Directory / server
aliyun/alibabacloud-devops-mcp-server
This directory entry reports an automated security scan of aliyun/alibabacloud-devops-mcp-server, scanned 2026-07-26. Trust grade B rates provenance, transport, known vulnerabilities and instruction integrity; capability risk is reported separately, not folded into the grade.
Automated checks
| Status | Check | Policy | Result |
|---|---|---|---|
| WARN | Listed on the official MCP registry | §1.1 | Not found on the official MCP registry. Not disqualifying, but listed servers carry namespace-verified provenance. |
| PASS | Source repository is public and maintained | §1.2 | Active repository with a license. 5 findings
|
| INFO | Published package is consistent and attested | §1.3 | No published package associated with this server (remote-only or non-npm/PyPI source). |
| UNVERIFIABLE | Tool surface is inspectable and proportionate | §2.1–§2.4 | Tool surface could not be inspected (no reachable tools/list, no public package source). Per policy, unverifiability caps the overall grade. |
| INFO | Transport & authentication | §3 | Local (stdio) server: runs with host-process privileges by design. Transport checks apply to remote servers; scrutiny shifts to §1/§2. |
| INFO | No known vulnerabilities (OSV.dev) | §4.1 | No package to query (remote-only server). |
| UNVERIFIABLE | Server-supplied instructions free of poisoning indicators | §5.1–§5.4 | No server-supplied instructions or tool descriptions were obtainable to scan. |
Score history
| Date | Grade | Score |
|---|---|---|
| 2026-07-26 | B | 85/100 |
| 2026-07-24 | D | 50/100 |
What this grade covers
- Provenance & supply-chain integrity (§1)
- Tool surface & capability risk (§2)
- Transport & authentication (§3)
- Known CVEs via OSV.dev (§4)
- Instruction/tool poisoning patterns (§5)
Limitations: pattern-based only (no semantic injection detection), static npm analysis (live server instructions not retrieved for package-only scans), single-server scope (no cross-server toxic flow analysis). See the full policy.
Methodology: MCP Server Security Policy. Unfamiliar term? See the glossary.