Long-context project memory for Claude Code / Cursor / Codex — a local MCP server with hybrid retrieval (dense + BM25 + cross-encoder rerank). Falsification-first benchmarks, honest nulls.
- capability exposure inferred + 35
- tool safety inferred + 5
inferred
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 3d ago · see ecosystem CVEs →
- C · 52 → C · 40
- D · 60 → C · 52
- C · 52 → D · 60
- D · 60 → C · 52
- C · 52 → D · 60
- C · 59 → C · 52
- A · 0 → C · 59
No known CVEs for this server.
- medium dangerous code
dynamic exec: __import__ sink, __import__(), eval()/exec()
analyzed commit ac605c7 · analyzer v33 · 1w ago
skills & prompt files 11
- prompt-file harshithkantamneni-bert-ac605c7/prompts/charter_template.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/clearness_phase1.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/clearness_phase2.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/director.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/director_decision.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/evaluator.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/implementer.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/researcher.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/strategist.md
- prompt-file harshithkantamneni-bert-ac605c7/prompts/threshing.md
- skill harshithkantamneni-bert-ac605c7/skills/lab-tools/SKILL.md
danger signals8
- dynamic code execution __import__ sink harshithkantamneni-bert-ac605c7/benchmarks/v2_claude_track.py :125
workers = int(__import__("os").environ.get("BERT_CLAUDE_WORKERS", "4")) - dynamic code execution __import__ sink harshithkantamneni-bert-ac605c7/core/agent.py :218
pid=__import__("os").getpid(), role=role, cycle=cycle, - dynamic code execution __import__() harshithkantamneni-bert-ac605c7/core/mcp_server.py :355
mod = __import__(f"tools.mcp.{modname}", fromlist=["make_server"]) - dynamic code execution eval()/exec() harshithkantamneni-bert-ac605c7/core/tool_synthesizer.py :327
exec(compile(source, str(path), "exec"), ns) # noqa: S102 # nosec B102 — runs ONLY on PI-blessed, sandbox-validated source, never raw model output - dynamic code execution __import__() harshithkantamneni-bert-ac605c7/tests/_smoke_mcp_custom_servers.py :27
mod = __import__(f"tools.mcp.{modname}", fromlist=["make_server"]) - dynamic code execution __import__() harshithkantamneni-bert-ac605c7/tests/_smoke_role_capability.py :24
return __import__(f"evals.role_capability.{role}", - dynamic code execution __import__() harshithkantamneni-bert-ac605c7/tools/bert_doctor.py :84
__import__(mod) - dynamic code execution __import__() harshithkantamneni-bert-ac605c7/tools/run_capability_harness.py :130
mod = __import__(f"evals.role_capability.{role}",
[](https://mcpobservatory.com/servers/github:harshithkantamneni/bert/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of harshithkantamneni.