← Back to search

GitHits

githits-com streamable_http Scanned 4d ago

Search public open-source code, documentation, metadata, vulnerabilities, changelogs, and examples.

MCP Registry ↗ npm
D
40 / 100

Versions

0.6.3latest
first seen Jul 21, 2026
0.6.2
first seen Jul 8, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 5

quick_start
annotations: verified low

readOnlyHint true
pkg_vulns
annotations: verified low

format enum target string min_severity string include_withdrawn boolean
readOnlyHint true
pkg_info
annotations: verified low

format enum target string
readOnlyHint true
pkg_changelog
annotations: verified low

limit number format enum target string verbose boolean body_lines number omit_bodies boolean
readOnlyHint true
read
annotations: verified low

readOnlyHint true

Permissions 4

network medium
Server uses network capabilities via: fetch(), urllib
filesystem low
Server uses filesystem capabilities via: fs, fs/promises, os, pathlib, shutil, tempfile
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync(), subprocess
env_vars low
Server uses env_vars capabilities via: os.environ, process.env

Scan Findings 74

info
Tool 'quick_start' annotations are consistent annotation_checker · 80%
info
Tool 'pkg_vulns' annotations are consistent annotation_checker · 80%
info
Tool 'pkg_info' annotations are consistent annotation_checker · 80%
info
Tool 'pkg_changelog' annotations are consistent annotation_checker · 80%
info
Tool 'read' annotations are consistent annotation_checker · 80%
high
Hardcoded OAuth client secret in githits-com-githits-cli-2d18b7d/src/container.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in githits-com-githits-cli-2d18b7d/src/commands/doctor.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in githits-com-githits-cli-2d18b7d/src/commands/login.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in githits-com-githits-cli-2d18b7d/src/commands/login.ts auth_checker · 85%
high
Hardcoded OAuth client secret in githits-com-githits-cli-2d18b7d/src/commands/login.ts auth_checker · 95%
high
Hardcoded OAuth client secret in githits-com-githits-cli-2d18b7d/src/services/locked-auth-storage.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in githits-com-githits-cli-2d18b7d/src/services/auth-service.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in githits-com-githits-cli-2d18b7d/src/services/test-helpers.ts auth_checker · 95%
high
Hardcoded OAuth client ID in githits-com-githits-cli-2d18b7d/src/services/migrating-auth-storage.test.ts auth_checker · 85%
high
Hardcoded OAuth client secret in githits-com-githits-cli-2d18b7d/src/services/auth-storage.test.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: undici@7.30.0 (GHSA-4qv8-2p9j-2685) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.30.0 (GHSA-f72v-6w45-q472) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.30.0 (GHSA-xjj6-f33q-929c) dependency_analyzer · 95%
medium
Vulnerable dependency: zod@4.6.5 (GHSA-mrhx-c7xc-m3w5) dependency_analyzer · 95%
medium
Vulnerable dependency: zod@4.4.3 (GHSA-mrhx-c7xc-m3w5) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.29.0 (GHSA-22jm-h49p-29qw) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.29.0 (GHSA-46jr-4wx8-v453) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.29.0 (GHSA-6prh-2h8m-c8cw) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.29.0 (GHSA-6qxp-vccf-f47h) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.29.0 (GHSA-rvq5-wwqv-78pq) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/github-actions-pinning.test.ts:131 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/scripts/agent-eval-metrics.test.ts:84 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/scripts/agent-eval-suite.test.ts:1558 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/scripts/agent-eval-suite.test.ts:1775 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:4 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:6 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:8 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:10 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:12 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:14 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:16 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:18 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:20 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:22 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:24 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:26 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:28 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:30 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:32 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:34 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:36 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:38 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:40 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:42 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:44 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:46 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:48 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:50 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in githits-com-githits-cli-2d18b7d/src/services/mcp-skill-history.ts:52 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
Tool: quick_start manifest_parser · 85%
info
Tool: pkg_vulns manifest_parser · 85%
info
Tool: pkg_info manifest_parser · 85%
info
Tool: pkg_changelog manifest_parser · 85%
info
Tool: read manifest_parser · 85%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (25) manifest_parser · 80%
medium
Hardcoded OAuth client ID in githits-com-githits-cli-2d18b7d/src/commands/login.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in githits-com-githits-cli-2d18b7d/src/services/migrating-auth-storage.test.ts oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 80%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 27 components sbom_generator · 100%
high
Generic API Key Assignment found in githits-com-githits-cli-2d18b7d/scripts/cli-smoke.ts secret_scanner · 75%
critical
RSA Private Key found in githits-com-githits-cli-2d18b7d/scripts/proxy-node-smoke.mjs secret_scanner · 95%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%