← Back to search

@tankpkg/mcp-server

GitHub Actions Scanned 22d ago

MCP server for Tank - scan and publish AI agent skills from your editor

npm ↗
D
40 / 100

Versions

0.0.0-nightly.20260708.bd0df40latest
Jul 8, 2026
0.0.0-nightly.20260707.fa8ec41
Jul 7, 2026
0.0.0-nightly.20260706.fa8ec41
Jul 6, 2026
0.0.0-nightly.20260705.fa8ec41
Jul 5, 2026
0.0.0-nightly.20260704.fa8ec41
Jul 4, 2026
+ show 177 moreshow less
0.0.0-nightly.20260703.fa8ec41
Jul 3, 2026
0.0.0-nightly.20260702.fa8ec41
Jul 2, 2026
0.0.0-nightly.20260701.fa8ec41
Jul 1, 2026
0.0.0-nightly.20260630.fa8ec41
Jun 30, 2026
0.0.0-nightly.20260629.fa8ec41
Jun 29, 2026
0.0.0-nightly.20260628.fa8ec41
Jun 28, 2026
0.0.0-nightly.20260627.fa8ec41
Jun 27, 2026
0.0.0-nightly.20260626.fa8ec41
Jun 26, 2026
0.0.0-nightly.20260625.fa8ec41
Jun 25, 2026
0.0.0-nightly.20260624.fa8ec41
Jun 24, 2026
0.0.0-nightly.20260623.fa8ec41
Jun 23, 2026
0.0.0-nightly.20260622.fa8ec41
Jun 22, 2026
0.16.5
Jun 22, 2026
0.0.0-nightly.20260622.e240cf0
Jun 22, 2026
0.16.4
Jun 22, 2026
0.0.0-nightly.20260622.ed0176d
Jun 22, 2026
0.0.0-nightly.20260622.610a562
Jun 22, 2026
0.0.0-nightly.20260622.f11d0d6
Jun 22, 2026
0.16.3
Jun 21, 2026
0.0.0-nightly.20260621.dc3a5a5
Jun 21, 2026
0.0.0-nightly.20260621.0a1e122
Jun 21, 2026
0.0.0-nightly.20260621.9f69485
Jun 21, 2026
0.0.0-nightly.20260620.9f69485
Jun 20, 2026
0.0.0-nightly.20260619.9f69485
Jun 19, 2026
0.0.0-nightly.20260618.9f69485
Jun 18, 2026
0.0.0-nightly.20260617.9f69485
Jun 17, 2026
0.0.0-nightly.20260616.9f69485
Jun 16, 2026
0.0.0-nightly.20260615.9f69485
Jun 15, 2026
0.0.0-nightly.20260614.9f69485
Jun 14, 2026
0.0.0-nightly.20260613.9f69485
Jun 13, 2026
0.0.0-nightly.20260612.9f69485
Jun 12, 2026
0.0.0-nightly.20260611.9f69485
Jun 11, 2026
0.0.0-nightly.20260610.9f69485
Jun 10, 2026
0.0.0-nightly.20260609.9f69485
Jun 9, 2026
0.0.0-nightly.20260608.9f69485
Jun 8, 2026
0.0.0-nightly.20260607.9f69485
Jun 7, 2026
0.0.0-nightly.20260606.9f69485
Jun 6, 2026
0.0.0-nightly.20260605.9f69485
Jun 5, 2026
0.0.0-nightly.20260604.9f69485
Jun 4, 2026
0.0.0-nightly.20260603.9f69485
Jun 3, 2026
0.0.0-nightly.20260602.9f69485
Jun 2, 2026
0.0.0-nightly.20260601.9f69485
Jun 1, 2026
0.0.0-nightly.20260531.9f69485
May 31, 2026
0.0.0-nightly.20260530.9f69485
May 30, 2026
0.0.0-nightly.20260529.9f69485
May 29, 2026
0.0.0-nightly.20260528.9f69485
May 28, 2026
0.0.0-nightly.20260527.9f69485
May 27, 2026
0.0.0-nightly.20260526.9f69485
May 26, 2026
0.0.0-nightly.20260525.6157499
May 25, 2026
0.0.0-nightly.20260524.6157499
May 24, 2026
0.16.2
May 23, 2026
0.0.0-nightly.20260523.6157499
May 23, 2026
0.16.1
May 23, 2026
0.0.0-nightly.20260523.d82d3c1
May 23, 2026
0.16.0
May 23, 2026
0.0.0-nightly.20260523.d409644
May 23, 2026
0.0.0-nightly.20260523.7d66448
May 23, 2026
0.0.0-nightly.20260523.30eb33d
May 23, 2026
0.0.0-nightly.20260522.30eb33d
May 22, 2026
0.0.0-nightly.20260521.c067035
May 21, 2026
0.15.8
May 21, 2026
0.0.0-nightly.20260520.c067035
May 20, 2026
0.0.0-nightly.20260520.15ed2dd
May 20, 2026
0.0.0-nightly.20260520.50ea946
May 20, 2026
0.0.0-nightly.20260519.24863b9
May 19, 2026
0.0.0-nightly.20260518.24863b9
May 18, 2026
0.0.0-nightly.20260517.24863b9
May 17, 2026
0.0.0-nightly.20260516.24863b9
May 16, 2026
0.0.0-nightly.20260515.24863b9
May 15, 2026
0.0.0-nightly.20260514.87f16ed
May 14, 2026
0.0.0-nightly.20260513.87f16ed
May 13, 2026
0.15.7
May 12, 2026
0.0.0-nightly.20260512.4186da1
May 12, 2026
0.15.6
May 11, 2026
0.0.0-nightly.20260511.2215afc
May 11, 2026
0.0.0-nightly.20260511.560a6d7
May 11, 2026
0.0.0-nightly.20260510.560a6d7
May 10, 2026
0.0.0-nightly.20260509.560a6d7
May 9, 2026
0.0.0-nightly.20260508.560a6d7
May 8, 2026
0.0.0-nightly.20260507.560a6d7
May 7, 2026
0.0.0-nightly.20260506.560a6d7
May 6, 2026
0.0.0-nightly.20260505.560a6d7
May 5, 2026
0.0.0-nightly.20260504.560a6d7
May 4, 2026
0.0.0-nightly.20260503.560a6d7
May 3, 2026
0.15.5
May 2, 2026
0.0.0-nightly.20260502.9f8f7ff
May 2, 2026
0.0.0-nightly.20260502.4167ed4
May 2, 2026
0.0.0-nightly.20260502.1118493
May 2, 2026
0.15.4
May 1, 2026
0.0.0-nightly.20260501.3e7547e
May 1, 2026
0.15.3
May 1, 2026
0.0.0-nightly.20260501.a0a5515
May 1, 2026
0.15.2
May 1, 2026
0.0.0-nightly.20260501.c3b31ae
May 1, 2026
0.15.1
May 1, 2026
0.0.0-nightly.20260501.85e004b
May 1, 2026
0.0.0-nightly.20260501.4486bf7
May 1, 2026
0.0.0-nightly.20260501.015c507
May 1, 2026
0.0.0-nightly.20260430.015c507
Apr 30, 2026
0.15.0
Apr 29, 2026
0.0.0-nightly.20260429.015c507
Apr 29, 2026
0.0.0-nightly.20260429.a158e1d
Apr 29, 2026
0.0.0-nightly.20260429.ca481a8
Apr 29, 2026
0.0.0-nightly.20260428.ca481a8
Apr 28, 2026
0.0.0-nightly.20260427.38f9ecc
Apr 27, 2026
0.0.0-nightly.20260426.38f9ecc
Apr 26, 2026
0.0.0-nightly.20260425.38f9ecc
Apr 25, 2026
0.0.0-nightly.20260424.38f9ecc
Apr 24, 2026
0.14.4
Apr 23, 2026
0.0.0-nightly.20260423.38f9ecc
Apr 23, 2026
0.0.0-nightly.20260423.47c3dab
Apr 23, 2026
0.0.0-nightly.20260422.47c3dab
Apr 22, 2026
0.0.0-nightly.20260421.47c3dab
Apr 21, 2026
0.14.3
Apr 20, 2026
0.0.0-nightly.20260420.e2d1459
Apr 20, 2026
0.0.0-nightly.20260420.b55782e
Apr 20, 2026
0.14.2
Apr 19, 2026
0.0.0-nightly.20260419.efacc4e
Apr 19, 2026
0.14.1
Apr 19, 2026
0.0.0-nightly.20260419.c3a748c
Apr 19, 2026
0.0.0-nightly.20260419.e1fd51c
Apr 19, 2026
0.0.0-nightly.20260418.e1fd51c
Apr 18, 2026
0.0.0-nightly.20260417.e3e73b5
Apr 17, 2026
0.13.1
Apr 17, 2026
0.0.0-nightly.20260417.d092f19
Apr 17, 2026
0.0.0-nightly.20260417.9e74795
Apr 17, 2026
0.0.0-nightly.20260417.361fb34
Apr 17, 2026
0.13.0
Apr 16, 2026
0.0.0-nightly.20260416.361fb34
Apr 16, 2026
0.0.0-nightly.20260416.2d9a5bf
Apr 16, 2026
0.0.0-nightly.20260416.61373b0
Apr 16, 2026
0.0.0-nightly.20260416.c657a69
Apr 16, 2026
0.0.0-nightly.20260416.d672db7
Apr 16, 2026
0.0.0-nightly.20260416.ff1c580
Apr 16, 2026
0.0.0-nightly.20260416.9bc2c8a
Apr 16, 2026
0.0.0-nightly.20260415.9bc2c8a
Apr 15, 2026
0.0.0-nightly.20260414.24f6130
Apr 14, 2026
0.0.0-nightly.20260414.02c02b2
Apr 14, 2026
0.0.0-nightly.20260413.02c02b2
Apr 13, 2026
0.0.0-nightly.20260413.931ee15
Apr 13, 2026
0.0.0-nightly.20260413.1e0da97
Apr 13, 2026
0.0.0-nightly.20260412.1e0da97
Apr 12, 2026
0.0.0-nightly.20260411.1e0da97
Apr 11, 2026
0.0.0-nightly.20260410.e5efaa5
Apr 10, 2026
0.0.0-nightly.20260409.e5efaa5
Apr 9, 2026
0.0.0-nightly.20260408.d53b2bb
Apr 8, 2026
0.0.0-nightly.20260407.d53b2bb
Apr 7, 2026
0.0.0-nightly.20260407.22e7e7d
Apr 7, 2026
0.0.0-nightly.20260406.298775
Apr 6, 2026
0.0.0-nightly.20260406.ce0dd21
Apr 6, 2026
0.0.0-nightly.20260405.3744721
Apr 5, 2026
0.0.0-nightly.20260404.37142c6
Apr 4, 2026
0.11.0
Apr 3, 2026
0.0.0-nightly.20260403.2666d2a
Apr 3, 2026
0.0.0-nightly.20260403.71fadac
Apr 3, 2026
0.0.0-nightly.20260402.71fadac
Apr 2, 2026
0.0.0-nightly.20260402.37271a4
Apr 2, 2026
0.0.0-nightly.20260402.7539a85
Apr 2, 2026
0.0.0-nightly.20260402.f103b7c
Apr 2, 2026
0.0.0-nightly.20260402.4910951
Apr 2, 2026
0.0.0-nightly.20260402.49863f7
Apr 2, 2026
0.0.0-nightly.20260401.49863f7
Apr 1, 2026
0.10.6
Mar 29, 2026
0.10.5
Mar 28, 2026
0.10.4
Mar 26, 2026
0.10.3
Mar 25, 2026
0.10.2
Mar 24, 2026
0.9.1
Mar 13, 2026
0.9.0
Mar 12, 2026
0.8.1
Mar 12, 2026
0.7.0
Mar 9, 2026
0.6.3
Mar 7, 2026
0.6.2
Mar 7, 2026
0.6.1
Mar 6, 2026
0.6.0
Mar 6, 2026
0.5.0
Mar 5, 2026
0.4.2
Mar 4, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 14

link-skill
annotations: none low

Link an installed skill into an agent workspace. Creates a symlink from the workspace .skills directory to the installed skill.

name string workspace string
audit-skill
annotations: none low

Show security audit results for a skill from the Tank registry.

name string version string
unlink-skill
annotations: none low

Unlink a skill from an agent workspace. Removes the symlink without deleting the installed skill files.

name string workspace string
skill-permissions
annotations: none low

Display resolved permission summary for installed skills. Shows what capabilities each skill requires and checks against the project permission budget.

directory string
skill-info
annotations: none low

Get detailed information about a specific skill from the Tank registry

name string
verify-skills
annotations: none low

Verify that installed skills match their lockfile entries. Checks that skill directories exist and are not empty.

name string directory string
doctor
annotations: none low

Diagnose Tank setup and environment.

whoami
annotations: none low

Show the authenticated Tank user for the current local session.

login
annotations: none low

Authenticate with Tank using GitHub OAuth device flow. Opens browser for authorization.

timeout number
scan-skill
annotations: none low

Scan a skill directory for security issues. Requires authentication.

directory string
logout
annotations: none low

Log out of Tank by clearing local credentials.

update-skill
annotations: none low

Update an installed skill to the latest compatible version within its declared semver range.

name string directory string
publish-skill
annotations: none low

Publish a skill to the Tank registry. Requires authentication.

dryRun boolean directory string
search-skills
annotations: none low

Search the Tank registry for AI agent skills

limit number query string

Permissions 5

network medium
Server uses network capabilities via: fetch(), http, httpx, requests, urllib
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs/promises, open(), os, path, pathlib, shutil, tempfile
shell high
Server uses shell capabilities via: child_process, execSync(), os.popen(), os.system(), spawn(), subprocess
database medium
Server uses database capabilities via: drizzle-orm, psycopg
env_vars low
Server uses env_vars capabilities via: os.environ, os.getenv(), process.env

Scan Findings 192

critical
AWS Access Key ID found in tankpkg-tank-51b0ce1/idd/modules/vault/INTENT.md secret_scanner · 95%
critical
GitHub Personal Access Token found in tankpkg-tank-51b0ce1/idd/modules/vault/INTENT.md secret_scanner · 95%
high
Authorization Bearer Token found in tankpkg-tank-51b0ce1/idd/modules/vault/INTENT.md secret_scanner · 70%
critical
Stripe Key found in tankpkg-tank-51b0ce1/idd/modules/vault/INTENT.md secret_scanner · 90%
critical
Database URL with Password found in tankpkg-tank-51b0ce1/docs/ops/ops-runbooks.md secret_scanner · 85%
high
Hardcoded Password found in tankpkg-tank-51b0ce1/docs/references/playwright-web.md secret_scanner · 65%
critical
Database URL with Password found in tankpkg-tank-51b0ce1/docs/archive/self-hosting/README.md secret_scanner · 85%
high
Hardcoded Password found in tankpkg-tank-51b0ce1/docs/reference/external/playwright-web.md secret_scanner · 65%
critical
RSA Private Key found in tankpkg-tank-51b0ce1/apps/registry/public/llms-full.txt secret_scanner · 95%
critical
Database URL with Password found in tankpkg-tank-51b0ce1/apps/registry/public/llms-full.txt secret_scanner · 85%
critical
Database URL with Password found in tankpkg-tank-51b0ce1/apps/registry/src/screens/setup-wizard-screen.tsx secret_scanner · 85%
critical
Database URL with Password found in tankpkg-tank-51b0ce1/apps/registry/public/docs/self-host-quickstart.md secret_scanner · 85%
critical
RSA Private Key found in tankpkg-tank-51b0ce1/apps/registry/public/docs/security.md secret_scanner · 95%
critical
Database URL with Password found in tankpkg-tank-51b0ce1/apps/registry/public/docs/self-hosting.md secret_scanner · 85%
critical
AWS Access Key ID found in tankpkg-tank-51b0ce1/bdd/steps/system/mcp-proxy-phase-7.steps.ts secret_scanner · 95%
critical
GitHub Personal Access Token found in tankpkg-tank-51b0ce1/bdd/steps/system/mcp-proxy-phase-7.steps.ts secret_scanner · 95%
high
Generic API Key Assignment found in tankpkg-tank-51b0ce1/bdd/steps/system/scanner-stages.steps.ts secret_scanner · 75%
high
Hardcoded Password found in tankpkg-tank-51b0ce1/bdd/steps/system/star.steps.ts secret_scanner · 65%
critical
AWS Access Key ID found in tankpkg-tank-51b0ce1/bdd/features/system/mcp-proxy/resources-prompts.feature secret_scanner · 95%
critical
GitHub Personal Access Token found in tankpkg-tank-51b0ce1/bdd/features/system/mcp-proxy/resources-prompts.feature secret_scanner · 95%
critical
AWS Access Key ID found in tankpkg-tank-51b0ce1/bdd/features/system/mcp-proxy/tool-poisoning.feature secret_scanner · 95%
critical
Stripe Key found in tankpkg-tank-51b0ce1/bdd/features/system/vault/full-flow.feature secret_scanner · 90%
critical
GitHub Personal Access Token found in tankpkg-tank-51b0ce1/bdd/features/system/vault/detector.feature secret_scanner · 95%
critical
GitHub OAuth Token found in tankpkg-tank-51b0ce1/bdd/features/system/vault/detector.feature secret_scanner · 95%
critical
Stripe Key found in tankpkg-tank-51b0ce1/bdd/features/system/vault/detector.feature secret_scanner · 90%
critical
Stripe Key found in tankpkg-tank-51b0ce1/bdd/features/system/vault/runner.feature secret_scanner · 90%
critical
Stripe Key found in tankpkg-tank-51b0ce1/bdd/features/system/vault/proxy.feature secret_scanner · 90%
critical
GitHub Personal Access Token found in tankpkg-tank-51b0ce1/bdd/features/system/vault/tokenizer.feature secret_scanner · 95%
critical
Stripe Key found in tankpkg-tank-51b0ce1/bdd/features/system/vault/tokenizer.feature secret_scanner · 90%
critical
Database URL with Password found in tankpkg-tank-51b0ce1/bdd/features/system/vault/tokenizer.feature secret_scanner · 85%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%
high
Hardcoded API key in tankpkg-tank-51b0ce1/apps/python-api/tests/test_scanner_report_redesign.py auth_checker · 90%
high
Hardcoded API key in tankpkg-tank-51b0ce1/apps/python-api/tests/test_skills/malicious/secrets_hardcoded/config.py auth_checker · 90%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 112 direct dependencies dependency_analyzer · 90%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Suspicious package name: react-markdown dependency_analyzer · 60%
medium
Vulnerable dependency: turbo@2.8.20 (GHSA-3qcw-2rhx-2726) dependency_analyzer · 95%
medium
Vulnerable dependency: turbo@2.8.20 (GHSA-hcf7-66rw-9f5r) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@4.1.0 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@4 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@4 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
medium
Vulnerable dependency: tar@7.5.11 (GHSA-23hp-3jrh-7fpw) dependency_analyzer · 95%
medium
Vulnerable dependency: tar@7.5.11 (GHSA-8x88-c5mf-7j5w) dependency_analyzer · 95%
medium
Vulnerable dependency: tar@7.5.11 (GHSA-gvwx-54wh-qm9j) dependency_analyzer · 95%
medium
Vulnerable dependency: tar@7.5.11 (GHSA-r292-9mhp-454m) dependency_analyzer · 95%
medium
Vulnerable dependency: tar@7.5.11 (GHSA-vmf3-w455-68vh) dependency_analyzer · 95%
medium
Vulnerable dependency: tar@7.5.11 (GHSA-w8wr-v893-vjvp) dependency_analyzer · 95%
medium
Vulnerable dependency: esbuild@0.27.4 (GHSA-g7r4-m6w7-qqqr) dependency_analyzer · 95%
medium
Vulnerable dependency: better-auth@1.5.5 (GHSA-2vg6-77g8-24mp) dependency_analyzer · 95%
medium
Vulnerable dependency: better-auth@1.5.5 (GHSA-392p-2q2v-4372) dependency_analyzer · 95%
medium
Vulnerable dependency: better-auth@1.5.5 (GHSA-7w99-5wm4-3g79) dependency_analyzer · 95%
medium
Vulnerable dependency: better-auth@1.5.5 (GHSA-86j7-9j95-vpqj) dependency_analyzer · 95%
medium
Vulnerable dependency: better-auth@1.5.5 (GHSA-9h47-pqcx-hjr4) dependency_analyzer · 95%
medium
Vulnerable dependency: better-auth@1.5.5 (GHSA-fmh4-wcc4-5jm3) dependency_analyzer · 95%
medium
Vulnerable dependency: better-auth@1.5.5 (GHSA-g38m-r43w-p2q7) dependency_analyzer · 95%
medium
Vulnerable dependency: better-auth@1.5.5 (GHSA-pw9m-5jxm-xr6h) dependency_analyzer · 95%
medium
Vulnerable dependency: better-auth@1.5.5 (GHSA-qq9h-g4jm-xgf3) dependency_analyzer · 95%
medium
Vulnerable dependency: better-auth@1.5.5 (GHSA-wxw3-q3m9-c3jr) dependency_analyzer · 95%
medium
Vulnerable dependency: drizzle-orm@0.45.1 (GHSA-gpj5-g38j-94v9) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-26pp-8wgv-hjvm) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-2gcr-mfcq-wcc3) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-3hrh-pfw6-9m5x) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-458j-xx4x-4375) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-54fx-42gc-7vw4) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-69xw-7hcm-h432) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-79qm-7rj5-m7r9) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-88fw-hqm2-52qc) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-8j4g-w8fx-2239) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-9vqf-7f2p-gf9v) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-crvj-82cr-hjcx) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-f23p-vx2j-j53r) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-f577-qrjj-4474) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-g6gw-c38x-mqfc) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-gqvv-2mrq-wpjv) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-hm8q-7f3q-5f36) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-hvrm-45r6-mjfj) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-j6c9-x7qj-28xf) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-p77w-8qqv-26rm) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-qp7p-654g-cw7p) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-r5rp-j6wh-rvv4) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-rv63-4mwf-qqc2) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-w62v-xxxg-mg59) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-wgpf-jwqj-8h8p) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-wmmm-f939-6g9c) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-wwfh-h76j-fc44) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-xf4j-xp2r-rqqx) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-xgm2-5f3f-mvvc) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-xpcf-pg52-r92g) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.8 (GHSA-xrhx-7g5j-rcj5) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.3 (GHSA-268h-hp4c-crq3) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.3 (GHSA-2x7j-588g-ccc2) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.3 (GHSA-8m3c-c648-2xjj) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.3 (GHSA-c7w3-x93f-qmm8) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.3 (GHSA-cc9r-2j5m-2m83) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.3 (GHSA-p6gq-j5cr-w38f) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.3 (GHSA-r7g4-qg5f-qqm2) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.3 (GHSA-vvjj-xcjg-gr5g) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.3 (GHSA-wmmp-3585-3rmp) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.3 (GHSA-wqvq-jvpq-h66f) dependency_analyzer · 95%
medium
Vulnerable dependency: nitro@3.0.260311-beta (GHSA-5w89-w975-hf9q) dependency_analyzer · 95%
medium
Vulnerable dependency: nitro@3.0.260311-beta (GHSA-9phm-9p8f-hw5m) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.1 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.1 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.1 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.1 (GHSA-v2wj-q39q-566r) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.1 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.0.0 (GHSA-mr82-8j83-vxmv) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.0.0 (PYSEC-2026-1812) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (GHSA-4g5m-c9r5-49xf) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (GHSA-4jcj-7x88-m979) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (GHSA-4xpc-pv4p-pm3w) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (GHSA-5jmr-gcrj-2c9q) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (GHSA-6wvf-77m9-58rm) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (GHSA-7488-6r32-c95q) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (GHSA-hx8v-g79f-8w5f) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (GHSA-qrc4-49gv-mv9m) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (GHSA-r75f-5x8p-qvmc) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (GHSA-v4p8-mg3p-g94g) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (GHSA-wpfp-gwwc-vwq6) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (GHSA-wxxx-gvqv-xp7p) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (GHSA-xqmj-j6mv-4862) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (PYSEC-2026-2598) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (PYSEC-2026-2599) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (PYSEC-2026-2600) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (PYSEC-2026-2601) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (PYSEC-2026-2602) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (PYSEC-2026-3476) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (PYSEC-2026-3477) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (PYSEC-2026-3479) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (PYSEC-2026-3861) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (PYSEC-2026-388) dependency_analyzer · 95%
medium
Vulnerable dependency: litellm@1.83.0 (PYSEC-2026-391) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in tankpkg-tank-51b0ce1/Formula/tank.rb:7 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in tankpkg-tank-51b0ce1/Formula/tank.rb:10 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in tankpkg-tank-51b0ce1/Formula/tank.rb:13 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in tankpkg-tank-51b0ce1/Formula/tank.rb:16 entropy_analyzer · 70%
medium
Buffer.from base64 in tankpkg-tank-51b0ce1/packages/internals-helpers/src/prompt-injection/normalizer.ts:60 entropy_analyzer · 75%
medium
Buffer.from base64 in tankpkg-tank-51b0ce1/apps/registry/src/lib/crypto.ts:23 entropy_analyzer · 75%
medium
High-entropy string (5.81 bits/char) in tankpkg-tank-51b0ce1/apps/python-api/tests/test_stage4_lock_files.py:35 entropy_analyzer · 52%
medium
High-entropy string (5.95 bits/char) in tankpkg-tank-51b0ce1/apps/python-api/tests/test_stage4_lock_files.py:48 entropy_analyzer · 54%
medium
High-entropy string (5.72 bits/char) in tankpkg-tank-51b0ce1/apps/python-api/tests/test_stage4_lock_files.py:114 entropy_analyzer · 50%
high
Long unicode escape chain in tankpkg-tank-51b0ce1/apps/python-api/lib/scan/stage_token.py:708 entropy_analyzer · 80%
medium
Hex string literal (>50 chars) in tankpkg-tank-51b0ce1/bdd/steps/system/upgrade.steps.ts:82 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: link-skill manifest_parser · 70%
info
Tool: audit-skill manifest_parser · 70%
info
Tool: unlink-skill manifest_parser · 70%
info
Tool: skill-permissions manifest_parser · 70%
info
Tool: skill-info manifest_parser · 70%
info
Tool: verify-skills manifest_parser · 70%
info
Tool: doctor manifest_parser · 70%
info
Tool: whoami manifest_parser · 70%
info
Tool: login manifest_parser · 70%
info
Tool: scan-skill manifest_parser · 70%
info
Tool: logout manifest_parser · 70%
info
Tool: update-skill manifest_parser · 70%
info
Tool: publish-skill manifest_parser · 70%
info
Tool: search-skills manifest_parser · 70%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (74) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 90%
low
Tool 'link-skill' has no annotations annotation_checker · 100%
low
Tool 'audit-skill' has no annotations annotation_checker · 100%
low
Tool 'unlink-skill' has no annotations annotation_checker · 100%
low
Tool 'skill-permissions' has no annotations annotation_checker · 100%
low
Tool 'skill-info' has no annotations annotation_checker · 100%
low
Tool 'verify-skills' has no annotations annotation_checker · 100%
low
Tool 'doctor' has no annotations annotation_checker · 100%
low
Tool 'whoami' has no annotations annotation_checker · 100%
low
Tool 'login' has no annotations annotation_checker · 100%
low
Tool 'scan-skill' has no annotations annotation_checker · 100%
low
Tool 'logout' has no annotations annotation_checker · 100%
low
Tool 'update-skill' has no annotations annotation_checker · 100%
low
Tool 'publish-skill' has no annotations annotation_checker · 100%
low
Tool 'search-skills' has no annotations annotation_checker · 100%
high
Permission: shell access detected permission_analyzer · 95%
medium
Permission: database access detected permission_analyzer · 90%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 128 components sbom_generator · 100%
critical
Database URL with Password found in tankpkg-tank-51b0ce1/.env.example.onprem secret_scanner · 85%
critical
Database URL with Password found in tankpkg-tank-51b0ce1/infra/docker-compose.yml secret_scanner · 85%
critical
Database URL with Password found in tankpkg-tank-51b0ce1/infra/docker-compose.production.yml secret_scanner · 85%
critical
Database URL with Password found in tankpkg-tank-51b0ce1/infra/docker-compose.tanstack.yml secret_scanner · 85%
critical
Database URL with Password found in tankpkg-tank-51b0ce1/infra/docker-compose.onprem.yml secret_scanner · 85%
critical
Database URL with Password found in tankpkg-tank-51b0ce1/docs/ops-runbooks.md secret_scanner · 85%
high
Hardcoded Password found in tankpkg-tank-51b0ce1/infra/helm/README.md secret_scanner · 65%
critical
AWS Access Key ID found in tankpkg-tank-51b0ce1/idd/modules/mcp-proxy/INTENT.md secret_scanner · 95%