CanopiiCanopiiAll serversEnterprise →
delltrak/wamcp

delltrak/wamcp vmain@f6b119d

Security Trust Score
Grade A · Strong posture
Tier 1 · Public sourceHigh confidence · 98%
Declared MCP capabilities
Prompts

Host delltrak/wamcp in a governed environment — SSO in front, every tool call attributed and audited.

Reputation25stars11forks3open issuestodaylast commit<1yage

Security controls

Deterministic, evidence-backed. Score earned from passing controls; a failed guard caps it.

Model–MCP Runtime Guardrails

  • Pass
    Indirect Prompt Injection (IPI) Defensesguardno injection markers

    Tool/prompt/resource text is free of hidden instructions that could hijack the agent.

  • Pass
    Strict JSON Schema EnforcementadditionalProperties:false present

    Tool inputs are constrained (additionalProperties:false), so unexpected arguments can't be smuggled in.

  • Pass
    In-Session Definition Integrityguardno call-gated or call-time tool definition changes

    Tool and prompt definitions stay fixed during a session — they don't change after a few calls, which is how runtime-gated rug-pulls slip past one-time review.

  • Pass
    User-in-the-Loop / Approval Scopeguardno destructive tool scope

    No over-broad or destructive tools (arbitrary shell, bulk-delete) that warrant human approval.

  • N/A
    Tool Definition Integrityguardno prior version to diff

    Every consecutive version pair is diffed for new injection markers or destructive scope — a risky diff anywhere in history is a rug-pull (fail, durable); benign description drift warns.

Application Security Checks

  • Warn
    No path traversalguard16 occurrences

    Naive path checks let tools read/write outside intended directories (EscapeRoute-class).

    src/channels/baileys/baileys.adapter.ts:246src/channels/baileys/baileys.adapter.ts:971src/channels/baileys/baileys.adapter.ts:974src/channels/baileys/baileys.adapter.ts:977

    Fix: Resolve to a canonical path and verify containment; reject ../ and symlinks.

  • Warn
    No SSRF sinksguard12 occurrences

    Fetching tool-supplied URLs can pivot into internal networks and metadata services.

    src/channels/cloud-api/cloud.adapter.ts:153src/channels/cloud-api/cloud.adapter.ts:171src/channels/cloud-api/cloud.adapter.ts:625src/channels/cloud-api/cloud.adapter.ts:891

    Fix: Allow-list destinations; reject arbitrary/loopback/link-local URLs.

  • Warn
    Declares a licenseno recognized license

    A clear license is required for legal enterprise use.

    Fix: Add a recognized SPDX license (MIT, Apache-2.0, …).

  • Pass
    No command-injection sinksguardno sinks found

    Untrusted tool input reaching a shell yields remote code execution.

  • Pass
    No dynamic code executionguardno sinks found

    eval()/exec()/Function() on tool-derived strings allows arbitrary code execution.

  • Pass
    No unsafe deserializationguardno sinks found

    pickle/yaml.load/etc. on untrusted data can execute code.

  • Pass
    No committed secretsguardno secrets found

    Hardcoded keys/tokens in published source are live credentials an attacker can use.

  • Pass
    Credentials sourced from environmentreads credentials from environment

    Reading secrets from env/secret stores avoids hardcoding them.

  • Pass
    No known-vulnerable dependencies225 runtime deps, no known CVEs

    Runtime dependencies (parsed from the lockfile) are scanned against OSV.dev for published CVEs. Advisory: flagged dependencies lower the score but don't hard-cap it, since transitive reachability is unproven.

  • Pass
    Dependencies pinned (lockfile)lockfile present

    A lockfile makes installs reproducible and resistant to silent dependency swaps.

  • Pass
    Actively maintainedrecent commits

    Unmaintained servers don't receive security fixes.

  • Pass
    Repository not archivedguardactive

    Archived repositories will never be patched.

  • Pass
    Has a security policySECURITY.md present

    A SECURITY.md gives a private path to report vulnerabilities.

  • Pass
    Adoption & popularityestablished adoption

    A small, capped nudge from stars/downloads — widely-used servers get more eyes on bugs. It can never offset a real security failure.

  • Not checked
    Signed releasesnot evaluated

    Signed releases let consumers verify artifacts weren't tampered with.

  • N/A
    No install/post-install scriptsguardno published package

    install hooks run arbitrary code on every consumer at install time.

  • N/A
    Package name not typosquattingguardno published package

    Names mimicking popular packages are a common malware delivery vector.

  • N/A
    Published with provenanceno published package

    Build provenance attests the artifact was built from the claimed source by CI.

  • N/A
    Established maintainerno published package

    Brand-new / single anonymous maintainers raise takeover and malware risk.

Transport & Trust Model

  • Warn
    DNS-Rebinding Protectionno Origin/Host validation found

    HTTP endpoints reject requests carrying an unlisted Origin, so a malicious web page can't drive the server through the user's browser.

    Fix: Enable the SDK's DNS-rebinding protection (enableDnsRebindingProtection / TransportSecuritySettings) with explicit allowed hosts and origins, and return 403 for an unlisted Origin.

  • Warn
    Network Exposurebinds 0.0.0.0

    Binding 0.0.0.0 or exposing debug inspectors widens the attack surface.

    Fix: Bind to 127.0.0.1 by default; never ship open debug endpoints.

  • Pass
    No Token Passthroughguardno inbound token forwarded downstream

    The client's token is never forwarded to downstream APIs — the server obtains its own, correctly-scoped credential instead.

  • Pass
    Execution Sandboxingcontainerized

    A container/sandbox image limits blast radius; a server that runs natively has full host access.

  • N/A
    Transport Encryption (TLS)guardno remote endpoints

    Plaintext HTTP exposes traffic and bearer tokens to interception.

  • N/A
    IAM / Authentication Scopingno remote endpoints

    OAuth 2.1 / Protected Resource Metadata gates who can invoke tools.

  • N/A
    Live Endpoint Reachablenot dynamically scanned

    A dynamic scan connected to the declared remote endpoint and it responded — verified live, not a dead URL.

  • N/A
    Authentication Enforced (live)not dynamically scanned

    If the server declares auth is required, it must actually reject anonymous clients. Serving tools to unauthenticated callers is a real exposure.

Tools (80)

wa_xwa_pin_chatwa_send_gifwa_send_ptvwa_mute_chatwa_send_pollwa_send_textwa_clear_chatwa_edit_labelwa_group_joinwa_list_chatswa_send_audiowa_send_eventwa_send_imagewa_send_videowa_delete_chatwa_get_qr_codewa_group_leavewa_list_groupswa_list_labelswa_my_new_toolwa_reject_callwa_archive_chatwa_create_groupwa_create_labelwa_delete_labelwa_get_messageswa_group_demotewa_send_contactwa_send_stickerwa_star_messagewa_block_contactwa_group_promotewa_send_documentwa_send_locationwa_send_reactionwa_add_chat_labelwa_download_mediawa_get_group_infowa_search_contactwa_create_instancewa_delete_instancewa_forward_messagewa_resync_contactswa_unblock_contactwa_connect_instancewa_get_pairing_codewa_get_poll_resultswa_mark_chat_unreadwa_restart_instancewa_add_message_labelwa_get_contact_aboutwa_remove_chat_labelwa_send_link_previewwa_send_live_locationwa_check_number_existswa_disconnect_instancewa_get_event_responseswa_group_revoke_invitewa_get_business_profilewa_group_handle_requestwa_group_remove_picturewa_group_update_picturewa_group_update_subjectwa_remove_message_labelwa_fetch_message_historywa_get_group_invite_infowa_group_get_invite_codewa_group_member_add_modewa_group_update_settingswa_list_blocked_contactswa_set_cloud_credentialswa_group_add_participantswa_group_toggle_ephemeralwa_group_join_approval_modewa_group_list_join_requestswa_group_update_descriptionwa_group_remove_participantswa_send_group_invite_messagewa_set_disappearing_messages
delltrak/wamcp vmain@f6b119d — 90/100 · Canopii Trust Index