Why this verdict
- inconclusive: gap no_tools_extracted at server.json
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the coverage gaps below; 2 candidate findings were refuted on review.
Refuted findings 2
Candidates the review stage examined and rejected, kept for transparency.
Reconnaissance
lowRefutedlow confidenceThe probe_endpoint tool sends JSON-RPC POST requests to any caller-supplied http(s) URL with no host restriction, so it could be used to reach internal or metadata hosts (SSRF); this is the declared 'probe ANY endpoint' capability, so it is a contextual risk, not concealed behavior.
const url = String(args.url || "").trim();
Why it was refuted
The probe_endpoint tool's arbitrary-URL probing is its openly declared core capability (diagnose ANY EVM JSON-RPC endpoint), disclosed in tool metadata and the manifest. It sends only JSON-RPC POSTs to a caller-supplied URL, with no concealed behavior or exfiltration. The SSRF concern is a generic capability risk, not an undeclared one.
Reconnaissance
lowRefutedlow confidenceThe declared probe_endpoint tool accepts any caller-supplied http(s) URL, JSON-RPC method and params, so an agent could use it to send requests to arbitrary hosts, including internal or localhost services; this is disclosed and matches the diagnostic purpose, so it is only a capability risk.
Diagnose any EVM JSON-RPC endpoint: chain identity, height, archive capability, latency.
Why it was refuted
The manifest accurately declares that probe_endpoint diagnoses any EVM JSON-RPC endpoint; this is the declared core capability, with no hidden behavior and no instruction directing the agent to target internal hosts.
Coverage gaps 1
Parts of the artifact the static analysis could not fully examine.
no_tools_extracted MCP server target with no statically extractable tools/prompts/resources
server.json
