MCP Observatory
github re-analysis due unconfirmed MCP

nduckmink/arkon

github

Arkon: Enterprise AI Knowledge Hub & MCP Server. Self-hosted knowledge base for teams to manage RAG contexts, access policies, and AI skills. Connect Claude and other LLMs via Model Context Protocol (MCP) for automated, secure organizational knowledge integration.

maintainer
nduckmink
license
NOASSERTION
first seen
2026-05-22
last seen
2026-06-04
releases · 30d
6
short id
risk 11/100 · heuristic grade
A minimal
  • capability exposureinferred+14
  • trust mitigatorsmixed−3

inferredmixed

The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.

graded 7m ago · see ecosystem CVEs →

risk trajectory 1 movements
  • A · 0 → A · 11
capability exposure grade factor +14
Inferred surface — each links to servers holding it:
vulnerabilities 0 CVEs

No known CVEs for this server.

tool safety 1 findings · grade factor +0
  1. highdangerous code

    env-secret-flows-to-network-js: A process environment value (often a secret/token) flows into a network call — possible credential exfiltration. (/tmp/obs-code-vcSnn9/nduckmink-ark

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 5e4069d · analyzer v17 · 2d ago

skills & prompt files 6

embed badge readme-ready
live risk-grade badge preview [![MCP Observatory risk grade](https://mcpobservatory.com/servers/github:nduckmink/arkon/badge.svg)](https://mcpobservatory.com/servers/github:nduckmink/arkon/security)

Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of nduckmink.