github re-analysis due

mobilevibe/notification-mcp

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio · http · sse counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 43c051a · analyzer v17 · 3d ago

suspicious endpointapi.telegram.orgMobileVibe-notification-mcp-43c051a/build/index.js:19const TELEGRAM_API_URL = `https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}`;
suspicious endpointapi.telegram.orgMobileVibe-notification-mcp-43c051a/src/index.ts:29const TELEGRAM_API_URL = `https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}`;

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

net MobileVibe-notification-mcp-43c051a/build/index.js :10 import axios from "axios";
net MobileVibe-notification-mcp-43c051a/src/index.ts :15 import axios from "axios";

secrets MobileVibe-notification-mcp-43c051a/build/index.js :12 const TELEGRAM_BOT_TOKEN = process.env.TELEGRAM_BOT_TOKEN;
secrets MobileVibe-notification-mcp-43c051a/src/index.ts :18 const TELEGRAM_BOT_TOKEN = process.env.TELEGRAM_BOT_TOKEN;