← Back to search

@gaunt-sloth/api

Galvanized-Pukeko Scanned 11d ago

API server for Gaunt Sloth

npm ↗
B
82.2 / 100

Versions

0.2.0latest
Jun 25, 2026
0.1.9
Jun 25, 2026
0.1.8
Jun 11, 2026
0.1.7
Jun 11, 2026
0.1.6
Jun 5, 2026
+ show 8 moreshow less
0.1.5
May 31, 2026
0.1.4
May 30, 2026
0.1.3
May 29, 2026
0.1.2
May 24, 2026
0.1.1
May 5, 2026
0.0.3
Apr 25, 2026
0.0.2
Apr 12, 2026
0.0.1
Mar 26, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 6

whoami
annotations: none low

Return the authenticated identity and its role.

query string
list_my_orders
annotations: none low

List the caller's OWN orders (data-isolated to the authenticated identity).

query string
search_catalog
annotations: none low

Search the product catalog (procurement scope).

query string
list_inventory
annotations: none low

Report the inventory level for a SKU (inventory scope).

sku string
list_all_orders
annotations: none low

List EVERY order across all users (admin-only cross-scope read).

order_id string
delete_order
annotations: none low

Delete an order by id (privileged; admin only).

order_id string

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs sync ops, os, path
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: os.environ, process.env

Scan Findings 32

low
Tool 'whoami' has no annotations annotation_checker · 100%
low
Tool 'list_my_orders' has no annotations annotation_checker · 100%
low
Tool 'search_catalog' has no annotations annotation_checker · 100%
low
Tool 'list_inventory' has no annotations annotation_checker · 100%
low
Tool 'list_all_orders' has no annotations annotation_checker · 100%
low
Tool 'delete_order' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 54 direct dependencies dependency_analyzer · 90%
medium
Buffer.from base64 in pukeko-robotics-gaunt-sloth-8362c51/packages/agent/src/tools/McpResourceTool.ts:41 entropy_analyzer · 75%
medium
Buffer.from base64 in pukeko-robotics-gaunt-sloth-8362c51/packages/review/src/tools/ghReadFileTool.ts:215 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in pukeko-robotics-gaunt-sloth-8362c51/packages/core/spec/debugDumpRedact.spec.ts:388 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in pukeko-robotics-gaunt-sloth-8362c51/packages/core/spec/debugDumpRedact.spec.ts:477 entropy_analyzer · 70%
medium
Buffer.from base64 in pukeko-robotics-gaunt-sloth-8362c51/packages/core/src/utils/binaryOutputUtils.ts:159 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: whoami manifest_parser · 85%
info
Tool: list_my_orders manifest_parser · 85%
info
Tool: search_catalog manifest_parser · 85%
info
Tool: list_inventory manifest_parser · 85%
info
Tool: list_all_orders manifest_parser · 85%
info
Tool: delete_order manifest_parser · 85%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (22) manifest_parser · 80%
medium
OAuth authorization code flow without PKCE oauth_scope_analyzer · 75%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 56 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%
high
Declared package '@gaunt-sloth/api' matches no manifest in the repo identity_guard · 70%