github re-analysis due

micahyee415/vitally-mcp

Model Context Protocol (MCP) server for the Vitally customer-success platform: 40 read/write tools with per-user OAuth and a write allowlist.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 40 tools

transport streamable-http · http counts 40 tools · 0 res · 0 prompts permission surface via code analysis

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

fs micahyee415-vitally-mcp-99cf91b/src/index.ts :24 import { existsSync } from "fs";

net micahyee415-vitally-mcp-99cf91b/src/auth.ts :49 const res = await fetch(
net micahyee415-vitally-mcp-99cf91b/src/vitally-client.ts :76 res = await fetch(url.toString(), {

secrets micahyee415-vitally-mcp-99cf91b/src/index.ts :128 const vitallyClient = new VitallyClient(process.env.VITALLY_API_KEY!);