/index.js +3 -1
- package/dist/src/index.js.map +1 -1
- package/dist/src/receipt.d.ts +4 -1
- package/dist/src/receipt.js +85 -0
- package/dist/src/receipt.js.map +1 -1
- package/dist/src/reporters/markdown.js +39 -0
- package/dist/src/reporters/markdown.js.map +1 -1
- package/dist/src/reporters/terminal.d.ts +3 -0
- package/dist/src/reporters/terminal.js +50 -1
- package/dist/src/reporters/terminal.js.map +1 -1
- package/dist/src/runner.js +6 -0
- package/dist/src/runner.js.map +1 -1
- package/dist/src/types.d.ts +26 -1
- package/docs/mcp-server-safety-index.md +13 -11
- package/docs/safety-index/artifacts/github-mcp-server.json +1707 -0
- package/docs/safety-index/artifacts/github-mcp-server.md +169 -0
- package/docs/safety-index/targets.json +17 -0
- package/package.json +2 -2
|
@@ -10,12 +10,12 @@ For the rules behind this page, see the [Safety Methodology](./methodology.md) a
|
|
|
10
10
|
|
|
11
11
|
## Snapshot
|
|
12
12
|
|
|
13
|
-
- Evaluated servers:
|
|
13
|
+
- Evaluated servers: 18
|
|
14
14
|
- Ready for CI: 7
|
|
15
|
-
- Needs review before production:
|
|
15
|
+
- Needs review before production: 6
|
|
16
16
|
- Unsafe default posture: 5
|
|
17
17
|
- Not reproducible: 0
|
|
18
|
-
- Latest run: 2026-07-
|
|
18
|
+
- Latest run: 2026-07-08T21:36:07.342Z
|
|
19
19
|
|
|
20
20
|
## Evaluations
|
|
21
21
|
|
|
@@ -30,14 +30,15 @@ For the rules behind this page, see the [Safety Methodology](./methodology.md) a
|
|
|
30
30
|
| 7 | [Promptopia](https://www.npmjs.com/package/promptopia-mcp) | Prompts | **Ready for CI** | `allow` | Prompt/resource contract | `npx -y promptopia-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y promptopia-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/promptopia-server.json) / [report](./safety-index/artifacts/promptopia-server.md) | Uses the checked-in prompt fixture through package defaults. |
|
|
31
31
|
| 8 | [Ref tools](https://www.npmjs.com/package/ref-tools-mcp) | Developer Tools | **Ready for CI** | `allow` | Prompt/tool inventory | `npx -y ref-tools-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y ref-tools-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/ref-tools-server.json) / [report](./safety-index/artifacts/ref-tools-server.md) | Zero-config public package. |
|
|
32
32
|
| 9 | [Git MCP Server](https://www.npmjs.com/package/@cyanheads/git-mcp-server) | Developer Tools | **Needs review before production** | `gate` | Git tool boundary | `npx -y @cyanheads/git-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @cyanheads/git-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/cyanheads-git-mcp-server.json) / [report](./safety-index/artifacts/cyanheads-git-mcp-server.md) | Zero-config public package. Keep tool invocation read-only unless a harmless fixture repository is added. |
|
|
33
|
-
| 10 | [
|
|
34
|
-
| 11 | [
|
|
35
|
-
| 12 | [
|
|
36
|
-
| 13 | [
|
|
37
|
-
| 14 | [
|
|
38
|
-
| 15 | [
|
|
39
|
-
| 16 | [
|
|
40
|
-
| 17 | [
|
|
33
|
+
| 10 | [Official GitHub MCP server](https://github.com/modelcontextprotocol/servers) | Developer Tools | **Needs review before production** | `gate` | Write/merge tool boundary | `npx -y @modelcontextprotocol/server-github` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-github" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/github-mcp-server.json) / [report](./safety-index/artifacts/github-mcp-server.md) | Zero-config package; tool listing succeeds without a real GitHub token, so this check is safe to run in CI. Note: npm currently flags this package as deprecated/no longer supported by the publisher — treat this target as compatibility evidence, not an endorsement of the package's maintenance status. |
|
|
34
|
+
| 11 | [OpenTofu MCP server](https://github.com/opentofu/opentofu-mcp-server) | Infrastructure | **Needs review before production** | `gate` | Infrastructure tool surface | `npx -y @opentofu/opentofu-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @opentofu/opentofu-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/opentofu-server.json) / [report](./safety-index/artifacts/opentofu-server.md) | Zero-config public package. |
|
|
35
|
+
| 12 | [Puppeteer MCP server](https://www.npmjs.com/package/puppeteer-mcp-server) | Browser Automation | **Unsafe default posture** | `quarantine` | Browser/code execution boundary | `npx -y puppeteer-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y puppeteer-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/puppeteer-server.json) / [report](./safety-index/artifacts/puppeteer-server.md) | Intentional browser evaluation is suppressed so remaining findings stay readable. |
|
|
36
|
+
| 13 | [BrowserMCP](https://github.com/BrowserMCP/mcp) | Browser Automation | **Ready for CI** | `allow` | Browser-control boundary | `npx -y @browsermcp/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @browsermcp/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | Zero-config public package. [public proof](https://github.com/BrowserMCP/mcp/pull/189) |
|
|
37
|
+
| 14 | [Microsoft Playwright MCP](https://github.com/microsoft/playwright-mcp) | Browser Automation | **Unsafe default posture** | `quarantine` | Browser/code execution boundary | `npx -y @playwright/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @playwright/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/playwright-mcp-server.json) / [report](./safety-index/artifacts/playwright-mcp-server.md) | Zero-config public package; security findings represent policy-review prompts, not a vulnerability claim. |
|
|
38
|
+
| 15 | [AntV chart MCP server](https://github.com/antvis/mcp-server-chart) | Visualization | **Ready for CI** | `allow` | Artifact-producing tools | `npx -y @antv/mcp-server-chart` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @antv/mcp-server-chart" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/antv-chart-server.json) / [report](./safety-index/artifacts/antv-chart-server.md) | Zero-config public package. [public proof](https://github.com/antvis/mcp-server-chart/pull/312) |
|
|
39
|
+
| 16 | [ExecuteAutomation Playwright MCP](https://github.com/executeautomation/mcp-playwright) | Browser Automation | **Unsafe default posture** | `quarantine` | Startup/listing reproducibility | `npx -y @executeautomation/playwright-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @executeautomation/playwright-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/executeautomation-playwright-server.json) / [report](./safety-index/artifacts/executeautomation-playwright-server.md) | Evaluated as a public package; current result should be treated as a maintainer conversation starter. [public proof](https://github.com/executeautomation/mcp-playwright/pull/225) |
|
|
40
|
+
| 17 | [Flux159 Kubernetes MCP server](https://github.com/Flux159/mcp-server-kubernetes) | Infrastructure / Kubernetes | **Unsafe default posture** | `quarantine` | Command and cluster mutation boundary | `npx -y mcp-server-kubernetes` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-kubernetes" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/kubernetes-server.json) / [report](./safety-index/artifacts/kubernetes-server.md) | Zero-config public package. Evaluated without cluster credentials; findings are metadata and schema boundary prompts, not exploit claims. |
|
|
41
|
+
| 18 | [Chrome DevTools MCP](https://github.com/ChromeDevTools/chrome-devtools-mcp) | Browser Automation | **Unsafe default posture** | `gate` | Browser/code execution boundary | `npx -y chrome-devtools-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y chrome-devtools-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/chrome-devtools-mcp-server.json) / [report](./safety-index/artifacts/chrome-devtools-mcp-server.md) | Zero-config public package; browser-control findings should be treated as policy-review prompts, not vulnerability claims. |
|
|
41
42
|
|
|
42
43
|
## Patterns Observed
|
|
43
44
|
|
|
@@ -56,6 +57,7 @@ For the rules behind this page, see the [Safety Methodology](./methodology.md) a
|
|
|
56
57
|
- Startup/listing reproducibility: 1 server(s)
|
|
57
58
|
- Temporary directory filesystem access: 1 server(s)
|
|
58
59
|
- Tool schema clarity: 1 server(s)
|
|
60
|
+
- Write/merge tool boundary: 1 server(s)
|
|
59
61
|
|
|
60
62
|
## Publication Rules
|
|
61
63
|
|