← Back to search

arc-1

GitHub Actions Scanned 13d ago

ARC-1 — MCP Server for SAP ABAP Systems

npm ↗
D
57.9 / 100

Versions

1.0.0latest
Jul 31, 2026
0.9.27
Jul 13, 2026
0.9.25
Jul 2, 2026
0.9.24
Jul 1, 2026
0.9.23
Jun 29, 2026
+ show 47 moreshow less
0.9.22
Jun 26, 2026
0.9.21
Jun 25, 2026
0.9.20
Jun 22, 2026
0.9.19
Jun 18, 2026
0.9.18
Jun 16, 2026
0.9.17
Jun 15, 2026
0.9.16
Jun 12, 2026
0.9.15
Jun 12, 2026
0.9.14
Jun 11, 2026
0.9.13
Jun 9, 2026
0.9.12
Jun 9, 2026
0.9.11
Jun 5, 2026
0.9.10
Jun 5, 2026
0.9.9
Jun 4, 2026
0.9.8
Jun 1, 2026
0.9.7
May 30, 2026
0.9.6
May 27, 2026
0.9.5
May 11, 2026
0.9.4
May 10, 2026
0.9.3
May 9, 2026
0.9.2
May 8, 2026
0.9.1
May 8, 2026
0.9.0
May 8, 2026
0.8.0
May 6, 2026
0.7.2
May 2, 2026
0.7.1
Apr 27, 2026
0.7.0
Apr 27, 2026
0.6.10
Apr 20, 2026
0.6.9
Apr 17, 2026
0.6.8
Apr 16, 2026
0.6.7
Apr 15, 2026
0.6.6
Apr 14, 2026
0.6.5
Apr 14, 2026
0.6.4
Apr 14, 2026
0.6.3
Apr 14, 2026
0.6.2
Apr 14, 2026
0.6.1
Apr 10, 2026
0.6.0
Apr 8, 2026
0.5.0
Apr 8, 2026
0.4.4
Apr 7, 2026
0.4.3
Apr 7, 2026
0.4.2
Apr 7, 2026
0.4.1
Apr 7, 2026
0.3.0
Apr 1, 2026
0.2.0
Mar 31, 2026
0.1.4
Mar 31, 2026
0.1.0
Mar 31, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 10

Custom_HiddenWrite
annotations: none low

w

schema object
Custom_Echo
annotations: none low

echoes msg + requestId

msg string schema object
Custom_Surface
annotations: none low

reports the gated shape of the ctx surfaces it was handed

schema object
Custom_Interactive
annotations: none low

d

schema object
Custom_NoCap
annotations: none low

d

schema object
Custom_NoServer
annotations: none low

d

schema object
Foo
annotations: none low

Custom_PdEcho
annotations: none low

echo

msg string schema object
Custom_PdWrite
annotations: none low

w

msg string schema object
Custom_PdHf
annotations: none low

echo

msg string schema object

Permissions 4

network medium
Server uses network capabilities via: fetch(), http
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, os, path
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 44

info
Tool: Custom_HiddenWrite manifest_parser · 75%
low
Tool 'Custom_HiddenWrite' has no annotations annotation_checker · 100%
low
Tool 'Custom_Echo' has no annotations annotation_checker · 100%
low
Tool 'Custom_Surface' has no annotations annotation_checker · 100%
low
Tool 'Custom_Interactive' has no annotations annotation_checker · 100%
low
Tool 'Custom_NoCap' has no annotations annotation_checker · 100%
low
Tool 'Custom_NoServer' has no annotations annotation_checker · 100%
low
Tool 'Foo' has no annotations annotation_checker · 100%
low
Tool 'Custom_PdEcho' has no annotations annotation_checker · 100%
low
Tool 'Custom_PdWrite' has no annotations annotation_checker · 100%
low
Tool 'Custom_PdHf' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client ID in arc-mcp-arc-1-1f29817/tests/integration/audit-logging.integration.test.ts auth_checker · 85%
high
Hardcoded OAuth client ID in arc-mcp-arc-1-1f29817/tests/unit/server/http-multi-target-routes.test.ts auth_checker · 85%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Buffer.from base64 in arc-mcp-arc-1-1f29817/src/adt/ddic-xml.ts:612 entropy_analyzer · 75%
medium
Buffer.from base64 in arc-mcp-arc-1-1f29817/src/adt/ddic-xml.ts:629 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: Custom_Echo manifest_parser · 75%
info
Tool: Custom_Surface manifest_parser · 75%
info
Tool: Custom_Interactive manifest_parser · 75%
info
Tool: Custom_NoCap manifest_parser · 75%
info
Tool: Custom_NoServer manifest_parser · 75%
info
Tool: Foo manifest_parser · 75%
info
Tool: Custom_PdEcho manifest_parser · 75%
info
Tool: Custom_PdWrite manifest_parser · 75%
info
Tool: Custom_PdHf manifest_parser · 75%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (122) manifest_parser · 80%
medium
Hardcoded OAuth client ID in arc-mcp-arc-1-1f29817/tests/integration/audit-logging.integration.test.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in arc-mcp-arc-1-1f29817/tests/unit/server/http-multi-target-routes.test.ts oauth_scope_analyzer · 80%
high
Deprecated implicit grant flow in arc-mcp-arc-1-1f29817/src/server/multi-target-destination-runtime.ts oauth_scope_analyzer · 85%
high
High-risk OAuth scope: admin oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 80%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 465 components sbom_generator · 100%
high
Hardcoded Password found in arc-mcp-arc-1-1f29817/docs_page/sap-trial-setup.md secret_scanner · 65%
high
Hardcoded Password found in arc-mcp-arc-1-1f29817/docs_page/enterprise-auth.md secret_scanner · 65%
high
Hardcoded Password found in arc-mcp-arc-1-1f29817/docs/research/2026-04-14-rfc-integration-sap-rfc-lite.md secret_scanner · 65%
high
Hardcoded Password found in arc-mcp-arc-1-1f29817/docs/compare/fr0ster/evaluations/issue-2-env-comments.md secret_scanner · 65%
high
Hardcoded Password found in arc-mcp-arc-1-1f29817/docs/plans/completed/2026-04-28-etag-conditional-get-and-inactive-objects-fix.md secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%