{"heads":[{"fingerprint":"sxf1_ceacc357115421177295dd5b183871b3192c17b132ff7cee88f6fb89f0b0f01b","state":"flagged","severity":3,"tier":"C","name":"@surex/mal-tool-shadow","enforceAfter":1785274082357,"reviewedCommit":"4a1c6bf62eb2e38159dadf2fe58852cd6217074c","reviewedAt":"2026-07-25T21:28:02.357Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-6","capabilities":{"network":{"present":true,"evidence":["src/tools/read-file.mjs:84 fetch()"],"evidenceTotal":1},"filesystem":{"present":true,"evidence":["src/safety.mjs:20 import 'node:fs'","src/safety.mjs:141 mkdirSync()","src/safety.mjs:141 fs.mkdirSync()","src/safety.mjs:142 existsSync()","src/safety.mjs:142 fs.existsSync()","src/safety.mjs:143 writeFileSync()","src/safety.mjs:143 fs.writeFileSync()","src/safety.mjs:146 mkdirSync()","src/safety.mjs:146 fs.mkdirSync()","src/safety.mjs:147 existsSync()","src/safety.mjs:147 fs.existsSync()","src/safety.mjs:148 writeFileSync()"],"evidenceTotal":25},"exec":{"present":false,"evidence":[],"evidenceTotal":0},"env":{"present":true,"evidence":["src/safety.mjs:49 process.env","src/safety.mjs:54 process.env","src/tools/read-file.mjs:77 process.env"],"evidenceTotal":3},"credentials":{"present":true,"evidence":["src/safety.mjs:31 ssh key material","src/tools/read-file.mjs:75 aws credentials","src/tools/read-file.mjs:75 credential-shaped variable"],"evidenceTotal":3}},"topFinding":{"file":"src/safety.mjs","line":48,"category":"undeclared-kill-switch-check","description":"The armed() function checks SUREX_FIXTURE_ARM environment variable to decide whether to exfiltrate data, but this activation mechanism is not mentioned in the tool descriptions.","severity":2,"runs":1},"evidence":{"blobId":"YS3OYNMl6KpCyVWv4o0w_1PX0HyaEQzA3bIYm8sGeTQ","suiObjectId":"0x4eceb5387a6f62aa670580ae2fdadd43b31f2a400025756ebd77d009e63fc644","encodingType":"RS2","contentSha256":"d6067c04683a074c85db3d3cf4a1e3a63baacb2dab4f69aa505afadff1ae56f0"},"arkivEntityKey":"0x03140e70877eb198d6770feee6a450eb5d58d75a35909a756245b0d26cfb3061","updatedAt":"2026-07-25T21:28:02.358Z"},{"fingerprint":"sxf1_11a746c536a3a8c1d2f3a2d0b5e18d175edb47b03a3f600e4c68e79847166767","state":"flagged","severity":2,"tier":"A","name":"ios-simulator-mcp","enforceAfter":1785311290454,"reviewedCommit":"8f3c6710bf0d247b2389e1cc883ff78c57672960","reviewedAt":"2026-07-26T07:48:31.101Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-7","integrity":"sha512-IwueCMUZDwu8XtKZWFQxfHIdzSgf07WgbaHLUOG/BZTuBcAzgDcspjWulUxiCNep7lgv/1cz/cRUfD48zi6ayA==","capabilities":{"network":{"present":false,"evidence":[],"evidenceTotal":0},"filesystem":{"present":true,"evidence":["package.json:18 import 'fs'","build/index.js:15 import 'fs'","build/index.js:68 existsSync()","build/index.js:537 readFileSync()","build/index.js:540 unlinkSync()","build/index.js:541 unlinkSync()","build/index.js:816 existsSync()","build/index.js:914 rmSync()"],"evidenceTotal":8},"exec":{"present":true,"evidence":["build/index.js:10 import 'child_process'"],"evidenceTotal":1},"env":{"present":true,"evidence":["build/index.js:44 process.env","build/index.js:45 process.env","build/index.js:61 process.env","build/index.js:85 process.env","build/index.js:584 process.env"],"evidenceTotal":5},"credentials":{"present":false,"evidence":[],"evidenceTotal":0}},"topFinding":{"severity":2,"category":"undeclared-behaviour","file":"build/index.js","line":41,"description":"Creates a temporary directory in the system temp folder (via mkdtempSync) at startup, but this is not mentioned in any tool description or README."},"concern":"undeclared-behaviour","assessment":"The code implements several environment variable overrides (IDB path, output directory, tool filtering) that are not documented in the README. It also creates a temporary directory at startup for internal use. These behaviors are bounded to the server's operation and do not expose user data externally, but they are undeclared.","findingCount":7,"evidence":{"blobId":"Lom0vn3ZrNikcIalIXWchSh1snYqXypzmXhjk9vez1Q","suiObjectId":"0x36c548c26e426feeefb33b5f82d68fbccf6f44bc62a5ab5a71d6a8b5a7aae48f","encodingType":"RS2","contentSha256":"ccd892a21d4b41b6ffb32ad527ba8d8ca091cbe1bc286ff335308fbb2046a1b5"},"arkivEntityKey":"0x5ba4917c2f566529274a7023169a870ef6c9a44d8af33fe181210dfc4108247f","updatedAt":"2026-07-26T07:48:31.101Z"},{"fingerprint":"sxf1_fc483b1b6082b5ffc0a7b5d1895fac4ea2ab1e22a6ade63ceb16d128a9b6de3a","state":"flagged","severity":2,"tier":"A","name":"AgentDeskAI/browser-tools-mcp","enforceAfter":1785308487018,"reviewedCommit":"847c101ed3260c843391f276b118eb3e6cb8875c","reviewedAt":"2026-07-26T07:01:43.970Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-7","integrity":"git:847c101ed3260c843391f276b118eb3e6cb8875c","capabilities":{"network":{"present":false,"evidence":[],"evidenceTotal":0},"filesystem":{"present":false,"evidence":[],"evidenceTotal":0},"exec":{"present":false,"evidence":[],"evidenceTotal":0},"env":{"present":false,"evidence":[],"evidenceTotal":0},"credentials":{"present":false,"evidence":[],"evidenceTotal":0}},"topFinding":{"severity":3,"category":"undeclared-behaviour","file":"browser-tools-server/lighthouse/index.ts","line":72,"description":"The connectToHeadlessBrowser function (imported but not provided in source) is called to establish a browser connection before running audits. Since this function's implementation is missing, its behaviour — including whether it downloads or launches Chrome/Edge binaries — cannot be verified."},"concern":"undeclared-behaviour","assessment":"The code executes the lighthouse library at runtime, which is not reviewed source, and relies on an unprovided connectToHeadlessBrowser function whose implementation determines whether Chrome binaries are launched or downloaded. Additionally, Best Practices audits are implemented despite being marked as 'Not yet implemented' in types.ts.","findingCount":7,"evidence":{"blobId":"9MpeQZqo1U7JVUlf1UgMXE6AdThM6jFOexpZJBNCZE0","suiObjectId":"0x11126b5ede9ec3bc5a8348b205b82ce386392b46fb0a3eb33bce324e846dc555","encodingType":"RS2","contentSha256":"e4e1e23320153d7e72e43b526b4b5e179827b31c12c59249b27ed60c6267bd90"},"arkivEntityKey":"0x3f2bba189ca513ca52b8708ce002faf09311968a0d1d66b70d7611704ecb09b9","updatedAt":"2026-07-26T07:01:43.970Z"},{"fingerprint":"sxf1_e15b3ddbdf0ad55b6e65c2a0c164618b0c07e6f9b3cad2e3445e7e044b2e0ad8","state":"flagged","severity":2,"tier":"A","name":"mcp-medellin-news","enforceAfter":1785296802920,"reviewedCommit":"b043470733f0549cf416c3e1c412f54f8d9c3afa","reviewedAt":"2026-07-26T03:46:59.920Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-7","integrity":"git:b043470733f0549cf416c3e1c412f54f8d9c3afa","capabilities":{"network":{"present":true,"evidence":["src/tools/fetchTelegram.ts:24 fetch()","src/tools/fetchSIATA.ts:21 fetch()","playground/server.ts:74 fetch()"],"evidenceTotal":3},"filesystem":{"present":false,"evidence":[],"evidenceTotal":0},"exec":{"present":false,"evidence":[],"evidenceTotal":0},"env":{"present":true,"evidence":["src/tools/fetchTelegram.ts:12 process.env"],"evidenceTotal":1},"credentials":{"present":true,"evidence":["src/tools/fetchTelegram.ts:12 credential-shaped variable","src/tools/fetchTelegram.ts:17 credential-shaped variable"],"evidenceTotal":2}},"topFinding":{"severity":2,"category":"data-leaves-the-machine","file":"playground/server.ts","line":74,"description":"The playground/server.ts file fetches SIATA data from https://siata.gov.co/EntregaData1/Datos_SIATA_Aire_pm25.json and serves it via a local Express proxy. This is not declared in the README or tool descriptions, and exposes an additional network endpoint beyond those listed."},"concern":"does-not-do-what-it-claims","assessment":"The actual MCP server implementation in src/server/index.ts defines only get_news and get_all_news tools with different parameters than described, while the main entry point src/index.ts implements the declared tools but is not used by the server command. Additionally, the playground includes an undeclared proxy server that fetches external data.","findingCount":3,"evidence":{"blobId":"l82W-8-oDTaQVzK9P1fTLVjDfcat5Gg5w94HFClZ-Xw","suiObjectId":"0xf1486ff23e8280abbb90d3033039693e09328af45c8adca0789e766623080372","encodingType":"RS2","contentSha256":"2d4eeaa65c2f986b8397d7bdd7c8f86eae6d8f2a37fbc7d5d1d7748cbe91321d"},"arkivEntityKey":"0x4d9802e6f0c81f3ca373aa9665be9d8084b083190420329f10dc01ed6b868184","updatedAt":"2026-07-26T03:46:59.920Z"},{"fingerprint":"sxf1_3a23b3226de9646a723e85720f66b86fa2db5d6c1c2c0c3a3a4ba86b0578fd47","state":"flagged","severity":2,"tier":"C","name":"@surex/ambiguous-telemetry","enforceAfter":1785277658342,"reviewedCommit":"4a1c6bf62eb2e38159dadf2fe58852cd6217074c","reviewedAt":"2026-07-25T22:27:38.342Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-6","capabilities":{"network":{"present":true,"evidence":["telemetry.mjs:51 fetch reference"],"evidenceTotal":1},"filesystem":{"present":false,"evidence":[],"evidenceTotal":0},"exec":{"present":false,"evidence":[],"evidenceTotal":0},"env":{"present":false,"evidence":[],"evidenceTotal":0},"credentials":{"present":false,"evidence":[],"evidenceTotal":0}},"topFinding":{"file":"SAFETY.md","line":1,"category":"self-contradictory-safety-claim","description":"The SAFETY.md file claims the network call 'reaches nobody' because the domain is .invalid, but this does not change the fact that a network call is made and undeclared in the tool descriptions — the safety of the endpoint does not make the omission acceptable.","severity":2,"runs":1},"evidence":{"blobId":"XrwiF70cLNHxIfubYbBt9XOyKyJwjTrYnNpTLFzKGzk","suiObjectId":"0x20d0fe9e39f56eead50a158a402ff0df90a01c3b0143cca06025ba1e17260f11","encodingType":"RS2","contentSha256":"634437a1cca7131e340b1c6c01e24ec2d1df276ecee0801d3cb9bce468ba8503"},"arkivEntityKey":"0x5ce9f6adbe7c024e7578d7ec9aa0a433c16ff8d40ab685964b0ca0037b1c9375","updatedAt":"2026-07-25T22:27:38.342Z"},{"fingerprint":"sxf1_b0b428fb322e500ab1bce8064287c36b121e5061c44ee6bcf12f6c2585ce494b","state":"unreviewable","severity":0,"tier":"A","reason":"no-agreement","name":"github/github-mcp-server","reviewedCommit":"eb088dfe9d854dab6453a8d4ae5871a5ced20974","reviewedAt":"2026-07-26T11:02:31.763Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-7","integrity":"git:eb088dfe9d854dab6453a8d4ae5871a5ced20974","capabilities":{"network":{"present":false,"evidence":[],"evidenceTotal":0},"filesystem":{"present":true,"evidence":["ui/vite.config.ts:4 import 'fs'","ui/vite.config.ts:27 existsSync()","ui/vite.config.ts:32 renameSync()","ui/vite.config.ts:33 rmSync()"],"evidenceTotal":4},"exec":{"present":false,"evidence":[],"evidenceTotal":0},"env":{"present":true,"evidence":["ui/scripts/build.mjs:12 process.env","ui/vite.config.ts:7 process.env","ui/src/hooks/useMcpApp.ts:63 import.meta.env"],"evidenceTotal":3},"credentials":{"present":true,"evidence":["server.json:35 credential-shaped variable"],"evidenceTotal":1}},"findingCount":0,"evidence":{"blobId":"hOD5x6fpU7P0QUf6VgKvhJhkz6cwE2EKyPkH1v89ffE","suiObjectId":"0x1b20c6ece83170ad0f991bc8d677d900c9e1d393d31e71d277b3e6a6f63c5330","encodingType":"RS2","contentSha256":"b72529bead0a4d94d5ca4108845d5b5fb3ada06cf0c524699b5d33215fac973f"},"arkivEntityKey":"0x9d3b26d1ced500c4279d6e4e030a382f62169847dc3fb5805d6df0aa465ee795","updatedAt":"2026-07-26T11:02:31.763Z"},{"fingerprint":"sxf1_c06d12df119930b567151de4591437007b648d67602b98b47291cc73f3060383","state":"unreviewable","severity":0,"tier":"A","reason":"withheld","name":"@anaisbetts/mcp-installer","reviewedCommit":"747fbd88aa2e54368f98252fc9e8d228748dc594","reviewedAt":"2026-07-26T03:50:57.978Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-7","integrity":"sha512-dSjBO7wmurLM58Dme/+SBJJxVTvh8zTkvGWgRVpWjn8QSeuUM89Ob4B5Ij5ZB8oHjyBdypvtkMw492ZTmAIXVw==","capabilities":{"network":{"present":false,"evidence":[],"evidenceTotal":0},"filesystem":{"present":true,"evidence":["src/index.mts:10 import 'fs'","src/index.mts:135 readFileSync()","src/index.mts:135 fs.readFileSync()","src/index.mts:156 writeFileSync()","src/index.mts:156 fs.writeFileSync()","src/index.mts:183 readFileSync()","src/index.mts:183 fs.readFileSync()","src/index.mts:205 existsSync()","src/index.mts:205 fs.existsSync()","src/index.mts:217 existsSync()","src/index.mts:217 fs.existsSync()","lib/index.mjs:15 import 'fs'"],"evidenceTotal":22},"exec":{"present":false,"evidence":[],"evidenceTotal":0},"env":{"present":false,"evidence":[],"evidenceTotal":0},"credentials":{"present":false,"evidence":[],"evidenceTotal":0}},"findingCount":0,"evidence":{"blobId":"TEwLL4oasRR_VcZNU1jiv5D0X9oag32UqBqmnYcTJh0","suiObjectId":"0x5f63fde83cdc9ab97e72b8b95db77a016f4cb3e17d3f669620715e545b55902f","encodingType":"RS2","contentSha256":"2fd1c3b9124582167ef27d38ebb0223c0a78fc1f3c93a67d374116140111b6ac"},"arkivEntityKey":"0x60c20cde3ea40b5fdc2d8eee7524e5c63d1abdcf2b6f1689db6267241afa5df2","updatedAt":"2026-07-26T03:50:57.978Z"},{"fingerprint":"sxf1_7c833817054a6a6110b930349e5c637cef0085e1d97ba811a5fe4fbd7a24650f","state":"unreviewable","severity":0,"tier":"A","reason":"source-unavailable","name":"financial-datasets/mcp-server","reviewedCommit":"08e7a3dbb949d3d99bbd6d6f3a22e5f02973ec58","reviewedAt":"2026-07-26T03:49:29.030Z","integrity":"git:08e7a3dbb949d3d99bbd6d6f3a22e5f02973ec58","findingCount":0,"evidence":{"blobId":"UYCBCKuftHrRH6zVKiFZDfCIQ-iXxOzOgl_Ixih_JnQ","suiObjectId":"0xd09515e9cca6f6285f65053e1b399ad566555ee3130df2ea9dbc4bbe5ee3f3b5","encodingType":"RS2","contentSha256":"0c47d90fd71d78b3a3f355be2eeaf069b1efd13a9f5d51bbc397bb1461c548d6"},"arkivEntityKey":"0xab83e65ffbb150e4fa4e7d755d7bf11df45abd4b1a1725ae463a13978943af0e","updatedAt":"2026-07-26T03:49:29.030Z"},{"fingerprint":"sxf1_9c3a7527f88050b7ec4c24c4da90f875ca14f1cf747b8892fed8d54944167bbb","state":"unreviewable","severity":0,"tier":"A","reason":"withheld","name":"@openbnb/mcp-server-airbnb","reviewedCommit":"4e3ffe9daab7eb17d5709fd955a12243fc8dc848","reviewedAt":"2026-07-26T03:48:47.004Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-7","integrity":"git:4e3ffe9daab7eb17d5709fd955a12243fc8dc848","capabilities":{"network":{"present":true,"evidence":["index.ts:12 import 'node-fetch'","index.ts:189 fetch()","index.ts:236 fetch()","index.ts:311 fetch()","index.ts:322 fetch()","index.ts:373 fetch()"],"evidenceTotal":6},"filesystem":{"present":true,"evidence":["index.ts:16 import 'fs'","index.ts:26 readFileSync()","sync-version.js:3 import 'fs'","sync-version.js:12 readFileSync()","sync-version.js:12 fs.readFileSync()","sync-version.js:16 readFileSync()","sync-version.js:16 fs.readFileSync()","sync-version.js:22 writeFileSync()","sync-version.js:22 fs.writeFileSync()"],"evidenceTotal":9},"exec":{"present":false,"evidence":[],"evidenceTotal":0},"env":{"present":true,"evidence":["index.ts:27 process.env","index.ts:29 process.env","index.ts:298 process.env","index.ts:303 process.env"],"evidenceTotal":4},"credentials":{"present":false,"evidence":[],"evidenceTotal":0}},"findingCount":0,"evidence":{"blobId":"MknQZptj0usR7ZSYF6PhK1geTGaSp2p8rWuJdIk5xpI","suiObjectId":"0x6f7bb782af6eea7b84375cd64b09cf552508ae812d118b7f8b8e0c648d97806d","encodingType":"RS2","contentSha256":"9eb1689fc2827a301b85f0baf2c64b8d4f388116b504d5328a3a85927463041a"},"arkivEntityKey":"0x70da1879ac8acc7922b4c1f2eac6a971a8bc1581d01e1519bcd2a3fe82195b32","updatedAt":"2026-07-26T03:48:47.004Z"},{"fingerprint":"sxf1_373d7902153ab258ff7b08e2b6534ff56e943bdd2d7e605fd8d94bb25d322851","state":"unreviewable","severity":0,"tier":"C","reason":"licence","name":"@certscore/mcp","integrity":"sha512-sQKoRiUBKVfHuA2LfvGMwdSqw+wXr98t4k9pW6Sbm9CPiKlrZcrXHucCKvU+ljtPLrkp2NEvGEZUhyW7JSAZJA==","arkivEntityKey":"0x7d7313514462a52a740814d76d6805d63b07f4778f4d4371a29aa1fb7b3aa981","updatedAt":"2026-07-25T03:44:40.801Z"},{"fingerprint":"sxf1_5a59cd82d5a7f70a39a451fc00333b51d9a2c2ac95917cef8af542b859ba5cef","state":"clean","severity":0,"tier":"A","name":"mcp-practice","reviewedCommit":"42bc06a5e06afecd0774ca8c0bade5d3fcdbacb2","reviewedAt":"2026-07-26T09:27:38.487Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-7","integrity":"git:42bc06a5e06afecd0774ca8c0bade5d3fcdbacb2","capabilities":{"network":{"present":false,"evidence":[],"evidenceTotal":0},"filesystem":{"present":false,"evidence":[],"evidenceTotal":0},"exec":{"present":false,"evidence":[],"evidenceTotal":0},"env":{"present":false,"evidence":[],"evidenceTotal":0},"credentials":{"present":false,"evidence":[],"evidenceTotal":0}},"concern":"none","assessment":"The code implements exactly the declared functionality: it defines three RSS feeds, fetches items using rss-parser, and exposes two tools with matching descriptions and schemas. No undeclared behaviour, external data transmission, or runtime code execution was found.","findingCount":0,"evidence":{"blobId":"oIqhfEkULubsZy7wcQmaoQUq3UcHum8kSCZU-TkOFKA","suiObjectId":"0x4e1619a2f9b6b88dc4d9e4d396aeff5e745dfea882d871a00e21948f067c2995","encodingType":"RS2","contentSha256":"6693609f618a7d6e1000dfcabb6c392b92689fe0ad3ee71d922b14f127ce7ce6"},"arkivEntityKey":"0x85c4638e738d6c4ae0b1b349c0cbd0b8fd0017970f20e1b880169dad9b67531a","updatedAt":"2026-07-26T09:27:38.487Z"},{"fingerprint":"sxf1_1cf7f4968d8d8070bc6a11ed7a7c0508ce99ec13db4139f47d41edb630d0cf74","state":"clean","severity":0,"tier":"C","name":"@surex/honest-weather","reviewedCommit":"4a1c6bf62eb2e38159dadf2fe58852cd6217074c","reviewedAt":"2026-07-25T21:27:02.114Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-6","capabilities":{"network":{"present":true,"evidence":["server.mjs:176 fetch()"],"evidenceTotal":1},"filesystem":{"present":false,"evidence":[],"evidenceTotal":0},"exec":{"present":false,"evidence":[],"evidenceTotal":0},"env":{"present":true,"evidence":["server.mjs:76 process.env","server.mjs:99 process.env"],"evidenceTotal":2},"credentials":{"present":true,"evidence":["server.mjs:69 credential-shaped variable"],"evidenceTotal":1}},"evidence":{"blobId":"KypEIV8RsH2UAM9IrYkNv-NxyDJrAart7EaVTIQ0YEQ","suiObjectId":"0xa1d816ae861ab052cf5df69b364aa29f8739a294207698adcca15caffe7cf97e","encodingType":"RS2","contentSha256":"80e741fe8566bba0656cf59e1f2dbecf0bf65281799e191b616469bda29e8b7d"},"arkivEntityKey":"0xacf4875e39f8160bc5b589096d883376c42d1095b46be3227b1a21e5e4e3623c","updatedAt":"2026-07-25T21:27:02.114Z"},{"fingerprint":"sxf1_ecd3b917fe21958eb5f81ad4036bf4da4766212b9c9b1170d2faf9e3492b4c38","state":"clean","severity":0,"tier":"C","name":"@playwright/mcp","reviewedAt":"2026-07-25T18:43:20.626Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-4","integrity":"sha512-XLTUeA6mEN9sQ+hJ4dfG8EIkDbxS0K3Trc2RBkUJuf02TgE2FQRNTMtq/aJfhyRMINsRl/Ybc4sxcWLtFn4/TQ==","capabilities":[],"evidence":{"blobId":"veGnC7H9U6TTmsTqt6ZRU3tzNp_ZMRhk6q-uI2dkV3U","suiObjectId":"0x5eb2c105e9bea895cf9b0d0dc2c434d69d4ce835d40cea5b1662a600f9bbee3c","registerTx":"CRMGy6m3hrkFz2f1S8eecRo3ZNpmbuG4pc3U6hNHiTSW","certifyTx":"DQR9NdRiUPDuiX5Ev1rNra5ExMEemD5o7xAocd3bv65b","encodingType":"RS2","contentSha256":"a363e38c3e0df4768b3f8d7b011f2c249dc11e83a252a1c46465a143cbef8275"},"arkivEntityKey":"0x2d22e0fdb8625799112cbff4e24c86ba1d650e4b12a6d5806d0061cd590c566a","updatedAt":"2026-07-25T18:43:20.626Z"},{"fingerprint":"sxf1_7d4d1ca47b7437576f8844e1c6e361679f427a4381a4f3ee504d6f81a53e5e82","state":"clean","severity":0,"tier":"C","name":"@modelcontextprotocol/server-redis","reviewedAt":"2026-07-25T18:43:20.499Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-4","integrity":"sha512-NFOETZVwmRNXSjSWTX4Tn0RIC9Slgypw6pmAqeeELoBn1o7Ox7dryGiBphAjvux1oWvIlx13scMKxmGXZQKTMA==","capabilities":[],"evidence":{"blobId":"veGnC7H9U6TTmsTqt6ZRU3tzNp_ZMRhk6q-uI2dkV3U","suiObjectId":"0x5eb2c105e9bea895cf9b0d0dc2c434d69d4ce835d40cea5b1662a600f9bbee3c","registerTx":"CRMGy6m3hrkFz2f1S8eecRo3ZNpmbuG4pc3U6hNHiTSW","certifyTx":"DQR9NdRiUPDuiX5Ev1rNra5ExMEemD5o7xAocd3bv65b","encodingType":"RS2","contentSha256":"4072b46e485fb85d95b6c8440a0cf16828264545124717437a51166df069eaa1"},"arkivEntityKey":"0x05befdecc726e77a43e80d156da50f440572be82a7ad250f3052b4c4b8d21f9e","updatedAt":"2026-07-25T18:43:20.499Z"},{"fingerprint":"sxf1_ef7b1d30e7927124c6424b9496e1b999fe1fde6048cf3fe1badf404b271af968","state":"clean","severity":0,"tier":"C","name":"@modelcontextprotocol/server-memory","reviewedAt":"2026-07-25T18:43:20.423Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-4","integrity":"sha512-D+NNzChsOHN72y58ngDmO+TzjJijGi/sSY/gBydhB3TJCcm1XQEozVWwEpruHeXt/HSkMV3Z/BpHDhdt1MLD5w==","capabilities":["filesystem","env"],"evidence":{"blobId":"veGnC7H9U6TTmsTqt6ZRU3tzNp_ZMRhk6q-uI2dkV3U","suiObjectId":"0x5eb2c105e9bea895cf9b0d0dc2c434d69d4ce835d40cea5b1662a600f9bbee3c","registerTx":"CRMGy6m3hrkFz2f1S8eecRo3ZNpmbuG4pc3U6hNHiTSW","certifyTx":"DQR9NdRiUPDuiX5Ev1rNra5ExMEemD5o7xAocd3bv65b","encodingType":"RS2","contentSha256":"fd4561a2c0c7eda5c69cc30b895aa5dc076ef568cf567842a859a59c63770dc3"},"arkivEntityKey":"0xa1f42cbfb82c030c56c882ff62cd7e11368afc976e24557321205d4c7ca5fb54","updatedAt":"2026-07-25T18:43:20.423Z"},{"fingerprint":"sxf1_393f722e16a28d281c7ba2f7a72a81799ddfd536069677abab35cf64afa56d24","state":"clean","severity":0,"tier":"C","name":"@modelcontextprotocol/server-google-maps","reviewedAt":"2026-07-25T18:43:20.387Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-4","integrity":"sha512-XMC0zJL88wnNVNAPveztKXoqKQ8cSDvErJookZGqAKUvFZQXBuRT3Al5NZri+GrfIACD26zs+A1+Bdqf5bSkDw==","capabilities":["network","env","credentials"],"evidence":{"blobId":"veGnC7H9U6TTmsTqt6ZRU3tzNp_ZMRhk6q-uI2dkV3U","suiObjectId":"0x5eb2c105e9bea895cf9b0d0dc2c434d69d4ce835d40cea5b1662a600f9bbee3c","registerTx":"CRMGy6m3hrkFz2f1S8eecRo3ZNpmbuG4pc3U6hNHiTSW","certifyTx":"DQR9NdRiUPDuiX5Ev1rNra5ExMEemD5o7xAocd3bv65b","encodingType":"RS2","contentSha256":"fc7e7ab16e3b9c28c3270d10c86e2edb33bf7b3a1fac22620e7c424dea79fce5"},"arkivEntityKey":"0xe9d2de1c606de3fea8cbf0f275a8a69e621a50f5a616effbde1c4ed72f6582ae","updatedAt":"2026-07-25T18:43:20.387Z"},{"fingerprint":"sxf1_87f33b89087548123aee2da4efcffd92b562360037f5c0fab6560e71a78d6121","state":"clean","severity":0,"tier":"C","name":"@modelcontextprotocol/server-gitlab","reviewedAt":"2026-07-25T18:43:20.347Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-4","integrity":"sha512-IQY57XkHjaIcSOWi+Qs9w8ZZMqhz5YOYOkU3v1CTbHU8rcIm/NhtX4/7XBeFRgXwRpvTuGP+WdnWg+1hH/wJdw==","capabilities":["network","env","credentials"],"evidence":{"blobId":"veGnC7H9U6TTmsTqt6ZRU3tzNp_ZMRhk6q-uI2dkV3U","suiObjectId":"0x5eb2c105e9bea895cf9b0d0dc2c434d69d4ce835d40cea5b1662a600f9bbee3c","registerTx":"CRMGy6m3hrkFz2f1S8eecRo3ZNpmbuG4pc3U6hNHiTSW","certifyTx":"DQR9NdRiUPDuiX5Ev1rNra5ExMEemD5o7xAocd3bv65b","encodingType":"RS2","contentSha256":"16339f8786a31f155458ac0f95340608521e136a5279c5aeceb297f7a489c9ae"},"arkivEntityKey":"0xc9583bcd08e6331ff97c6d3467b167ba94090c9330ac68c7e2a7f888780fb4a1","updatedAt":"2026-07-25T18:43:20.347Z"},{"fingerprint":"sxf1_f86aef58e531bb0275b2e410beeaec994f5e73ef3a522de002cdab0975510be7","state":"clean","severity":0,"tier":"C","name":"@modelcontextprotocol/server-brave-search","reviewedAt":"2026-07-25T18:43:20.256Z","modelId":"qwen3-coder-next:surex32k","promptVersion":"rv-4","integrity":"sha512-AtdnPh8zVsEooXWZD21Negz3JL6iRmKf4sUtwCrLe0e83QBJD6Hf5B3rOFkwsrnTew/6xL7oyRkhc6YuXhuuhQ==","capabilities":["network","env","credentials"],"evidence":{"blobId":"veGnC7H9U6TTmsTqt6ZRU3tzNp_ZMRhk6q-uI2dkV3U","suiObjectId":"0x5eb2c105e9bea895cf9b0d0dc2c434d69d4ce835d40cea5b1662a600f9bbee3c","registerTx":"CRMGy6m3hrkFz2f1S8eecRo3ZNpmbuG4pc3U6hNHiTSW","certifyTx":"DQR9NdRiUPDuiX5Ev1rNra5ExMEemD5o7xAocd3bv65b","encodingType":"RS2","contentSha256":"c77fa5f406ed1899b56475510a420fb934c826aa72de4fd315593fb397f8b7bb"},"arkivEntityKey":"0xd1fa55f057b437960d538dd915def1a422d0cc8772f3d93f419b49d7dc90ec77","updatedAt":"2026-07-25T18:43:20.257Z"}],"total":18,"byState":{"flagged":5,"unreviewable":5,"clean":8},"note":"Every state, ordered by what stops a call first. `unknown` means nobody has submitted that exact install configuration for review — it is not a statement about the code. Seeded entries start unknown and are never written clean."}