← Back to search Server uses network capabilities via: fetch(), urllib Server uses filesystem capabilities via: fs, fs.promises, fs/promises, path Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync() Server uses env_vars capabilities via: process.env
@modelstat/mcp
MCP server for modelstat — ask any MCP-compatible AI tool about your token spend.
? Not scanned yet
Versions
0.6.0latestJun 27, 2026
0.5.0Jun 27, 2026
0.4.2Jun 27, 2026
0.4.1Jun 27, 2026
0.4.0Jun 24, 2026
+ show 9 moreshow less
0.3.0Jun 23, 2026
0.2.0Jun 23, 2026
0.1.3Jun 23, 2026
0.1.2Jun 22, 2026
0.1.1Jun 22, 2026
0.1.0Jun 21, 2026
0.0.3Jun 20, 2026
0.0.2Jun 12, 2026
0.0.1Apr 18, 2026
Tools 0
No tools indexed yet.
Permissions 4
network medium filesystem low shell high env_vars low Scan Findings 62
medium
OAuth implementation without PKCE
info
Sandbox failed to start for behavioral verification
medium
Suspicious package name: react-dom
medium
Vulnerable dependency: turbo@2.3.3 (GHSA-3qcw-2rhx-2726)
medium
Vulnerable dependency: turbo@2.3.3 (GHSA-hcf7-66rw-9f5r)
medium
Vulnerable dependency: vite@6.0.7 (GHSA-356w-63v5-8wf4)
medium
Vulnerable dependency: vite@6.0.7 (GHSA-4r4m-qw57-chr8)
medium
Vulnerable dependency: vite@6.0.7 (GHSA-4w7w-66w2-5vf9)
medium
Vulnerable dependency: vite@6.0.7 (GHSA-859w-5945-r5v3)
medium
Vulnerable dependency: vite@6.0.7 (GHSA-93m4-6634-74q7)
medium
Vulnerable dependency: vite@6.0.7 (GHSA-fx2h-pf6j-xcff)
medium
Vulnerable dependency: vite@6.0.7 (GHSA-g4jq-h2w9-997c)
medium
Vulnerable dependency: vite@6.0.7 (GHSA-jqfw-vq24-v9c3)
medium
Vulnerable dependency: vite@6.0.7 (GHSA-p9ff-h696-f583)
medium
Vulnerable dependency: vite@6.0.7 (GHSA-v6wh-96g9-6wx3)
medium
Vulnerable dependency: vite@6.0.7 (GHSA-vg6x-rcgg-rjx6)
medium
Vulnerable dependency: vite@6.0.7 (GHSA-x574-m823-4x7w)
medium
Vulnerable dependency: vite@6.0.7 (GHSA-xcj6-pq6g-qj4x)
medium
Vulnerable dependency: vitest@2.1.8 (GHSA-5xrq-8626-4rwp)
medium
Vulnerable dependency: vitest@2.1.8 (GHSA-9crc-q9x8-hgqq)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-2mjp-6q6p-2qxm)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-35p6-xmwp-9g52)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-4992-7rv2-5pvq)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-4cwx-7wf7-3272)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-8xcm-r25x-g524)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-c76h-2ccp-4975)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-cxrh-j4jr-qwg3)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-f269-vfmq-vjvj)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-g8m3-5g58-fq7m)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-g9mf-h72j-4rw9)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-jr45-8vmc-qm54)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-m8rv-5g2x-5cg5)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-p88m-4jfj-68fv)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-pr7r-676h-xcf6)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-v3r7-h72x-cjcm)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-v9p9-hfj2-hcw8)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-vrm6-8vpv-qv8q)
medium
Vulnerable dependency: undici@7.1.0 (GHSA-vxpw-j846-p89q)
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.0.0 (GHSA-w48q-cv73-mx4w)
medium
Vulnerable dependency: esbuild@0.24.0 (GHSA-67mh-4wv8-2f99)
medium
Hex string literal (>50 chars) in modelstat-modelstat-acc1ae9/daemon/scripts/fixtures/gen-wire.mts:128
medium
Hex string literal (>50 chars) in modelstat-modelstat-acc1ae9/daemon/packaging/homebrew/modelstat.rb:16
medium
Hex string literal (>50 chars) in modelstat-modelstat-acc1ae9/daemon/packaging/homebrew/modelstat.rb:20
medium
Hex string literal (>50 chars) in modelstat-modelstat-acc1ae9/daemon/packaging/homebrew/modelstat.rb:27
medium
Hex string literal (>50 chars) in modelstat-modelstat-acc1ae9/daemon/packaging/homebrew/modelstat.rb:31
info
package.json metadata
info
pyproject.toml metadata
info
Transport: stdio
info
Required env vars (26)
info
Sandbox failed to start for output poisoning scan
medium
Permission: network access detected
low
Permission: filesystem access detected
high
Permission: shell access detected
low
Permission: env_vars access detected
info
SBOM generated: 44 components
critical
AWS Access Key ID found in modelstat-modelstat-acc1ae9/sdks/rust/src/capture.rs
critical
GitHub Personal Access Token found in modelstat-modelstat-acc1ae9/sdks/rust/src/redact.rs
high
Slack Token found in modelstat-modelstat-acc1ae9/sdks/rust/src/redact.rs
critical
Stripe Key found in modelstat-modelstat-acc1ae9/sdks/rust/src/redact.rs
critical
Database URL with Password found in modelstat-modelstat-acc1ae9/sdks/rust/src/redact.rs
critical
Stripe Key found in modelstat-modelstat-acc1ae9/daemon/crates/modelstat-parsers/src/tool_action/executable.rs
medium
No build provenance detected (SLSA L0)