OrangePro local-first CLI + MCP server for behavior mapping, grounded test generation, and dynamic proof.
- capability exposure inferred + 30
- tool safety inferred + 17
- trust mitigators mixed − 11
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 20h ago · see ecosystem CVEs →
- C · 56 → C · 36
- A · 13 → C · 56
- B · 21 → A · 13
- B · 33 → B · 21
- B · 18 → B · 33
- B · 26 → B · 18
- B · 29 → B · 26
- C · 37 → B · 29
No known CVEs for this server.
- high dangerous code
committed secret: OpenAI key · dynamic exec: new Function()
- medium toxic flow (lethal trifecta)
lethal trifecta reachable across this server's tool + source surface: private-data access + untrusted-content ingestion + network exfil (a leg is proven only in the analyzed source)
analyzed commit 8787e04 · analyzer v33 · 20h ago
skills & prompt files 3
danger signals4
- dynamic code execution new Function() OrangeproAI-orangepro-mcp-8787e04/src/local/viz/d3.bundle.ts :3
Xu=34,Gu=10,Vu=13;function Wu(t){return new Function(\"d\",\"return {\"+t.map((function(t,n){return JSON.stringify(t)+\": d[\"+n+'] || \"\"'})).join(\",\")+\"}\")}function Zu(t){var n=Object.create(nu - dynamic code execution new Function() OrangeproAI-orangepro-mcp-8787e04/tests/local/generate.test.ts :2183
expect(() => new Function(body)).not.toThrow(); - dynamic code execution new Function() OrangeproAI-orangepro-mcp-8787e04/tests/local/viz.test.ts :1036
expect(() => new Function(body)).not.toThrow(); - committed secret OpenAI key OrangeproAI-orangepro-mcp-8787e04/tests/local/privacy-export.test.ts :30
sk-AAA…(31 chars, redacted)
[](https://mcpobservatory.com/servers/github:OrangeproAI/orangepro-mcp/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of OrangeproAI.