tomcounsell/ai
github Python re-analysis due
unconfirmed MCP
A productive AI coworker that learns, self-improves, and ships work.
risk
C elevated
- capability exposure inferred + 35
- tool safety inferred + 5
inferred
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
risk trajectory
- C · 35 → C · 40
- C · 40 → C · 35
- D · 67 → C · 40
- D · 60 → D · 67
- C · 55 → D · 60
- D · 60 → C · 55
- C · 52 → D · 60
- A · 0 → C · 52
capability exposure
Inferred surface — each links to servers holding it:
vulnerabilities
No known CVEs for this server.
tool safety
- medium dangerous code
dynamic exec: __import__()
skills & danger signals
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit f01efe9 · analyzer v33 · 3h ago
skills & prompt files 1
- agent-rules CLAUDE.md
danger signals1
- dynamic code execution __import__() tests/test_rollout.py :257
assert __import__(f"bridges.{name}.__main__", fromlist=["LABEL"]).LABEL == label
embed badge
[](https://mcpobservatory.com/servers/github:tomcounsell/ai/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of tomcounsell.