github TypeScript analyzed 0f11d05

lolxl/safespace-mcp

The AI safety gateway for an agent's external surface — a provider-agnostic safety envelope (input sanitize + untrusted-content tagging, tier/scope/burst/recipient egress gates, autonomy hardening, run_id forensics, tokens behind a SecretBackend, full audit trail) between an AI agent and any source it touches. MIT.

maintainer: lolxl
licence: Apache-2.0
first seen: 2026-06-11
last seen: 2026-07-30
releases · 30d: 0
short id

risk 44/100 · heuristic grade

C elevated inferred analyzer v33 (current)

capability exposure inferred + 35
tool safety inferred + 12
trust mitigators mixed − 3

inferred mixed

The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.

grade last moved 1w ago · see ecosystem CVEs →

risk trajectory 2 movements

6w ago B · 32 → C · 44
12w ago A · 0 → B · 32

capability exposure grade factor +35

Inferred surface — each links to servers holding it:

vulnerabilities 0 CVEs

No known CVEs for this server.

tool safety 2 findings · grade factor +12

high dangerous code

committed secret: Google OAuth client secret, Google API key, GitHub token, GitHub fine-grained PAT, Stripe live key, OpenAI key · obfuscated payload: dynamic require()/import()
low dangerous code

env-secret-flows-to-network-js: A process environment value reaches a network call. Review whether it is a credential leaving the process; the ordinary API-wrapper shape (read a ke

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 0f11d05 · analyzer v33 · 2w ago

skills & prompt files 1

agent-rules lolxl-safespace-mcp-0f11d05/CLAUDE.md

danger signals38

suspicious endpoint api.telegram.org lolxl-safespace-mcp-0f11d05/.claude-plugin/src/auth/telegram/client.ts :26 const TELEGRAM_API = "https://api.telegram.org";
suspicious endpoint api.telegram.org lolxl-safespace-mcp-0f11d05/.claude-plugin/src/policy/egress-destinations.test.ts :101 const host = new URL("https://api.telegram.org/botSECRET123/sendMessage").hostname;
suspicious endpoint 169.254.169.254 (cloud metadata) lolxl-safespace-mcp-0f11d05/.claude-plugin/src/policy/url-gate.test.ts :248 assertUrlAllowed(new URL("http://169.254.169.254/latest/meta-data/"), PUBLIC_LOOKUP, EMPTY_ENV),
suspicious endpoint 169.254.169.254 (cloud metadata) lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/envelope-integration.test.ts :168 args: { url: "http://169.254.169.254/" },
suspicious endpoint api.telegram.org lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/handlers/telegram-read.test.ts :66 expect(url).toContain("https://api.telegram.org/botsecret-tok/getUpdates");
suspicious endpoint api.telegram.org lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/handlers/telegram.test.ts :58 expect(url).toBe("https://api.telegram.org/botsecret-tok/sendMessage");
suspicious endpoint api.telegram.org lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/handlers/telegram.ts :40 const TELEGRAM_API_HOST = "https://api.telegram.org";
suspicious endpoint 169.254.169.254 (cloud metadata) lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/handlers/web-fetch.test.ts :67 await webFetchHandler(KEYLESS_CTX, { url: "http://169.254.169.254/latest/meta-data/" });
over-broad OAuth scope https://www.googleapis.com/auth/documents expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/auth/consent.test.ts :86 expect(V1_REQUIRED_SCOPES).toContain("https://www.googleapis.com/auth/documents");
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/auth/consent.test.ts :266 expect(V1_REQUIRED_SCOPES).toContain("https://www.googleapis.com/auth/spreadsheets");
over-broad OAuth scope gmail.modify lolxl-safespace-mcp-0f11d05/.claude-plugin/src/auth/consent.ts :41 "https://www.googleapis.com/auth/gmail.modify",
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/auth/consent.ts :43 "https://www.googleapis.com/auth/drive",
over-broad OAuth scope https://www.googleapis.com/auth/documents expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/auth/consent.ts :46 "https://www.googleapis.com/auth/documents",
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/auth/consent.ts :101 "https://www.googleapis.com/auth/spreadsheets",
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/auth/scopes.ts :37 "https://www.googleapis.com/auth/drive",
over-broad OAuth scope https://www.googleapis.com/auth/documents expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/auth/scopes.ts :43 "https://www.googleapis.com/auth/documents",
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/auth/scopes.ts :265 "https://www.googleapis.com/auth/spreadsheets",
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/migrate.test.ts :32 "https://www.googleapis.com/auth/drive",
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/handlers.test.ts :7609 const DRIVE_FULL = "https://www.googleapis.com/auth/drive";
over-broad OAuth scope https://www.googleapis.com/auth/documents expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/registry.test.ts :493 "https://www.googleapis.com/auth/documents",
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/registry.test.ts :511 "https://www.googleapis.com/auth/drive",
over-broad OAuth scope gmail.modify lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/registry.test.ts :548 "https://www.googleapis.com/auth/gmail.modify",
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/registry.test.ts :871 "https://www.googleapis.com/auth/spreadsheets",
over-broad OAuth scope gmail.modify lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/registry/scopes.ts :7 export const GMAIL_MODIFY = "https://www.googleapis.com/auth/gmail.modify";
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/registry/scopes.ts :27 export const DRIVE = "https://www.googleapis.com/auth/drive";
over-broad OAuth scope https://www.googleapis.com/auth/documents expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/registry/scopes.ts :35 export const DOCUMENTS = "https://www.googleapis.com/auth/documents";
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/registry/scopes.ts :179 export const SPREADSHEETS = "https://www.googleapis.com/auth/spreadsheets";
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/source.test.ts :282 account: { accountId: "a@x.com", scopes: ["https://www.googleapis.com/auth/drive"] },
over-broad OAuth scope gmail.modify lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/with-context.test.ts :530 "https://www.googleapis.com/auth/gmail.modify",
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/with-context.test.ts :644 "https://www.googleapis.com/auth/drive",
over-broad OAuth scope https://www.googleapis.com/auth/documents expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/with-context.test.ts :686 "https://www.googleapis.com/auth/documents",
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose lolxl-safespace-mcp-0f11d05/.claude-plugin/src/tools/with-context.test.ts :1006 "https://www.googleapis.com/auth/spreadsheets",
committed secret Google OAuth client secret lolxl-safespace-mcp-0f11d05/.claude-plugin/.env.example :6 GOCSPX…(30 chars, redacted)
committed secret Google API key lolxl-safespace-mcp-0f11d05/.claude-plugin/src/policy/outbound-secret.test.ts :35 AIzaSy…(39 chars, redacted)
committed secret GitHub token lolxl-safespace-mcp-0f11d05/.claude-plugin/src/policy/outbound-secret.test.ts :41 ghp_01…(40 chars, redacted)
committed secret GitHub fine-grained PAT lolxl-safespace-mcp-0f11d05/.claude-plugin/src/policy/outbound-secret.test.ts :44 github…(35 chars, redacted)
committed secret Stripe live key lolxl-safespace-mcp-0f11d05/.claude-plugin/src/policy/outbound-secret.test.ts :49 sk_liv…(32 chars, redacted)
committed secret OpenAI key lolxl-safespace-mcp-0f11d05/.claude-plugin/src/policy/outbound-secret.test.ts :50 sk-012…(39 chars, redacted)

embed badge readme-ready

[![MCP Observatory risk grade](https://mcpobservatory.com/servers/github:lolxl/safespace-mcp/badge.svg)](https://mcpobservatory.com/servers/github:lolxl/safespace-mcp/security)

Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of lolxl.

lolxl/safespace-mcp

skills & prompt files 1

danger signals38

Navigate

Stream

Features

Display