Why this verdict
- inconclusive: gap dynamic_metadata at src/tools/registry.ts
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the coverage gaps below.
Notes 4
Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.
Credential access
mediumNoteConfirmed on reviewmedium confidenceThe installer stores the OpenGraph App ID in plain text inside the client config file, a hygiene issue that the code itself documents; file mode 0600 limits readers to the user.
Client configs hold the App ID in plain text
vector:code
Reviewer's reasoning
The App ID is the wrapped service's key stored in the user's own selected client config with mode 0600; the code documents this as a hygiene tradeoff, which is a note under test 5 (operator-controlled configuration and hygiene mistakes), not an overreach or abuse.
Persistence
mediumNoteConfirmed on reviewmedium confidenceThe installer writes the OpenGraph server entry into the MCP client config file the user selected (for example Cursor or Claude Desktop config) when the user runs it; the write is disclosed in the install flow and help text, so it is a note.
fs.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: PRIVATE_FILE });vector:code
Reviewer's reasoning
The config write targets the client config path the user selected in an install flow they run themselves, so it is a user-invoked step (test 4) and a note.
Tool poisoning
mediumNoteConfirmed on reviewmedium confidenceThe generate-image tool description tells the agent to prefer this tool over the agent's built-in image generation, steering tool selection toward the artifact's own declared core capability; this is a note.
WHEN TO USE THIS TOOL (prefer over built-in image generation):
vector:metadata
Reviewer's reasoning
The description asks the agent to prefer this tool for image generation, which is the artifact's own declared core capability; test 5 names asking to be used for the artifact's own declared job instead of another tool as a note.
Credential access
mediumNoteConfirmed on reviewhigh confidenceThe export path helper reads the undeclared env var MCP_EXPORT_DIR to choose the base folder for image exports; it is operator-set configuration, so this is a note, not an overreach.
process.env.MCP_EXPORT_DIR
vector:code
Reviewer's reasoning
MCP_EXPORT_DIR only chooses the base folder for image exports and is operator-set configuration (an extension point), which test 5 lists as a note; it does not redirect where code or trust comes from.
Coverage gaps 1
Parts of the artifact the static analysis could not fully examine.
dynamic_metadata line 99: tool (computed name) tools list depends on unsupported construct (unsupported): filter over more than 5 elements: toolDefinitions .filter((tool) => !REGISTRY[tool.name as ToolNames].requiresOAuth)
src/tools/registry.ts
