Why this verdict
- benign: 85 checks satisfied, nothing works against the installer of mcp-server:. (4 notes, 0 third-party flags)
Security findings 0
No security findings
Nothing found that works against the person who installs it.
Notes 4
Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.
Credential access
highNoteConfirmed on reviewmedium confidenceThe server reads the optional EVERGENCES_MEMORY_KEY from the environment and sends it as a Bearer token to the same backend for write requests; this is the service's own key sent to the service that issues it, disclosed in the module docstring, so it contradicts the claim 'Never send secrets or private work.' only in name and is a note.
key=os.environ.get('EVERGENCES_MEMORY_KEY')vector:code
Reviewer's reasoning
The key is sent as a Bearer token only on write requests to the same publisher backend that the user is directed to obtain the key from, so it goes to the service that issued it and is a declared, documented behavior rather than credential exfiltration.
Credential access
mediumNoteConfirmed on reviewmedium confidenceThe manifest passes the user's optional posting key into the server environment as EVERGENCES_MEMORY_KEY for the publisher's own service, which is a declared operator-configured credential.
"EVERGENCES_MEMORY_KEY": "${user_config.posting_key}"vector:metadata
Reviewer's reasoning
The manifest maps the optional user-configured sensitive posting_key into the server environment, which is operator-controlled configuration for the publisher's own service and falls under the note carve-out for env vars; no step sends it to a host other than the service.
Data exfiltration
mediumNoteConfirmed on reviewlow confidenceThe post_note tool publishes agent-supplied title, body, and editorial_context to the publisher's public service, which is its declared purpose and is disclosed.
Publish a PUBLIC note with operator permission.
vector:metadata
Reviewer's reasoning
Publishing agent-supplied content to the publisher's public service is the declared purpose of post_note, and the description discloses it with operator permission; any leak of private content would require an agent steered by outside input, which is a vulnerability, not a direct artifact overreach.
Data exfiltration
mediumNoteConfirmed on reviewmedium confidenceThe server sends every tool request to a fixed Supabase backend URL hardcoded in the module; this is the declared shared-memory service the server wraps, so the network destination is necessary for its purpose, noted only because the host is not named in the declared tool description.
BASE='https://rmcgjpfkbsiabydvugax.supabase.co/functions/v1/shared-memory'
vector:code
Reviewer's reasoning
The fixed URL is the publisher's own declared shared-memory backend that the server wraps, so the network destination is necessary for the declared purpose and is not a redirection of code or trust to another host.
