← Back to search

@opensip-cli/mcp

GitHub Actions Scanned 6d ago

MCP server exposing the OpenSIP call graph and stored results to coding agents over stdio

npm
D
40 / 100

Versions

0.8.5latest
Jul 24, 2026
0.8.4
Jul 22, 2026
0.8.3
Jul 21, 2026
0.8.2
Jul 21, 2026
0.8.1
Jul 20, 2026
+ show 20 moreshow less
0.8.0
Jul 19, 2026
0.7.0
Jul 15, 2026
0.6.0
Jul 13, 2026
0.5.3
Jul 11, 2026
0.5.2
Jul 10, 2026
0.5.1
Jul 10, 2026
0.5.0
Jul 8, 2026
0.4.2
Jul 7, 2026
0.4.1
Jul 7, 2026
0.4.0
Jul 6, 2026
0.3.1
Jul 3, 2026
0.3.0
Jul 3, 2026
0.2.4
Jul 2, 2026
0.2.3
Jul 2, 2026
0.2.1
Jul 2, 2026
0.1.19
Jul 1, 2026
0.1.18
Jun 30, 2026
0.1.17
Jun 30, 2026
0.1.16
Jun 30, 2026
0.1.15
Jun 29, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 13

bad-template
annotations: none low

bad

orphan-tool
annotations: none low

orphan

bad-tool
annotations: none low

bad

toy
annotations: none low

Toy tool gate (ADR-0036 zero-code ratchet proof)

${ctx.toolId}
annotations: none low

Project-local typed tool scaffolded by opensip tools create

gitleaks
annotations: none low

Secret scanning via Gitleaks

plain
annotations: none low

plain tool

hooks
annotations: none low

hooks tool

demo
annotations: none low

bad

worker-only
annotations: none low

worker only

external-dispatch-tool
annotations: none low

fixture

broken
annotations: none low

ext-tool
annotations: none low

ext

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs/promises, open(), path
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 89

low
Tool 'broken' has no annotations annotation_checker · 100%
low
Tool 'gitleaks' has no annotations annotation_checker · 100%
low
Tool 'plain' has no annotations annotation_checker · 100%
low
Tool 'hooks' has no annotations annotation_checker · 100%
low
Tool 'demo' has no annotations annotation_checker · 100%
low
Tool 'worker-only' has no annotations annotation_checker · 100%
low
Tool 'external-dispatch-tool' has no annotations annotation_checker · 100%
low
Tool 'ext-tool' has no annotations annotation_checker · 100%
low
Tool 'orphan-tool' has no annotations annotation_checker · 100%
low
Tool 'bad-tool' has no annotations annotation_checker · 100%
low
Tool 'toy' has no annotations annotation_checker · 100%
low
Tool '${ctx.toolId}' has no annotations annotation_checker · 100%
low
Tool 'bad-template' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 273 direct dependencies dependency_analyzer · 90%
medium
Vulnerable dependency: pytest@8.3.5 (GHSA-6w46-j5rx-g56g) dependency_analyzer · 95%
medium
Vulnerable dependency: pytest@8.3.5 (PYSEC-2026-1845) dependency_analyzer · 95%
medium
Vulnerable dependency: certifi@2022.12.7 (GHSA-248v-346w-9cwc) dependency_analyzer · 95%
medium
Vulnerable dependency: certifi@2022.12.7 (GHSA-xqr8-7jwr-rhp7) dependency_analyzer · 95%
medium
Vulnerable dependency: certifi@2022.12.7 (PYSEC-2023-135) dependency_analyzer · 95%
medium
Vulnerable dependency: certifi@2022.12.7 (PYSEC-2024-230) dependency_analyzer · 95%
medium
Vulnerable dependency: setuptools@65.5.0 (GHSA-5rjg-fvgr-3xxf) dependency_analyzer · 95%
medium
Vulnerable dependency: setuptools@65.5.0 (GHSA-cx63-2mw6-8hw5) dependency_analyzer · 95%
medium
Vulnerable dependency: setuptools@65.5.0 (GHSA-h35f-9h28-mq5c) dependency_analyzer · 95%
medium
Vulnerable dependency: setuptools@65.5.0 (GHSA-r9hx-vwmv-q579) dependency_analyzer · 95%
medium
Vulnerable dependency: setuptools@65.5.0 (PYSEC-2022-43012) dependency_analyzer · 95%
medium
Vulnerable dependency: setuptools@65.5.0 (PYSEC-2025-49) dependency_analyzer · 95%
medium
Vulnerable dependency: setuptools@65.5.0 (PYSEC-2026-1918) dependency_analyzer · 95%
medium
Vulnerable dependency: setuptools@65.5.0 (PYSEC-2026-3447) dependency_analyzer · 95%
medium
Buffer.from base64 in opensip-ai-opensip-cli-83f705d/scripts/lib/registry-integrity-inventory.mjs:142 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/dashboard/src/change-impact/__tests__/catalog-identity-digest-vectors.fixture.ts:12 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/dashboard/src/change-impact/__tests__/catalog-identity-digest-vectors.fixture.ts:16 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/dashboard/src/change-impact/__tests__/catalog-identity-digest-vectors.fixture.ts:20 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/dashboard/src/change-impact/__tests__/catalog-identity-digest-vectors.fixture.ts:24 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/dashboard/src/change-impact/__tests__/catalog-identity-digest-vectors.fixture.ts:28 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/core/src/plugins/__tests__/manifest-loader.test.ts:503 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/core/src/plugins/__tests__/manifest-loader.test.ts:529 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/core/src/plugins/__tests__/manifest-loader.test.ts:530 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/fitness/engine/src/__tests__/fingerprint-parity.test.ts:61 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/fitness/engine/src/__tests__/fingerprint-parity.test.ts:63 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/fitness/engine/src/__tests__/fingerprint-parity.test.ts:65 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/fitness/engine/src/cli/fit/__tests__/result-builders.test.ts:73 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/__tests__/catalog-identity-digest-vectors.fixture.ts:12 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/__tests__/catalog-identity-digest-vectors.fixture.ts:16 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/__tests__/catalog-identity-digest-vectors.fixture.ts:20 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/__tests__/catalog-identity-digest-vectors.fixture.ts:24 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/__tests__/catalog-identity-digest-vectors.fixture.ts:28 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/__tests__/render/opensip-id-derivation.test.ts:39 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/__tests__/render/opensip-id-derivation.test.ts:51 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/__tests__/render/opensip-id-derivation.test.ts:60 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/__tests__/render/opensip-id-derivation.test.ts:124 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/__tests__/render/opensip-id-derivation.test.ts:135 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/__tests__/render/opensip-id-derivation.test.ts:146 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/__tests__/lang-adapter/body-digest.test.ts:56 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/cli/__tests__/impact.test.ts:159 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/graph/engine/src/cli/__tests__/impact.test.ts:160 entropy_analyzer · 70%
medium
Buffer.from base64 in opensip-ai-opensip-cli-83f705d/packages/cli/src/commands/init/authored-state-transaction-materialization.ts:85 entropy_analyzer · 75%
medium
Buffer.from base64 in opensip-ai-opensip-cli-83f705d/packages/cli/src/commands/init/file-classifier.ts:244 entropy_analyzer · 75%
medium
Buffer.from base64 in opensip-ai-opensip-cli-83f705d/packages/cli/src/commands/init/init-authored-plan-snapshot-validation.ts:23 entropy_analyzer · 75%
medium
Buffer.from base64 in opensip-ai-opensip-cli-83f705d/packages/cli/src/commands/init/init-authored-plan-snapshot-validation.ts:72 entropy_analyzer · 75%
medium
Buffer.from base64 in opensip-ai-opensip-cli-83f705d/packages/cli/src/commands/init/init-authored-plan.ts:155 entropy_analyzer · 75%
medium
Buffer.from base64 in opensip-ai-opensip-cli-83f705d/packages/cli/src/commands/init/init-authored-plan-builder.ts:344 entropy_analyzer · 75%
medium
Buffer.from base64 in opensip-ai-opensip-cli-83f705d/packages/cli/src/commands/init/init-authored-plan-builder.ts:351 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in opensip-ai-opensip-cli-83f705d/packages/cli/src/ui/__tests__/views.test.ts:943 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: gitleaks manifest_parser · 75%
info
Tool: plain manifest_parser · 75%
info
Tool: hooks manifest_parser · 75%
info
Tool: demo manifest_parser · 75%
info
Tool: worker-only manifest_parser · 90%
info
Tool: external-dispatch-tool manifest_parser · 90%
info
Tool: broken manifest_parser · 90%
info
Tool: ext-tool manifest_parser · 90%
info
Tool: orphan-tool manifest_parser · 90%
info
Tool: bad-tool manifest_parser · 90%
info
Tool: toy manifest_parser · 90%
info
Tool: ${ctx.toolId} manifest_parser · 75%
info
Tool: bad-template manifest_parser · 75%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (76) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 113 components sbom_generator · 100%
critical
RSA Private Key found in opensip-ai-opensip-cli-83f705d/packages/fitness/checks-universal/src/checks/security/no-hardcoded-secrets.ts secret_scanner · 95%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%