← Back to search

@tuttiai/mcp

tuttiai Scanned 9d ago

MCP bridge voice for Tutti — wrap any MCP server as a Tutti voice

npm ↗
D
40 / 100

Versions

0.1.2latest
May 10, 2026
0.1.1
Apr 16, 2026
0.1.0
Apr 12, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 8

test-voice
annotations: none low

echo
annotations: none low

Echo input text.

send
annotations: none low

Send a token.

leaky
annotations: none low

Throws with a leaked key.

send_email
annotations: none low

send

read_file
annotations: none low

read

noop
annotations: none low

Always returns ok.

remember_fact
annotations: none low

Remember a fact about the user

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs/promises
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 65

low
Tool 'test-voice' has no annotations annotation_checker · 100%
low
Tool 'echo' has no annotations annotation_checker · 100%
low
Tool 'send' has no annotations annotation_checker · 100%
low
Tool 'leaky' has no annotations annotation_checker · 100%
low
Tool 'send_email' has no annotations annotation_checker · 100%
low
Tool 'read_file' has no annotations annotation_checker · 100%
low
Tool 'noop' has no annotations annotation_checker · 100%
low
Tool 'remember_fact' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 101 direct dependencies dependency_analyzer · 90%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: turbo@2.9.5 (GHSA-3qcw-2rhx-2726) dependency_analyzer · 95%
medium
Vulnerable dependency: turbo@2.9.5 (GHSA-hcf7-66rw-9f5r) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@3.2.4 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@6.1.6 (GHSA-2pvr-wf23-7pc7) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@6.1.6 (GHSA-4g3v-8h47-v7g6) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@6.1.6 (GHSA-7pw4-f3q4-r2p2) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@6.1.6 (GHSA-8hv8-536x-4wqp) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@6.1.6 (GHSA-f48w-9m4c-m7f5) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@6.1.6 (GHSA-jrpj-wcv7-9fh9) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@6.1.6 (GHSA-xr5h-phrj-8vxv) dependency_analyzer · 95%
medium
Vulnerable dependency: sharp@0.33.0 (GHSA-f88m-g3jw-g9cj) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-356w-63v5-8wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-4r4m-qw57-chr8) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-vg6x-rcgg-rjx6) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-x574-m823-4x7w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-xcj6-pq6g-qj4x) dependency_analyzer · 95%
medium
Vulnerable dependency: ws@8.17.0 (GHSA-3h5v-q93c-6h6q) dependency_analyzer · 95%
medium
Vulnerable dependency: ws@8.17.0 (GHSA-58qx-3vcg-4xpx) dependency_analyzer · 95%
medium
Vulnerable dependency: ws@8.17.0 (GHSA-96hv-2xvq-fx4p) dependency_analyzer · 95%
medium
Vulnerable dependency: @opentelemetry/core@2.6.1 (GHSA-8988-4f7v-96qf) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.7 (GHSA-268h-hp4c-crq3) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.7 (GHSA-p6gq-j5cr-w38f) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.7 (GHSA-r7g4-qg5f-qqm2) dependency_analyzer · 95%
medium
Vulnerable dependency: nodemailer@8.0.7 (GHSA-wqvq-jvpq-h66f) dependency_analyzer · 95%
medium
Buffer.from base64 in tuttiai-tutti-c1f199e/packages/server/src/routes/realtime-bridge.ts:108 entropy_analyzer · 75%
medium
Buffer.from base64 in tuttiai-tutti-c1f199e/packages/cli/src/commands/publish.ts:232 entropy_analyzer · 75%
medium
Buffer.from base64 in tuttiai-tutti-c1f199e/voices/github/src/tools/get-file-contents.ts:39 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: test-voice manifest_parser · 90%
info
Tool: echo manifest_parser · 90%
info
Tool: send manifest_parser · 90%
info
Tool: leaky manifest_parser · 90%
info
Tool: send_email manifest_parser · 90%
info
Tool: read_file manifest_parser · 90%
info
Tool: noop manifest_parser · 90%
info
Tool: remember_fact manifest_parser · 90%
info
Required env vars (41) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 1468 components sbom_generator · 100%
critical
Database URL with Password found in tuttiai-tutti-c1f199e/docker-compose.yml secret_scanner · 85%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%