github TypeScript re-analysis due

AlpayC/mcp-migration-check

Deterministic readiness checker for the MCP 2026-07-28 specification break - a graded web probe and an agent skill over one rule engine.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport — counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit b5e9ac3 · analyzer v33 · 1w ago

suspicious endpoint 169.254.169.254 (cloud metadata) AlpayC-mcp-migration-check-b5e9ac3/packages/core/test/ssrf.test.ts :27 ["http://169.254.169.254/latest/meta-data", "cloud metadata address"],
suspicious endpoint 93.184.216.34 AlpayC-mcp-migration-check-b5e9ac3/packages/core/test/ssrf.test.ts :55 ["http://93.184.216.34/mcp", "public IPv4 literal"],
suspicious endpoint 172.15.0.1 AlpayC-mcp-migration-check-b5e9ac3/packages/core/test/ssrf.test.ts :56 ["http://172.15.0.1/mcp", "just below 172.16.0.0/12"],
suspicious endpoint 172.32.0.1 AlpayC-mcp-migration-check-b5e9ac3/packages/core/test/ssrf.test.ts :57 ["http://172.32.0.1/mcp", "just above 172.16.0.0/12"],
suspicious endpoint 192.169.1.1 AlpayC-mcp-migration-check-b5e9ac3/packages/core/test/ssrf.test.ts :58 ["http://192.169.1.1/mcp", "adjacent to 192.168.0.0/16"],
suspicious endpoint 100.63.255.255 AlpayC-mcp-migration-check-b5e9ac3/packages/core/test/ssrf.test.ts :59 ["http://100.63.255.255/mcp", "just below CGNAT"],
suspicious endpoint 100.128.0.1 AlpayC-mcp-migration-check-b5e9ac3/packages/core/test/ssrf.test.ts :60 ["http://100.128.0.1/mcp", "just above CGNAT"],
suspicious endpoint 11.0.0.1 AlpayC-mcp-migration-check-b5e9ac3/packages/core/test/ssrf.test.ts :61 ["http://11.0.0.1/mcp", "adjacent to 10.0.0.0/8"],

code evidence vv0.5.2 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 59

fs AlpayC-mcp-migration-check-b5e9ac3/packages/cli/bin/mcpcheck.mjs :806 import { constants, promises as fs } from "node:fs";
fs AlpayC-mcp-migration-check-b5e9ac3/packages/core/src/scan.ts :1 import { constants, promises as fs } from "node:fs";
fs (weak) AlpayC-mcp-migration-check-b5e9ac3/packages/core/test/scan.test.ts :5 import { promises as fs } from "node:fs";
fs (weak) AlpayC-mcp-migration-check-b5e9ac3/scripts/action-report.mjs :15 import { appendFileSync, readFileSync } from "node:fs";
fs (weak) AlpayC-mcp-migration-check-b5e9ac3/scripts/bundle-engine.mjs :11 import { chmod, mkdir } from "node:fs/promises";
fs (weak) AlpayC-mcp-migration-check-b5e9ac3/scripts/ecosystem-report.mjs :63 import { mkdir, open, readFile, rm, writeFile } from "node:fs/promises";
fs (weak) AlpayC-mcp-migration-check-b5e9ac3/scripts/ecosystem-snapshot.mjs :25 import { readdir, readFile, writeFile } from "node:fs/promises";
fs (weak) AlpayC-mcp-migration-check-b5e9ac3/scripts/pack-skill.mjs :29 } from "node:fs";
fs (weak) AlpayC-mcp-migration-check-b5e9ac3/skill/mcp-migration/scripts/mcpcheck.mjs :806 import { constants, promises as fs } from "node:fs";

shell (weak) AlpayC-mcp-migration-check-b5e9ac3/packages/core/test/scan.test.ts :4 import { execFileSync } from "node:child_process";
shell (weak) AlpayC-mcp-migration-check-b5e9ac3/scripts/pack-skill.mjs :21 import { execFileSync } from "node:child_process";

net (weak) AlpayC-mcp-migration-check-b5e9ac3/scripts/ecosystem-report.mjs :171 const res = await fetch(url, {
net (weak) AlpayC-mcp-migration-check-b5e9ac3/scripts/verify-spec-links.mjs :73 const res = await fetch(url, {
net AlpayC-mcp-migration-check-b5e9ac3/web/app/page.tsx :148 const res = await fetch("/api/check", {

secrets (weak) AlpayC-mcp-migration-check-b5e9ac3/scripts/ecosystem-report.mjs :102 const GITHUB_TOKEN = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? null;
secrets (weak) AlpayC-mcp-migration-check-b5e9ac3/skill/mcp-migration-workspace/fixtures/notes-mcp/src/index.ts :17 secret: process.env.ADMIN_SESSION_SECRET ?? "dev",

prepublishOnly AlpayC-mcp-migration-check-b5e9ac3/packages/cli/package.json :48 node ../../scripts/build-cli.mjs