MCP Observatory
8m ago Tracked 59,479 Last 8m ago 24h 2,575
github JavaScript analyzed ae94da6

GautamTalksDev/mcp-pin

github

Tool-integrity pinning for MCP. Pin what your agent approved; block it when it changes.

maintainer
GautamTalksDev
licence
MIT
first seen
2026-09-02
last seen
2026-09-05
releases · 30d
3
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

code evidence vv0.1.3 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 22

filesystem 12

  • fs GautamTalksDev-mcp-pin-ae94da6/action/index.js :18 const fs = require('fs');
  • fs GautamTalksDev-mcp-pin-ae94da6/bin/attest.js :11 const fs = require('fs');
  • fs GautamTalksDev-mcp-pin-ae94da6/crawler/crawl.js :12 const fs = require('fs');
  • fs GautamTalksDev-mcp-pin-ae94da6/crawler/log.js :9 const fs = require('fs');
  • fs GautamTalksDev-mcp-pin-ae94da6/crawler/probe.js :205 const fs2 = require('fs');
  • fs GautamTalksDev-mcp-pin-ae94da6/crawler/report.js :14 const fs = require('fs');
  • fs GautamTalksDev-mcp-pin-ae94da6/crawler/seed.js :13 const fs = require('fs');
  • fs GautamTalksDev-mcp-pin-ae94da6/demo/rugpull-server.js :11 const fs = require('fs');
  • fs GautamTalksDev-mcp-pin-ae94da6/site/build.js :10 const fs = require('fs');
  • fs GautamTalksDev-mcp-pin-ae94da6/src/store.js :2 const fs = require('fs');
  • fs (weak) GautamTalksDev-mcp-pin-ae94da6/test/run.js :4 const fs = require('fs');
  • fs (weak) GautamTalksDev-mcp-pin-ae94da6/test/side-effect-server.js :4 const fs = require('fs');

shell / exec 4

  • shell GautamTalksDev-mcp-pin-ae94da6/bin/attest.js :10 const { spawn } = require('child_process');
  • shell GautamTalksDev-mcp-pin-ae94da6/crawler/probe.js :11 const { spawn } = require('child_process');
  • shell (weak) GautamTalksDev-mcp-pin-ae94da6/test/fake-client.js :2 const { spawn } = require('child_process');
  • shell (weak) GautamTalksDev-mcp-pin-ae94da6/test/run.js :7 const { spawn, spawnSync } = require('child_process');

network 3

  • net GautamTalksDev-mcp-pin-ae94da6/action/index.js :149 const r = await fetch(api + '?per_page=100', { headers });
  • net GautamTalksDev-mcp-pin-ae94da6/crawler/security.js :12 const net = require('net');
  • net GautamTalksDev-mcp-pin-ae94da6/crawler/seed.js :53 const r = await fetch('https://api.npmjs.org/downloads/point/last-month/' + batch.join(','));

secrets 5

  • secrets GautamTalksDev-mcp-pin-ae94da6/action/index.js :126 const token = process.env.GITHUB_TOKEN;
  • secrets GautamTalksDev-mcp-pin-ae94da6/crawler/crawl.js :75 let servers = await discover({ limit: 250, github: !!process.env.GITHUB_TOKEN });
  • secrets GautamTalksDev-mcp-pin-ae94da6/crawler/discover.js :93 if (process.env.GITHUB_TOKEN) headers.authorization = `Bearer ${process.env.GITHUB_TOKEN}`;
  • secrets GautamTalksDev-mcp-pin-ae94da6/crawler/log.js :41 if (process.env.LOG_PRIVATE_KEY) {
  • secrets (weak) GautamTalksDev-mcp-pin-ae94da6/test/run.js :18 if (!process.env.LOG_PRIVATE_KEY) {

obfuscation 1

  • base64 decode → exec sink GautamTalksDev-mcp-pin-ae94da6/test/run.js :92 const der = Buffer.from(process.env.LOG_PRIVATE_KEY, 'base64');