AI-powered CLI coding agent with 20+ built-in tools, MCP support, and multi-model providers
- capability exposure inferred + 35
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 43s ago · see ecosystem CVEs →
- C · 35 → B · 32
No known CVEs for this server.
No tool-safety findings — heuristic detectors run on the compute-risk cadence; a finding appears when a tool trips a rule.
analyzed commit cb268b9 · analyzer v28 · 1d ago
skills & prompt files 5
- skill echoVic-blade-code-cb268b9/.blade/skills/base64-parser/SKILL.md
- skill echoVic-blade-code-cb268b9/.blade/skills/code-review/SKILL.md
- skill echoVic-blade-code-cb268b9/.blade/skills/github-explorer/SKILL.md
- agent-rules echoVic-blade-code-cb268b9/AGENTS.md
- agent-rules echoVic-blade-code-cb268b9/CLAUDE.md
danger signals4
- suspicious endpoint discord.com echoVic-blade-code-cb268b9/packages/cli/release.config.js :89
webhookUrl: process.env.DISCORD_WEBHOOK_URL || 'https://discord.com/api/webhooks/1460226980938125387/5fWgMuGmkGtb6j3eoDaz4JtSFfH8LtFtHK9F2srIHGoXp71zm4sHFPCc729PujDbHJ2F', - suspicious endpoint 169.254.169.254 (cloud metadata) echoVic-blade-code-cb268b9/packages/cli/tests/unit/hooks/http-hook-security.test.ts :68
'https://169.254.169.254/hook', // 云 metadata - suspicious endpoint 172.32.0.1 echoVic-blade-code-cb268b9/packages/cli/tests/unit/hooks/http-hook-security.test.ts :76
expect(() => validateHookUrl('https://172.32.0.1/hook')).not.toThrow(); - suspicious endpoint 172.15.0.1 echoVic-blade-code-cb268b9/packages/cli/tests/unit/hooks/http-hook-security.test.ts :77
expect(() => validateHookUrl('https://172.15.0.1/hook')).not.toThrow();
[](https://mcpobservatory.com/servers/github:echoVic/blade-code/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of echoVic.