CanopiiCanopiiAll serversEnterprise →
io.github.YawLabs/mcp-compliance

io.github.YawLabs/mcp-compliance v0.17.1

Security Trust Score
Grade D · Weak posture
Tier 1 · Public sourceHigh confidence · 91%
Declared MCP capabilities
ResourcesPrompts

This server scored D. Run it behind runtime policy enforcement so one bad tool call can't become an incident.

1 issue capping this score
  • highTool descriptions free of injection markers — 1 marker(s) across 1 tool(s)
Reputation1.6kdownloads/mo

Security controls

Deterministic, evidence-backed. Score earned from passing controls; a failed guard caps it.

Model–MCP Runtime Guardrails

  • Fail
    Indirect Prompt Injection (IPI) Defensesguard1 marker(s) across 1 tool(s)

    Tool/prompt/resource text is free of hidden instructions that could hijack the agent. How many servers fail this?

    Rejects auth tokens in query string — exfiltration directive

    Fix: Remove hidden directives, HTML/comment instructions, and override phrasing from descriptions.

  • Pass
    Strict JSON Schema EnforcementadditionalProperties:false present

    Tool inputs are constrained (additionalProperties:false), so unexpected arguments can't be smuggled in.

  • Pass
    Tool Definition Integrityguardtool definitions stable; no risky changes in version history

    Every consecutive version pair is diffed for new injection markers or destructive scope — a risky diff anywhere in history is a rug-pull (fail, durable); benign description drift warns.

  • Pass
    User-in-the-Loop / Approval Scopeguardno destructive tool scope

    No over-broad or destructive tools (arbitrary shell, bulk-delete) that warrant human approval.

Application Security Checks

  • Warn
    Dependencies pinned (lockfile)no lockfile found

    A lockfile makes installs reproducible and resistant to silent dependency swaps.

    Fix: Commit a lockfile (package-lock.json / pnpm-lock.yaml / poetry.lock).

  • Warn
    Published with provenanceno provenance attestation

    Build provenance attests the artifact was built from the claimed source by CI.

    Fix: Publish with npm provenance (--provenance) from a trusted CI.

  • Warn
    Established maintainersingle maintainer

    Brand-new / single anonymous maintainers raise takeover and malware risk.

    Fix: Publish under an established account/org; add multiple maintainers.

  • Warn
    Has a security policyno security policy

    A SECURITY.md gives a private path to report vulnerabilities.

    Fix: Add SECURITY.md with a disclosure contact and process.

  • Pass
    No command-injection sinksguardno sinks found

    Untrusted tool input reaching a shell yields remote code execution.

  • Pass
    No dynamic code executionguardno sinks found

    eval()/exec()/Function() on tool-derived strings allows arbitrary code execution.

  • Pass
    No path traversalguardno sinks found

    Naive path checks let tools read/write outside intended directories (EscapeRoute-class).

  • Pass
    No SSRF sinksguardno sinks found

    Fetching tool-supplied URLs can pivot into internal networks and metadata services.

  • Pass
    No unsafe deserializationguardno sinks found

    pickle/yaml.load/etc. on untrusted data can execute code.

  • Pass
    No committed secretsguardno secrets found

    Hardcoded keys/tokens in published source are live credentials an attacker can use.

  • Pass
    Credentials sourced from environmentreads credentials from environment

    Reading secrets from env/secret stores avoids hardcoding them.

  • Pass
    No known-vulnerable dependencies1 runtime deps, no known CVEs

    Runtime dependencies (parsed from the lockfile) are scanned against OSV.dev for published CVEs. Advisory: flagged dependencies lower the score but don't hard-cap it, since transitive reachability is unproven.

  • Pass
    No install/post-install scriptsguardno install scripts

    install hooks run arbitrary code on every consumer at install time.

  • Pass
    Package name not typosquattingguarddistinct package name

    Names mimicking popular packages are a common malware delivery vector.

  • Pass
    Adoption & popularityestablished adoption

    A small, capped nudge from stars/downloads — widely-used servers get more eyes on bugs. It can never offset a real security failure.

  • Not checked
    Actively maintainedno GitHub repository

    Unmaintained servers don't receive security fixes.

  • Not checked
    Repository not archivedguardno GitHub repository

    Archived repositories will never be patched.

  • Not checked
    Declares a licenseno GitHub repository

    A clear license is required for legal enterprise use.

  • Not checked
    Signed releasesnot evaluated

    Signed releases let consumers verify artifacts weren't tampered with.

Transport & Trust Model

  • Warn
    Execution Sandboxingruns natively (no container image)

    A container/sandbox image limits blast radius; a server that runs natively has full host access.

    Fix: Ship a Dockerfile/Containerfile (or document a sandboxed run) so the server runs isolated.

  • Pass
    Network Exposureno bind-all detected

    Binding 0.0.0.0 or exposing debug inspectors widens the attack surface.

  • N/A
    Transport Encryption (TLS)guardno remote endpoints

    Plaintext HTTP exposes traffic and bearer tokens to interception.

  • N/A
    IAM / Authentication Scopingno remote endpoints

    OAuth 2.1 / Protected Resource Metadata gates who can invoke tools.

  • N/A
    Live Endpoint Reachablenot dynamically scanned

    A dynamic scan connected to the declared remote endpoint and it responded — verified live, not a dead URL.

  • N/A
    Authentication Enforced (live)not dynamically scanned

    If the server declares auth is required, it must actually reject anonymous clients. Serving tools to unauthenticated callers is a real exposure.

Tools (80)

Responds to pingEnforces HTTPS/TLSHTTP POST acceptedIncludes serverInfoInitialize handshakeRoots capability shapePrompts have name fieldUTF-8 unicode roundtripHandles invalid JSON bodyResponds with JSON or SSESampling capability shapeTools include title fieldlogging/setLevel acceptedHandles malformed JSON-RPCTool annotations are validHandles concurrent requestsInstructions field is validResources have uri and nameReturns capabilities objectSupports string request IDsCORS headers are restrictiveElicitation capability shapeSession IDs are high-entropycompletion/complete acceptedGET returns SSE stream or 405Recovers after unknown methodtools/call responds correctlyDELETE accepted or returns 405Newline-delimited JSON framingResource subscribe/unsubscribeResponse ID matches request IDResponse is valid JSON-RPC 2.0Returns valid protocol versionresources/read returns contenttools/list supports paginationRejects JSON-RPC batch requestsReturns -32700 for invalid JSONSession ID does not bypass authHandles unknown protocol versionRejects unauthenticated requestsprompts/list supports paginationAccepts listChanged notificationsNotification returns 202 AcceptedRejects second initialize requestResists SSRF to internal networksTolerates _meta field on requestsTools with outputSchema are validtools/list returns valid responseEnforces MCP-Session-Id after initHandles cancellation notificationsRejects malformed auth credentialsReturns -32600 for invalid requestReturns 404 for unknown session IDprompts/get returns valid messagesresources/list supports paginationAll tools have name and inputSchemaGET with session returns SSE or 405Handles oversized inputs gracefullyRejects auth tokens in query stringReturns error for unknown tool nameTool content items have valid typesValidates Origin header on requestsprompts/list returns valid responseResists SQL injection in tool paramsSSE responses include event: messageSupports progress tokens in requestsRejects non-JSON request Content-TypeResists path traversal in tool paramsresources/list returns valid responseResists command injection in tool paramsHandles progress notifications gracefullyReturns JSON-RPC error for unknown methodReturns error for tools/call without nameInitialize response has valid content typeProtected Resource Metadata endpoint existsRejects methods for undeclared capabilitiesHandles invalid pagination cursor gracefully401 responses include WWW-Authenticate headerresources/templates/list returns valid responseUses correct JSON-RPC error code for unknown method