github Python analyzed f70545d

cognis-digital/mcpharden

MCP server hardening linter — capability declarations, transport, tool descriptions

Drift inferred · capture-to-capture

HIGH 2026-08-08 code analysis flagged committed secret in cognis-digital/mcpharden
HIGH 2026-07-12 code analysis flagged dynamic code execution in cognis-digital/mcpharden
HIGH 2026-06-30 code analysis flagged committed secret in cognis-digital/mcpharden
HIGH 2026-06-24 code analysis flagged committed secret in cognis-digital/mcpharden

capabilities 0 tools

transport stdio · http · sse counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit f70545d · analyzer v33 · 1w ago

dynamic code execution __import__ sink cognis-digital-mcpharden-f70545d/mcpharden/cli.py :333 paths = [args.config] if args.config else [p for p in default_config_paths() if __import__("os").path.exists(p)]
committed secret Stripe live key cognis-digital-mcpharden-f70545d/demos/01-basic/weather-server.json :14 sk_liv…(31 chars, redacted)
committed secret Stripe live key cognis-digital-mcpharden-f70545d/demos/fixtures/fleet/files-mcp.json :5 sk_liv…(28 chars, redacted)
committed secret Stripe live key cognis-digital-mcpharden-f70545d/demos/fixtures/fleet/github-mcp.json :5 sk_liv…(28 chars, redacted)
committed secret Stripe live key cognis-digital-mcpharden-f70545d/demos/fixtures/public-rce-server.json :13 sk_liv…(31 chars, redacted)

code evidence vwalkthrough-v1 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 43

fs cognis-digital-mcpharden-f70545d/mcpharden/cli.py :88 with open(out, "w", encoding="utf-8") as fh:
fs cognis-digital-mcpharden-f70545d/mcpharden/configaudit.py :146 with open(path, "r", encoding="utf-8") as fh:
fs cognis-digital-mcpharden-f70545d/mcpharden/connect.py :73 text = sys.stdin.read() if a.input == "-" else open(a.input, encoding="utf-8").read()
fs cognis-digital-mcpharden-f70545d/mcpharden/core.py :120 with open(path, "r", encoding="utf-8") as fh:
fs (weak) cognis-digital-mcpharden-f70545d/tests/test_deep.py :102 with open(p, "w", encoding="utf-8") as fh:
fs (weak) cognis-digital-mcpharden-f70545d/tests/test_posture.py :470 with open(os.path.join(d, "good.json"), "w") as fh:
fs (weak) cognis-digital-mcpharden-f70545d/tests/test_smoke.py :22 with open(path, "w", encoding="utf-8") as fh:

shell (weak) cognis-digital-mcpharden-f70545d/tests/test_smoke.py :5 import subprocess

net cognis-digital-mcpharden-f70545d/integrations/webhook.py :8 import argparse, json, sys, urllib.request
net cognis-digital-mcpharden-f70545d/livesearch.py :28 import urllib.parse