The AI that writes the code doesn't get to certify it. A different vendor does.
- capability exposure inferred + 35
- tool safety inferred + 12
inferred
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 1w ago · see ecosystem CVEs →
- C · 59 → C · 47
- D · 67 → C · 59
- C · 52 → D · 67
- C · 35 → C · 52
- A · 0 → C · 35
No known CVEs for this server.
- high dangerous code
committed secret: Anthropic key, private key · dynamic exec: __import__ sink, eval()/exec()
analyzed commit 8a54d35 · analyzer v33 · 2w ago
skills & prompt files 1
- agent-rules mark-hubers-rondo-8a54d35/CLAUDE.md
danger signals7
- dynamic code execution __import__ sink mark-hubers-rondo-8a54d35/rounds/db_bootstrap_validation.py :43
env={**__import__("os").environ, "PGPASSWORD": DB_PASS}, - dynamic code execution __import__ sink mark-hubers-rondo-8a54d35/tests/cloud/test_cloud_full.py :341
env = {**__import__("os").environ, "HOME": str(fake_home)} - dynamic code execution eval()/exec() mark-hubers-rondo-8a54d35/tests/unit/test_mutate.py :69
exec(compile(mod.read_text(encoding="utf-8"), str(mod), "exec"), ns) # noqa: S102 - dynamic code execution __import__ sink mark-hubers-rondo-8a54d35/tests/unit/test_providers.py :396
env={k: v for k, v in __import__("os").environ.items() if k != "CLAUDECODE"}, - committed secret Anthropic key mark-hubers-rondo-8a54d35/tests/unit/test_audit.py :629
sk-ant…(49 chars, redacted) - committed secret Anthropic key mark-hubers-rondo-8a54d35/tests/unit/test_doctor.py :102
sk-ant…(33 chars, redacted) - committed secret private key mark-hubers-rondo-8a54d35/tests/unit/test_sanitize.py :63
PEM private key block (redacted)
[](https://mcpobservatory.com/servers/github:mark-hubers/rondo/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of mark-hubers.