github analyzed d2546e2 deep scan · partial (261/3,638 files)

ergoveritas1-alt/certscore.ai

CertScore MCP server for scan creation, findings, evidence, and domain lookup.

maintainer: ergoveritas1-alt
licence: —
first seen: 2026-07-05
last seen: 2026-07-05
releases · 30d: 0
short id

risk 47/100 · heuristic grade

C elevated inferred analyzer v33 (current)

capability exposure inferred + 35
tool safety inferred + 12

inferred

The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.

grade last moved 1d ago · see ecosystem CVEs →

risk trajectory 5 movements

1d ago C · 40 → C · 47
4w ago B · 32 → C · 40
5w ago C · 52 → B · 32
5w ago C · 44 → C · 52
6w ago B · 27 → C · 44

capability exposure grade factor +35

Inferred surface — each links to servers holding it:

vulnerabilities 0 CVEs

No known CVEs for this server.

tool safety 3 findings · grade factor +12

high dangerous code

dynamic exec: vm exec, new Function() · obfuscated payload: dynamic require()/import()
low dangerous code

env-secret-flows-to-network-js: A process environment value reaches a network call. Review whether it is a credential leaving the process; the ordinary API-wrapper shape (read a ke
low dangerous code

env-secret-flows-to-network-js: A process environment value reaches a network call. Review whether it is a credential leaving the process; the ordinary API-wrapper shape (read a ke

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit d2546e2 · analyzer v33 · 1d ago

skills & prompt files 4

danger signals80

dynamic code execution vm exec ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/analytics/consent-bootstrap.test.ts :19 vm.runInNewContext(buildConsentBootstrapScript(tag), { window, document, URL });
dynamic code execution new Function() ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/analytics/umami-integration.test.ts :14 assert.doesNotThrow(() => new Function(script));
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/v2-dag-lambda/src/handler.test.ts :1622 requestUrl: "https://www.google-analytics.com/g/collect?secret=redacted",
suspicious endpoint analytics.google.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/validation-worker/scripts/live-consent-audit.test.ts :115 url: "https://analytics.google.com/g/collect",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/validation-worker/src/validation/vendor-enrichment.test.ts :127 url: "https://www.google-analytics.com/g/collect?v=2"
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/components/scans/executive-summary-card.test.ts :618 preconsent_cookie_initiator_urls: ["https://www.google-analytics.com/analytics.js", "https://connect.facebook.net/en_US/fbevents.js"],
suspicious endpoint o1.ingest.de.sentry.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/components/scans/full-site-resource-context.test.tsx :46 const html = renderToStaticMarkup(<DataTransferDisclosure label="Sentry" context={context} requestUrls={["https://o1.ingest.de.sentry.io/api/2/envelope/"]}/>);
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/canonical-review-finding.test.ts :401 "vendor:Google Analytics|relationship:first_party|endpoint:first_party_collection_proxy|host:www.google-analytics.com|source_url:https://www.google-analytics.com/g/collect?v=2"
suspicious endpoint analytics.google.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/concern-policy.test.ts :2546 "https://analytics.google.com/g/collect?v=2",
suspicious endpoint edge.fullstory.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/executive-findings-projection.test.ts :3558 "https://edge.fullstory.com/s/settings/15TFZD/v1/web",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/finding-evidence-contracts.test.ts :362 sourceEvidenceIds: ["policy:cookie#reject", "cookie:_ga", "request:https://www.google-analytics.com/g/collect"]
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/full-site-resource-context.test.ts :7 const analytics=identifyCrawlService(row('https://www.google-analytics.com/g/collect'));
suspicious endpoint api2.amplitude.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/full-site-resource-context.test.ts :23 const identity=identifyCrawlService(row('https://api2.amplitude.com/2/httpapi'))!;
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/gdpr-eprivacy-coverage-checklist.test.ts :2323 requestUrl: "https://www.google-analytics.com/g/collect?v=2",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/gdpr-eprivacy-coverage-policy.test.ts :5590 requestUrl: "https://www.google-analytics.com/g/collect?v=2",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/hybrid-runtime-evidence.test.ts :1049 const googleUrl = "https://www.google-analytics.com/g/collect?tid=G-TEST";
suspicious endpoint edge.fullstory.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/hybrid-runtime-evidence.test.ts :1050 const fullStoryUrl = "https://edge.fullstory.com/s/fs.js";
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/normalized-concerns.test.ts :451 requestUrl: "https://www.google-analytics.com/g/collect?v=2",
suspicious endpoint edge.fullstory.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/normalized-concerns.test.ts :994 requestUrl: "https://edge.fullstory.com/s/settings/15TFZD/v1/web",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/policy-behavior-conflict.fixtures.ts :202 requests: ["https://www.google-analytics.com/g/collect"],
suspicious endpoint cdn.segment.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/preconsent-public-evidence.test.ts :57 { ...common, requestUrl: "https://cdn.segment.com/analytics.js", classification: "library" },
suspicious endpoint api.segment.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/preconsent-public-evidence.test.ts :58 { ...common, requestUrl: "https://api.segment.io/v1/p", classification: "tracking", collectionEndpointObserved: true }
suspicious endpoint edge.fullstory.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/preconsent-public-evidence.test.ts :141 pageUrl: "https://edge.fullstory.com/s/settings/15TFZD/v1/web",
suspicious endpoint sr-client-cfg.amplitude.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/preconsent-public-evidence.test.ts :183 url: "https://sr-client-cfg.amplitude.com/config/abc",
suspicious endpoint api2.amplitude.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/preconsent-public-evidence.test.ts :209 url: "https://api2.amplitude.com/2/httpapi",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/preconsent-public-evidence.test.ts :724 inferDirectEndpointVendorFromUrl("https://www.google-analytics.com/analytics.js"),
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/promotion-evidence-contracts.test.ts :866 runtimeAnchorRef: "https://www.google-analytics.com/g/collect?v=2",
suspicious endpoint rs.fullstory.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/regulatory-risk-source.test.ts :67 "https://rs.fullstory.com/rec/page.js",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/reject-click-tracking-runtime.test.ts :22 pendingRedirect?.writeHead(302, { location: "https://www.google-analytics.com/g/collect?tid=G-REDIRECT" }).end();
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/runtime-vendor-disclosure.test.ts :155 "https://www.google-analytics.com/g/collect?v=2",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/scan-report-unified-findings.test.ts :1947 "https://www.google-analytics.com/g/collect"
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/lib/scans/unified-findings.test.ts :2616 initiatorUrl: "https://www.google-analytics.com/analytics.js",
suspicious endpoint api.segment.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/server/browser-scans/canonical-routing.test.ts :186 url: "https://api.segment.io/v1/t"
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/server/scans/full-site-score.test.ts :133 nalytics", method: "POST", requestUrl: "https://www.google-analytics.com/g/collect", hostname: "www.google-analytics.com", thirdParty: true, collectionEndpointObserved: true }],
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/apps/web/server/scans/local-v2-dag-report.test.ts :336 requestUrl: "https://www.google-analytics.com/g/collect?v=2",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/infra/aws/ergoveritas-canary/broad-baseline-runtime.js :13 img.src = "https://www.google-analytics.com/collect?v=1&t=pageview&tid=G-X5ZM7BWET3&cid=CANARY";
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/infra/aws/ergoveritas-canary/post-accept/post-accept-runtime.js :53 analytics.src = "https://www.google-analytics.com/g/collect?v=2&tid=G-CERTSCORE&cid=POST_ACCEPT_CANARY&en=accept_honored";
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/infra/aws/ergoveritas-canary/post-refusal/post-refusal-runtime.js :51 analytics.src = "https://www.google-analytics.com/g/collect?v=2&tid=G-CERTSCORE&cid=POST_REFUSAL_CANARY&en=reject_ignored";
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-review-engine/src/fixtures.ts :118 url: "https://www.google-analytics.com/g/collect?v=2&tid=G-TEST",
suspicious endpoint rs.fullstory.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-review-engine/src/fixtures.ts :206 url: "https://rs.fullstory.com/s/fs.js",
suspicious endpoint rs.fullstory.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-review-engine/src/index.test.ts :1037 key: "endpoint:https://rs.fullstory.com/rec/page",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-review-engine/src/index.test.ts :4016 matchedUrls: ["https://www.google-analytics.com/g/collect"],
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-scan-core/src/consent-flow-replay-runner.test.ts :493 harUrls: ["https://policy-corpus.test/", "https://www.google-analytics.com/g/collect"],
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-scan-core/src/domain-utils.test.ts :31 assert.equal(classifyParty("https://www.google-analytics.com/g/collect", "http://127.0.0.1:3000"), "third_party");
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-scan-core/src/gpc-impact-assessment.test.ts :39 { type: "request", url: "https://www.google-analytics.com/g/collect", evidenceId: "collection" },
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-scan-core/src/inspector.test.ts :145 requestUrl: "https://www.google-analytics.com/g/collect?v=2&tid=G-TEST",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-scan-core/src/journey-builder.test.ts :19 requestUrl: "https://www.google-analytics.com/g/collect?v=2&tid=G-TEST",
suspicious endpoint rs.fullstory.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-scan-core/src/journey-builder.test.ts :163 scriptUrl: "https://rs.fullstory.com/s/fs.js",
suspicious endpoint o514642.ingest.us.sentry.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-scan-core/src/journey-builder.test.ts :753 requestUrl: "https://o514642.ingest.us.sentry.io/api/514642/envelope/",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-scan-core/src/post-action-owned-canary-pages.test.ts :151 await page.route("https://www.google-analytics.com/**", (route) =>
suspicious endpoint 169.254.169.254 (cloud metadata) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-scan-core/src/public-network-guard.test.ts :44 "http://169.254.169.254/latest/meta-data/",
suspicious endpoint 93.184.216.34 ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-scan-core/src/public-network-guard.test.ts :52 await assert.doesNotReject(() => assertPublicNetworkUrl("https://93.184.216.34/"));
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-scan-core/src/test-fixtures/static-server.ts :1139 Location: "https://www.google-analytics.com/g/collect?v=2&tid=G-LOCALFIXTURE&en=inflight_redirect",
suspicious endpoint sr-client-cfg.amplitude.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/index.test.ts :216 url: "https://sr-client-cfg.amplitude.com/config/abc123",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/index.test.ts :975 url: "https://www.google-analytics.com/g/collect?v=2&tid=G-TEST",
suspicious endpoint region1.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/index.test.ts :1113 url: "https://region1.google-analytics.com/g/collect?v=2&tid=G-TEST&en=page_view",
suspicious endpoint rs.fullstory.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/index.test.ts :1481 url: "https://rs.fullstory.com/s/fs.js",
suspicious endpoint eu-assets.i.posthog.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/index.test.ts :2003 request("https://eu-assets.i.posthog.com/static/array.js", "eu-assets.i.posthog.com"),
suspicious endpoint api.segment.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/index.test.ts :2083 url: "https://api.segment.io/v1/track",
suspicious endpoint sentry.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/index.test.ts :2272 request("https://sentry.io/api/123/envelope/", "sentry.io"),
suspicious endpoint assets.sentry.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/index.test.ts :2273 request("https://assets.sentry.io/example.js", "assets.sentry.io"),
suspicious endpoint o514642.ingest.us.sentry.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/index.test.ts :2274 request("https://o514642.ingest.us.sentry.io/api/514642/envelope/", "o514642.ingest.us.sentry.io"),
suspicious endpoint edge.fullstory.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/index.test.ts :2513 request("https://edge.fullstory.com/s/settings/o-221JN4-na1/v1/web", "edge.fullstory.com"),
suspicious endpoint o123.ingest.de.sentry.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/service-regions.test.ts :7 ["https://o123.ingest.de.sentry.io/api/456/envelope/?sentry_key=redacted", "DE"],
suspicious endpoint o123.ingest.us.sentry.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/service-regions.test.ts :8 ["https://o123.ingest.us.sentry.io/api/456/store/", "US"],
suspicious endpoint region1.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/service-regions.test.ts :9 ["https://region1.google-analytics.com/mp/collect?api_secret=redacted", "EU"],
suspicious endpoint o1.ingest.de.sentry.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/service-regions.test.ts :21 [undefined, "o1.ingest.de.sentry.io", "http://o1.ingest.de.sentry.io/api/2/store/", "https://o1.ingest.de.sentry.io.evil.test/api/2/store/", "https://o1.ingest.de.sentry.io:8443/api/2/store/", "https:
suspicious endpoint docs.sentry.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/service-regions.ts :15 { url: "https://docs.sentry.io/api/", title: "Sentry regional domains" },
suspicious endpoint sentry.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/service-regions.ts :16 { url: "https://sentry.io/changelog/ingestion-ip-addresses-are-changing/", title: "Sentry ingestion endpoint names" },
suspicious endpoint www.amplitude.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/vendor-headquarters.ts :32 verified("Amplitude, Inc.", "US", "https://www.amplitude.com/contact", "Amplitude contact and offices", "Company headquarters listed in San Francisco; Amsterdam is separately identified as EMEA headqu
suspicious endpoint www.fullstory.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/vendor-headquarters.ts :35 verified("FullStory, Inc.", "US", "https://www.fullstory.com/strong-1h-growth-fueled-by-continued-upmarket-expansion/", "Fullstory company growth announcement", "Company announcement identifies Atlant
suspicious endpoint mixpanel.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/vendor-headquarters.ts :38 verified("Mixpanel, Inc.", "US", "https://mixpanel.com/legal/app-store-privacy-details/", "Mixpanel developer privacy guidance", "Mixpanel identifies San Francisco headquarters separately from its EU
suspicious endpoint sentry.io (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/certscore-vendor-resolver/src/vendor-headquarters.ts :44 ied("Functional Software, Inc.", "US", "https://sentry.io/astro-assets/resources/legal/International-Data-Transfers-With-Sentry-2024-01-19.pdf", "Sentry international data transfer assessment", "Sentr
suspicious endpoint 169.254.169.254 (cloud metadata) ergoveritas1-alt-certscore.ai-d2546e2/packages/shared/src/validators/domain.test.ts :31 "http://169.254.169.254",
suspicious endpoint 1.1.1.1 ergoveritas1-alt-certscore.ai-d2546e2/packages/shared/src/validators/domain.test.ts :54 assert.equal(normalizeUrl("https://1.1.1.1"), "https://1.1.1.1/");
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/validation-shared/src/privacy-runtime-findings.dataset.ts :314 requestUrls: [`https://www.google-analytics.com/g/collect?reviewed=${index}`],
suspicious endpoint www.fullstory.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/validation-shared/src/privacy-runtime-findings.dataset.ts :958 session_replay_observed: "https://www.fullstory.com/",
suspicious endpoint www.google-analytics.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/packages/validation-shared/src/privacy-runtime-findings.reviewed.ts :871 "https://www.google-analytics.com/analytics.js",
suspicious endpoint segment.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/scripts/build-v2-regulatory-gold-corpus-stage1.ts :824 target("tech-segment", "https://segment.com/", "tech/SaaS", "primary", fullPolicy, ["cross_border_endpoint_review", "session_replay_fingerprinting_review"], ["Segment", "Google"]),
suspicious endpoint www.fullstory.com (telemetry) ergoveritas1-alt-certscore.ai-d2546e2/scripts/build-v2-regulatory-gold-corpus-stage1.ts :835 target("tech-fullstory", "https://www.fullstory.com/", "tech/SaaS", "primary", fullPolicy, ["session_replay_fingerprinting_review", "cookie_notice_availability"], ["FullStory"]),

embed badge readme-ready

[![MCP Observatory risk grade](https://mcpobservatory.com/servers/github:ergoveritas1-alt/certscore.ai/badge.svg)](https://mcpobservatory.com/servers/github:ergoveritas1-alt/certscore.ai/security)

Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of ergoveritas1-alt.

ergoveritas1-alt/certscore.ai

skills & prompt files 4

danger signals80

Navigate

Stream

Features

Display