benseverndev-oss/goldenmatch

v0.6.1

github

github Python analyzed 1934b8f deep scan · partial (1,482/7,212 files)

One MCP server exposing every Golden Suite tool — goldenmatch, goldencheck, goldenflow, goldenpipe, infermap

maintainer: benseverndev-oss
licence: MIT
first seen: 2026-08-12
last seen: 2026-08-31
releases · 30d: 0
github stars: 133 reported
short id

risk

56/100 · heuristic grade

C elevated inferred analyzer v33 (current)

capability exposure inferred + 35
recent drift inferred + 20
tool safety inferred + 12
trust mitigators mixed − 11

inferred mixed

The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.

risk trajectory

4 movements

5w ago C · 48 → C · 56
6w ago B · 24 → C · 48
8w ago B · 27 → B · 24
9w ago A · 0 → B · 27

capability exposure

grade factor +35

Inferred surface — each links to servers holding it:

vulnerabilities

0 CVEs

No known CVEs for this server.

tool safety

1 findings · grade factor +12

high dangerous code

dynamic exec: __import__(), __import__ sink, pickle.loads(), unsafe yaml.load()

skills & danger signals

github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 1934b8f · analyzer v33 · 10m ago

skills & prompt files 34

agent-rules AGENTS.md
agent-rules CLAUDE.md
agent-rules docs-site/goldenmatch/agent.mdx
agent-rules docs/superpowers/CLAUDE.md
agent-rules packages/python/CLAUDE.md
agent-rules packages/python/golden-suite/AGENTS.md
agent-rules packages/python/goldencheck-types/CLAUDE.md
agent-rules packages/python/goldencheck/AGENTS.md
agent-rules packages/python/goldencheck/CLAUDE.md
agent-rules packages/python/goldencheck/goldencheck/engine/CLAUDE.md
agent-rules packages/python/goldencheck/goldencheck/llm/CLAUDE.md
agent-rules packages/python/goldencheck/goldencheck/mcp/CLAUDE.md
agent-rules packages/python/goldencheck/goldencheck/profilers/CLAUDE.md
agent-rules packages/python/goldencheck/goldencheck/semantic/CLAUDE.md
agent-rules packages/python/goldencheck/goldencheck/tui/CLAUDE.md
agent-rules packages/python/goldenflow/AGENTS.md
agent-rules packages/python/goldenflow/CLAUDE.md
agent-rules packages/python/goldengraph/CLAUDE.md
agent-rules packages/python/goldenmatch-kg/CLAUDE.md
agent-rules packages/python/goldenmatch/AGENTS.md
agent-rules packages/python/goldenmatch/CLAUDE.md
agent-rules packages/python/goldenpipe/AGENTS.md
agent-rules packages/python/goldenpipe/CLAUDE.md
agent-rules packages/python/goldenpipe/goldenpipe/stages/CLAUDE.md
agent-rules packages/python/infermap/CLAUDE.md
agent-rules packages/rust/extensions/.clinerules
agent-rules packages/rust/extensions/.cursorrules
agent-rules packages/rust/extensions/.windsurfrules
agent-rules packages/rust/extensions/AGENTS.md
agent-rules packages/rust/extensions/CLAUDE.md
agent-rules packages/typescript/CLAUDE.md
agent-rules packages/typescript/goldenmatch/CLAUDE.md
agent-rules packages/typescript/goldenpipe/CLAUDE.md
agent-rules tests/CLAUDE.md

danger signals11

dynamic code execution __import__() packages/python/goldenmatch/goldenmatch/core/diagnostics.py :51 m = __import__(mod, fromlist=[name])
dynamic code execution __import__ sink packages/python/goldenmatch/goldenmatch/distributed/clustering.py :1062 npart = min(256, max(4, (__import__("os").cpu_count() or 16) * 4))
dynamic code execution pickle.loads() packages/python/goldenmatch/tests/test_lazy_cluster_dict.py :127 unp = pickle.loads(pickle.dumps(LazyClusterDict(lambda: dict(payload))))
dynamic code execution __import__ sink scripts/bench_er_headtohead/compare_cost_aware.py :109 summary = pathlib.Path(__import__("os").environ.get("GITHUB_STEP_SUMMARY", ""))
dynamic code execution __import__() scripts/bench_er_headtohead/run_bakeoff.py :67 return __import__(name)
dynamic code execution __import__() scripts/bench_er_headtohead/run_panel.py :44 return __import__(name)
dynamic code execution unsafe yaml.load() scripts/check_workflow_yaml.py :86 yaml.load(path.read_text(encoding="utf-8"), Loader=StrictLoader)
dynamic code execution __import__ sink scripts/test_sync_claims_coverage_enforcement.py :152 env = dict(__import__("os").environ)
dynamic code execution __import__ sink scripts/test_sync_claims_report.py :463 env={**__import__("os").environ, "COVERAGE_FILE": str(data_file)},
suspicious endpoint us.i.posthog.com (telemetry) packages/python/goldenmatch/goldenmatch/core/analytics.py :72 return os.environ.get("POSTHOG_HOST", "https://us.i.posthog.com").rstrip("/")
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform packages/python/goldenmatch/goldenmatch/core/vertex_embedder.py :121 "scope": "https://www.googleapis.com/auth/cloud-platform",

other grade factors

evidence elsewhere

recent drift +20 capability drift →

embed badge

readme-ready

[![MCP Observatory risk grade](https://mcpobservatory.com/servers/github:benseverndev-oss/goldenmatch/badge.svg)](https://mcpobservatory.com/servers/github:benseverndev-oss/goldenmatch/security)

Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of benseverndev-oss.