Why this verdict
- inconclusive: gap dynamic_metadata at pacs008_mcp/_mcp_compat.py
- inconclusive: gap dynamic_metadata at pacs008_mcp/server.py
- inconclusive: gap no_dataflow_for_dynamic_code at pacs008_mcp/_mcp_compat.py
- inconclusive: gap no_tools_extracted at pyproject.toml
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the coverage gaps below.
Notes 2
Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.
Credential access
mediumNoteConfirmed on reviewlow confidenceThe tool reads the PACS008_BIC_DIRECTORY_URL environment variable as an operator-set endpoint for the declared online lookup; this is operator-controlled configuration and is documented in the tool docstring, so it is a note.
os.environ.get(_BIC_DIRECTORY_URL_ENV)
vector:code
Reviewer's reasoning
The environment variable is operator-set configuration that the tool docstring and parameter description declare as the optional endpoint source, so this is test 5 operator-controlled configuration and not an overreach.
Data exfiltration
mediumNoteConfirmed on reviewmedium confidenceThe verify_bic_online tool sends the BIC being checked as a query parameter to a directory endpoint that the caller supplies or the operator configures; this is the disclosed, declared online-enrichment feature, so it is a note.
httpx.get(endpoint, params={"bic": bic_clean}, timeout=10.0)vector:code
Reviewer's reasoning
The BIC is sent only to a directory endpoint the caller supplies or the operator configures, as the declared read-only lookup; a harmful destination requires an attacker to steer the agent, which is test 3, and a BIC is not a credential.
Coverage gaps 7
Parts of the artifact the static analysis could not fully examine.
dynamic_metadata line 1138: tool (computed name) registration depends on unsupported construct (unsupported): server object server handed to _cli.serve(): tools may be registered out of sight
pacs008_mcp/server.py
dynamic_metadata line 73: tool (computed name) registered callable depends on unsupported construct (unsupported): module object is handed to other code
pacs008_mcp/_mcp_compat.py
dynamic_metadata line 73: resource (computed name) registered callable depends on unsupported construct (unsupported): module object is handed to other code
pacs008_mcp/_mcp_compat.py
dynamic_metadata line 73: prompt (computed name) registered callable depends on unsupported construct (unsupported): module object is handed to other code
pacs008_mcp/_mcp_compat.py
no_tools_extracted MCP server target with no statically extractable tools/prompts/resources
pyproject.toml
no_dataflow_for_dynamic_code line 73: invoked code is not structurally extracted
pacs008_mcp/_mcp_compat.py
no_dataflow_for_dynamic_code line 96: invoked code is not structurally extracted
pacs008_mcp/_mcp_compat.py
