CanopiiCanopiiAll serversEnterprise →
io.github.praneeth12098/x402-factory

io.github.praneeth12098/x402-factory v1.0.0

Security Trust Score
Grade A · Strong posture
Tier 1 · Public sourceHigh confidence · 90%
Declared MCP capabilities
ResourcesPrompts

Host io.github.praneeth12098/x402-factory in a governed environment — SSO in front, every tool call attributed and audited.

Reputation0stars0forks1open issues1d agolast commit<1yage

Security controls

Deterministic, evidence-backed. Score earned from passing controls; a failed guard caps it.

Model–MCP Runtime Guardrails

  • Warn
    Strict JSON Schema Enforcementschemas not strict

    Tool inputs are constrained (additionalProperties:false), so unexpected arguments can't be smuggled in.

    Fix: Set additionalProperties:false and require explicit parameters on every tool.

  • Pass
    Indirect Prompt Injection (IPI) Defensesguardno injection markers

    Tool/prompt/resource text is free of hidden instructions that could hijack the agent.

  • Pass
    User-in-the-Loop / Approval Scopeguardno destructive tool scope

    No over-broad or destructive tools (arbitrary shell, bulk-delete) that warrant human approval.

  • N/A
    Tool Definition Integrityguardno prior version to diff

    Every consecutive version pair is diffed for new injection markers or destructive scope — a risky diff anywhere in history is a rug-pull (fail, durable); benign description drift warns.

Application Security Checks

  • Warn
    Dependencies pinned (lockfile)no lockfile found

    A lockfile makes installs reproducible and resistant to silent dependency swaps.

    Fix: Commit a lockfile (package-lock.json / pnpm-lock.yaml / poetry.lock).

  • Warn
    Has a security policyno security policy

    A SECURITY.md gives a private path to report vulnerabilities.

    Fix: Add SECURITY.md with a disclosure contact and process.

  • Warn
    Adoption & popularitylimited adoption

    A small, capped nudge from stars/downloads — widely-used servers get more eyes on bugs. It can never offset a real security failure.

    Fix: Adoption grows naturally with real-world use; this never gates the score.

  • Pass
    No command-injection sinksguardno sinks found

    Untrusted tool input reaching a shell yields remote code execution.

  • Pass
    No dynamic code executionguardno sinks found

    eval()/exec()/Function() on tool-derived strings allows arbitrary code execution.

  • Pass
    No path traversalguardno sinks found

    Naive path checks let tools read/write outside intended directories (EscapeRoute-class).

  • Pass
    No SSRF sinksguardno sinks found

    Fetching tool-supplied URLs can pivot into internal networks and metadata services.

  • Pass
    No unsafe deserializationguardno sinks found

    pickle/yaml.load/etc. on untrusted data can execute code.

  • Pass
    No committed secretsguardno secrets found

    Hardcoded keys/tokens in published source are live credentials an attacker can use.

  • Pass
    Credentials sourced from environmentreads credentials from environment

    Reading secrets from env/secret stores avoids hardcoding them.

  • Pass
    Actively maintainedrecent commits

    Unmaintained servers don't receive security fixes.

  • Pass
    Repository not archivedguardactive

    Archived repositories will never be patched.

  • Pass
    Declares a licenseMIT

    A clear license is required for legal enterprise use.

  • Not checked
    No known-vulnerable dependenciesno lockfile found

    Runtime dependencies (parsed from the lockfile) are scanned against OSV.dev for published CVEs. Advisory: flagged dependencies lower the score but don't hard-cap it, since transitive reachability is unproven.

  • Not checked
    Signed releasesnot evaluated

    Signed releases let consumers verify artifacts weren't tampered with.

  • N/A
    No install/post-install scriptsguardno published package

    install hooks run arbitrary code on every consumer at install time.

  • N/A
    Package name not typosquattingguardno published package

    Names mimicking popular packages are a common malware delivery vector.

  • N/A
    Published with provenanceno published package

    Build provenance attests the artifact was built from the claimed source by CI.

  • N/A
    Established maintainerno published package

    Brand-new / single anonymous maintainers raise takeover and malware risk.

Transport & Trust Model

  • Warn
    IAM / Authentication Scopingno authentication handling detected

    OAuth 2.1 / Protected Resource Metadata gates who can invoke tools.

    Fix: Implement OAuth 2.1 with a .well-known/oauth-protected-resource document.

  • Warn
    Execution Sandboxingruns natively (no container image)

    A container/sandbox image limits blast radius; a server that runs natively has full host access.

    Fix: Ship a Dockerfile/Containerfile (or document a sandboxed run) so the server runs isolated.

  • Pass
    Transport Encryption (TLS)guardall remotes use HTTPS

    Plaintext HTTP exposes traffic and bearer tokens to interception.

  • Pass
    Network Exposureno bind-all detected

    Binding 0.0.0.0 or exposing debug inspectors widens the attack surface.

  • N/A
    Live Endpoint Reachablenot dynamically scanned

    A dynamic scan connected to the declared remote endpoint and it responded — verified live, not a dead URL.

  • N/A
    Authentication Enforced (live)not dynamically scanned

    If the server declares auth is required, it must actually reject anonymous clients. Serving tools to unauthenticated callers is a real exposure.

Tools (219)

core_pingecon_seriesedge_detailgov_recallsecon_calendaredge_backtestecon_dashboardecon_series_cpiprobability_getedge_calibrationgov_edgar-eventsgov_recalls_druggov_recalls_foodgov_edgar-insidergov_recalls_deltagov_edgar-13f-diffgov_recalls_deviceprobability_moversprobability_searchgov_recalls_changesgov_recalls_vehicleprobability_historyweather_alerts_heatecon_dashboard_deltaecon_series_core-cpiecon_series_core-pceecon_series_payrollsedge_weather-marketsgov_contracts-awardsgov_recalls_consumerprobability_calendarweather_alerts_floodweather_aviation_atlweather_aviation_bosweather_aviation_cltweather_aviation_denweather_aviation_dfwweather_aviation_dtwweather_aviation_ewrweather_aviation_fllweather_aviation_iahweather_aviation_jfkweather_aviation_lasweather_aviation_laxweather_aviation_lgaweather_aviation_mcoweather_aviation_miaweather_aviation_mspweather_aviation_ordweather_aviation_phxweather_aviation_seaweather_aviation_sfoweather_forecast_nycecon_series_fed-fundsgov_edgar-watch_deltaprobability_board_fedprobability_liquidityweather_alerts-severeweather_alerts_winterweather_energy-regionecon_dashboard_changesecon_series_gdp-growthgov_edgar-events_deltaprobability_movers_fedprobability_resolutionweather_alerts_tornadoweather_forecast-pointweather_forecast_miamiecon_series_treasury-2ygov_edgar-events_reg-fdgov_edgar-watch_changesprobability_board_deltaprobability_get-delayedweather_forecast-windowweather_forecast_austinweather_forecast_bostonweather_forecast_dallasweather_forecast_denverecon_series_retail-salesecon_series_treasury-10yecon_series_unemploymentgov_edgar-events_changesgov_edgar-events_resultsgov_edgar-filings-searchprobability_board_cryptoprobability_calendar_fedprobability_movers_deltaprobability_odds-compareweather_alerts_hurricaneweather_forecast_atlantaweather_forecast_chicagoweather_forecast_detroitweather_forecast_houstonweather_forecast_phoenixweather_forecast_seattleecon_series_pce-inflationprobability_board_changesprobability_board_climateprobability_movers_cryptoweather_forecast_portlandweather_forecast_san-joseecon_series_housing-startsecon_series_initial-claimsgov_contracts-awards_deltaprobability_calendar_deltaprobability_movers-delayedprobability_movers_changesprobability_movers_climateweather_forecast_charlotteweather_forecast_las-vegasweather_forecast_nashvilleweather_forecast_san-diegoweather_verification-tablegov_edgar-events_bankruptcyprobability_board_economicsprobability_calendar_cryptoweather_alerts_fire-weatherweather_aviation-delay-riskweather_forecast-window_nycweather_verification-scoresecon_series_building-permitsedge_weather-markets-delayedgov_contracts-awards_changesgov_edgar-events_restatementprobability_board_sports-mlbprobability_board_sports-nbaprobability_board_sports-nflprobability_calendar_changesprobability_calendar_climateprobability_movers_economicsweather_forecast_los-angelesweather_forecast_minneapolisweather_forecast_san-antonioweather_verification-stationgov_edgar-events_acquisitionsgov_edgar-events_other-eventsprobability_board_politics-usprobability_movers_sports-mlbprobability_movers_sports-nbaprobability_movers_sports-nflprobability_venue-calibrationweather_forecast-window_miamiweather_forecast_jacksonvilleweather_forecast_philadelphiaprobability_board_science-techprobability_calendar_economicsprobability_movers_politics-usweather_forecast-probabilisticweather_forecast-window_austinweather_forecast-window_bostonweather_forecast-window_dallasweather_forecast-window_denverweather_forecast_san-franciscoweather_forecast_washington-dcedge_climate-events-probabilityprobability_board_entertainmentprobability_board_sports-soccerprobability_calendar_sports-mlbprobability_calendar_sports-nbaprobability_calendar_sports-nflprobability_movers_science-techweather_forecast-window_atlantaweather_forecast-window_chicagoweather_forecast-window_detroitweather_forecast-window_houstonweather_forecast-window_phoenixweather_forecast-window_seattleprobability_board_politics-worldprobability_calendar_politics-usprobability_movers_entertainmentprobability_movers_sports-soccerweather_forecast-window_portlandweather_forecast-window_san-joseprobability_calendar_science-techprobability_movers_politics-worldweather_forecast-window_charlotteweather_forecast-window_las-vegasweather_forecast-window_nashvilleweather_forecast-window_san-diegogov_edgar-events_leadership-changeprobability_calendar_entertainmentprobability_calendar_sports-soccergov_edgar-events_material-agreementprobability_calendar_politics-worldweather_forecast-window_los-angelesweather_forecast-window_minneapolisweather_forecast-window_san-antonioprobability_cross-venue-disagreementprobability_venue-calibration-detailweather_forecast-window_jacksonvilleweather_forecast-window_philadelphiaweather_forecast-window_san-franciscoweather_forecast-window_washington-dcprobability_evergreen_eth-above-5k-eoyprobability_evergreen_superbowl-winnerprobability_evergreen_nba-finals-winnerprobability_evergreen_btc-above-100k-eoyprobability_evergreen_next-fomc-dot-shiftprobability_evergreen_oscars-best-pictureprobability_evergreen_world-series-winnerprobability_evergreen_fed-next-meeting-cutprobability_evergreen_fed-next-meeting-hikeprobability_evergreen_opec-cut-next-meetingprobability_cross-venue-disagreement-delayedprobability_evergreen_us-recession-this-yearprobability_evergreen_next-gdp-print-positiveprobability_evergreen_time-person-of-the-yearprobability_evergreen_next-cpi-above-consensusprobability_evergreen_next-nfp-above-consensusprobability_evergreen_sp500-positive-this-yearprobability_evergreen_fed-chair-change-this-yearprobability_evergreen_house-control-next-electionprobability_evergreen_senate-control-next-electionprobability_evergreen_next-hurricane-cat3-us-landfallprobability_evergreen_government-shutdown-this-quarterprobability_evergreen_atlantic-named-storms-above-normalprobability_evergreen_presidential-election-winner-partyprobability_evergreen_us-china-tariff-change-this-quarterprobability_evergreen_major-ai-regulation-federal-law-this-year
io.github.praneeth12098/x402-factory v1.0.0 — 90/100 · Canopii Trust Index