CanopiiCanopiiAll serversEnterprise →
io.github.blackboxfoundry/livedatalink

io.github.blackboxfoundry/livedatalink v1.6.7

Security Trust Score
Grade A · Strong posture
Tier 1 · Public sourceHigh confidence · 89%
Declared MCP capabilities
ResourcesPrompts

Host io.github.blackboxfoundry/livedatalink in a governed environment — SSO in front, every tool call attributed and audited.

Reputation0stars0forks0open issues13d agolast commit<1yage

Security controls

Deterministic, evidence-backed. Score earned from passing controls; a failed guard caps it.

Model–MCP Runtime Guardrails

  • Warn
    Strict JSON Schema Enforcementschemas not strict

    Tool inputs are constrained (additionalProperties:false), so unexpected arguments can't be smuggled in.

    Fix: Set additionalProperties:false and require explicit parameters on every tool.

  • Pass
    Indirect Prompt Injection (IPI) Defensesguardno injection markers

    Tool/prompt/resource text is free of hidden instructions that could hijack the agent.

  • Pass
    Tool Definition Integrityguardtool definitions stable; no risky changes in version history

    Every consecutive version pair is diffed for new injection markers or destructive scope — a risky diff anywhere in history is a rug-pull (fail, durable); benign description drift warns.

  • Pass
    In-Session Definition Integrityguardno call-gated or call-time tool definition changes

    Tool and prompt definitions stay fixed during a session — they don't change after a few calls, which is how runtime-gated rug-pulls slip past one-time review.

  • Pass
    User-in-the-Loop / Approval Scopeguardno destructive tool scope

    No over-broad or destructive tools (arbitrary shell, bulk-delete) that warrant human approval.

Application Security Checks

  • Warn
    No path traversalguard3 occurrences

    Naive path checks let tools read/write outside intended directories (EscapeRoute-class).

    bin/install.js:73bin/install.js:74bin/install.js:75

    Fix: Resolve to a canonical path and verify containment; reject ../ and symlinks.

  • Warn
    Dependencies pinned (lockfile)no lockfile found

    A lockfile makes installs reproducible and resistant to silent dependency swaps.

    Fix: Commit a lockfile (package-lock.json / pnpm-lock.yaml / poetry.lock).

  • Warn
    Adoption & popularitylimited adoption

    A small, capped nudge from stars/downloads — widely-used servers get more eyes on bugs. It can never offset a real security failure.

    Fix: Adoption grows naturally with real-world use; this never gates the score.

  • Pass
    No command-injection sinksguardno sinks found

    Untrusted tool input reaching a shell yields remote code execution.

  • Pass
    No dynamic code executionguardno sinks found

    eval()/exec()/Function() on tool-derived strings allows arbitrary code execution.

  • Pass
    No SSRF sinksguardno sinks found

    Fetching tool-supplied URLs can pivot into internal networks and metadata services.

  • Pass
    No unsafe deserializationguardno sinks found

    pickle/yaml.load/etc. on untrusted data can execute code.

  • Pass
    No committed secretsguardno secrets found

    Hardcoded keys/tokens in published source are live credentials an attacker can use.

  • Pass
    Credentials sourced from environmentreads credentials from environment

    Reading secrets from env/secret stores avoids hardcoding them.

  • Pass
    Actively maintainedrecent commits

    Unmaintained servers don't receive security fixes.

  • Pass
    Repository not archivedguardactive

    Archived repositories will never be patched.

  • Pass
    Declares a licenseMIT

    A clear license is required for legal enterprise use.

  • Pass
    Has a security policySECURITY.md present

    A SECURITY.md gives a private path to report vulnerabilities.

  • Not checked
    No known-vulnerable dependenciesno lockfile found

    Runtime dependencies (parsed from the lockfile) are scanned against OSV.dev for published CVEs. Advisory: flagged dependencies lower the score but don't hard-cap it, since transitive reachability is unproven.

  • Not checked
    Signed releasesnot evaluated

    Signed releases let consumers verify artifacts weren't tampered with.

  • N/A
    No install/post-install scriptsguardno published package

    install hooks run arbitrary code on every consumer at install time.

  • N/A
    Package name not typosquattingguardno published package

    Names mimicking popular packages are a common malware delivery vector.

  • N/A
    Published with provenanceno published package

    Build provenance attests the artifact was built from the claimed source by CI.

  • N/A
    Established maintainerno published package

    Brand-new / single anonymous maintainers raise takeover and malware risk.

Transport & Trust Model

  • Warn
    IAM / Authentication Scopingno authentication handling detected

    OAuth 2.1 / Protected Resource Metadata gates who can invoke tools.

    Fix: Implement OAuth 2.1 with a .well-known/oauth-protected-resource document.

  • Pass
    Transport Encryption (TLS)guardall remotes use HTTPS

    Plaintext HTTP exposes traffic and bearer tokens to interception.

  • Pass
    No Token Passthroughguardno inbound token forwarded downstream

    The client's token is never forwarded to downstream APIs — the server obtains its own, correctly-scoped credential instead.

  • Pass
    Execution Sandboxingcontainerized

    A container/sandbox image limits blast radius; a server that runs natively has full host access.

  • Pass
    Network Exposureno bind-all detected

    Binding 0.0.0.0 or exposing debug inspectors widens the attack surface.

  • Not checked
    DNS-Rebinding ProtectionHTTP transport not found in source

    HTTP endpoints reject requests carrying an unlisted Origin, so a malicious web page can't drive the server through the user's browser.

  • N/A
    Live Endpoint Reachablenot dynamically scanned

    A dynamic scan connected to the declared remote endpoint and it responded — verified live, not a dead URL.

  • N/A
    Authentication Enforced (live)not dynamically scanned

    If the server declares auth is required, it must actually reject anonymous clients. Serving tools to unauthenticated callers is a real exposure.

Tools (381)

rdap_ipsun_timesbls_seriescve_lookupcve_recentcwe_lookupepss_scorefbi_wantedlei_lookupnpi_lookupreg_searchvin_decodeair_qualitybook_searchbook_statuscargo_cratecrypto_infofred_searchgithub_reponpm_packagerdap_domainsec_ftd_topstock_quotebook_detailscompany_infocrypto_pricefdic_historyfdic_summaryfred_compareiv_analyticslocal_searchnrel_pvwattspaper_searchpaper_statuspypi_packagereg_documentwater_levelsbls_indicatorbook_get_textfdic_depositsfdic_failuresfed_z1_changefed_z1_seriesfred_releasesgeocode_batchgrants_searchip_reputationlei_hierarchyoptions_chainpackage_trackpaper_detailsparcel_searchpatent_recentpatent_searchrecall_screenstock_comparestock_historytreasury_debttrials_searchtx_wells_nearbounce_scannercaselaw_searchcollege_searchcollege_trendscrypto_compareeia_oil_supplyentity_dossierentity_resolvefed_z1_catalogfhfa_hpi_trendpaper_get_textparcel_detailspatent_detailsreg_cfr_searchreg_cfr_titlesresolve_entitysec_ftd_latesttrials_detailscensus_businesscftc_cot_latestchemical_lookupcollege_comparecollege_metricscrypto_trendingeia_natural_gasfda_device_510kfda_drug_lookupfdic_financialsfed_z1_snapshotfhfa_hpi_seriesgeocode_addressleie_lookup_npilobbying_detaillobbying_searchok_wells_searchparcel_coverageproperty_lookupreg_cfr_sectionsec_ftd_comparesec_ftd_historyvehicle_recallsweather_currentcftc_cot_comparecftc_cot_historychemical_hazardsfda_drug_recallsfda_food_recallsfhfa_hpi_comparefred_series_infokev_status_checklist_tool_groupsnonprofit_statusrealestate_rentsrealestate_trendtide_predictionsweather_forecastcdc_dataset_querycensus_populationcourt_case_searchearthquake_recenteia_series_lookupflood_zone_lookupfred_observationshurricane_trackernfip_flood_claimsnonprofit_detailsnws_active_alertsopen_payments_toprealestate_searchrealestate_statusrecreation_nearbysecurity_exposurestock_quote_batchtreasury_auctionsworldbank_comparebank_health_reportbea_compare_statescms_hospice_searchcourt_judge_lookupcpsc_recall_searchfda_device_recallslobbying_lobbyistsnrel_utility_ratested_search_noticesurlhaus_lookup_tagurlhaus_lookup_urlcandlestick_signalscensus_demographicscms_hospital_searchcollege_value_scorecompany_trust_checkcourt_docket_lookupcpsc_recent_recallsedgar_company_factseia_gasoline_pricesepa_facility_searchfmcsa_safety_scoresgeocode_coordinatesgsa_per_diem_lookupnpi_search_providernport_compare_fundsnport_fund_holdingsnrel_solar_resourceorg_funding_profileprice_to_rent_ratiotalent_market_briefurlhaus_lookup_hosturlhaus_recent_urlsusgs_water_realtimeworldbank_indicatorbook_fulltext_searchcaselaw_case_detailscaselaw_opinion_textcdc_flu_surveillancecdc_outbreak_reportscfpb_suggest_companycollege_demographicscongress_house_votescongress_recent_lawscourt_opinion_searchcourt_recent_filingscve_search_by_vendoredgar_company_lookupedgar_filing_contentedgar_recent_filingsepa_facility_detailsfec_candidate_searchfec_committee_searchfmcsa_carrier_lookupfmcsa_carrier_searchfred_category_seriesfred_quick_indicatorlobbying_registrantslocation_risk_reportnonprofit_lookup_einnpi_search_specialtyopen_payments_searchparcel_sales_historyproperty_search_areasanctions_get_entitysource_snapshot_listusda_nass_crop_trendusgs_earthquake_feedwa_contractor_verifycarrier_vetting_batchcarrier_vetting_scorecensus_income_housingcfpb_complaint_detailcfpb_complaint_trendscfpb_state_complaintscollege_accreditationcongress_bill_actionscongress_bill_detailscongress_search_billscve_search_by_keyworddisaster_declarationseia_electricity_statefacility_care_qualityfec_candidate_detailsfmcsa_carrier_compareinfluence_network_mapmarket_size_estimatornonprofit_search_nameoptions_history_chainpaper_fulltext_searchproperty_search_ownersanctions_get_changested_opportunity_radartreasury_cash_balancecfpb_search_complaintscftc_cot_evidence_packclinical_site_selectorcms_home_health_searchedgar_full_text_searcheia_energy_consumptionenergy_market_snapshotepa_enforcement_searchgrants_get_opportunityhud_lihtc_year15_radarleie_exclusion_detailsleie_search_exclusionslobbying_contributionsnrel_alt_fuel_stationsopen_payments_researchoptions_history_atm_ivpatent_assignee_searchpatent_inventor_searchproperty_value_historyrealestate_home_valuessanctions_screen_batchsanctions_search_aliassource_snapshot_statusspending_award_detailsspending_search_awardssupplier_esg_scorecardurlhaus_lookup_payloadusda_nass_crop_historyusgs_earthquake_detailusgs_earthquake_searchbeneficial_owner_screencarrier_monitor_recheckcaselaw_citation_lookupcdc_excess_deaths_covidcensus_geography_lookupcftc_cot_search_marketscms_nursing_home_searchcongress_member_detailscongress_search_memberscounterparty_risk_scorecourt_citation_resolverenvironmental_site_riskepa_facility_compliancefda_drug_adverse_eventsfmcsa_carrier_authorityhud_fha_lender_exposurehud_fha_maturity_searchlane_location_risk_packnasa_firms_search_firesnpi_search_organizationopen_payments_ownershipoptions_history_volhistprescriber_ties_profilesanctions_screen_entitytreasury_exchange_ratestreasury_interest_ratesurlhaus_recent_payloadsbea_state_economic_trendcdc_drug_overdose_deathscdc_vaccination_coveragecongress_bill_cosponsorscorporate_ownership_treedisaster_history_summaryeia_renewable_generationfdic_search_institutionsfec_candidate_financialsissuer_diligence_dossierload_tender_fraud_shieldopen_payments_by_companyoptions_history_contractproduct_liability_screenrealestate_market_screensanctions_screen_addresssanctions_status_summaryurlhaus_lookup_signaturecensus_commute_employmentcompany_complaint_profiledisaster_recovery_profilefbi_cde_state_crime_trendfed_board_h15_rate_spreadfed_board_h15_yield_curvenonprofit_search_locationsearch_available_datasetssec_ftd_search_securitiessupport_resistance_levelstreasury_tic_find_holderstreasury_tic_rank_holdersworldbank_country_profilebea_state_economic_historybea_state_economic_profilebts_transport_border_trendbts_transport_search_portscdc_weekly_deaths_by_statecourt_oral_argument_searchedgar_filings_by_form_typeedgar_insider_transactionsfed_board_h15_rate_historyfema_nfhl_search_inventorygovinfo_legislation_searchgsa_per_diem_mie_breakdownkyb_aml_evidence_case_fileopen_payments_by_specialtyopen_payments_state_totalsrecreation_facility_detailrecreation_search_recareasspending_recipient_summarybea_search_state_indicatorsbts_transport_compare_portscdc_leading_causes_of_deathcfpb_complaint_aggregationscollege_outcomes_by_programepa_water_or_air_violationsfed_board_h15_evidence_packfed_board_h15_search_seriesrecreation_search_campsitestreasury_tic_holder_historytreasury_tic_official_sharecost_of_doing_business_indexfbi_cde_national_crime_trendfbi_cde_state_month_snapshotfec_independent_expendituresfema_nfhl_get_inventory_itemnrel_alt_fuel_station_detailrecreation_search_facilitiestreasury_tic_compare_holdersusda_nass_compare_crop_yearsusda_nass_crop_evidence_packusda_nass_search_crop_serieswa_contractor_recent_changescarrier_vetting_evidence_packwa_contractor_license_historyopen_payments_national_summaryfema_nfhl_get_snapshot_metadatafbi_cde_state_reporting_coveragefbi_cde_compare_state_to_nationalfema_nfhl_compare_inventory_itemsgovinfo_legislation_evidence_packgovinfo_legislation_relationshipsbts_transport_border_activity_packfaa_public_aviation_search_runwaysgovinfo_legislation_committee_pathshipper_receiver_counterparty_packfaa_public_aviation_airport_profilefaa_public_aviation_search_airportsfema_nfhl_summarize_state_inventorygovinfo_legislation_version_lineagefaa_public_aviation_compare_airportsopportunity_zones_lookup_designationopportunity_zones_search_designationsopportunity_zones_compare_jurisdictionsopportunity_zones_summarize_designationsaffordable_housing_refinance_evidence_pack