Directory / server

com.arcself/arc-security

This directory entry reports an automated security scan of com.arcself/arc-security, scanned 2026-07-28. Trust grade C rates provenance, transport, known vulnerabilities and instruction integrity; capability risk is reported separately, not folded into the grade.

registry.modelcontextprotocol.io, scanned 2026-07-28, tool surface via package-source

C 68/100 permalink

Automated checks

Status	Check	Policy	Result
PASS	Listed on the official MCP registry	§1.1	Listed on registry.modelcontextprotocol.io as com.arcself/arc-security. 1 finding Registry entry: com.arcself/arc-security ↗
FAIL	Source repository is public and maintained	§1.2	Claimed source repository does not exist (or is private).
WARN	Published package is consistent and attested	§1.3	Minor integrity gaps: no npm provenance attestation. 6 findings Package: arc-security-mcp@0.5.1 ↗ Ecosystem: npm Age: 160 days Weekly downloads: 73 Repo field matches source repo: true Build-provenance attestation: absent
PASS	Tool surface is inspectable and proportionate	§2.1–§2.4	Package source scanned. Capabilities detected: process-execution, filesystem, network-egress. Reported as capability risk (§2.4); whether each is essential to the server's stated purpose is §2.3 and remains a manual judgement. 8 findings process-execution (child process execution): bin/arc-security-mcp.js process-execution (child process module import): bin/arc-security-mcp.js filesystem (filesystem write/delete): bin/arc-security-mcp.js filesystem (fs module import): bin/arc-security-mcp.js process-execution (child process execution): server.py process-execution (dynamic code evaluation): server.py network-egress (outbound network calls): server.py Detected capabilities: process-execution, filesystem, network-egress
INFO	Transport & authentication	§3	Local (stdio) server: runs with host-process privileges by design. Transport checks apply to remote servers; scrutiny shifts to §1/§2.
PASS	No known vulnerabilities (OSV.dev)	§4.1	No advisories on record for arc-security-mcp @0.5.1 (npm).
UNVERIFIABLE	Server-supplied instructions free of poisoning indicators	§5.1–§5.4	No server-supplied instructions or tool descriptions were obtainable to scan.

What this grade covers

Provenance & supply-chain integrity (§1)
Tool surface & capability risk (§2)
Transport & authentication (§3)
Known CVEs via OSV.dev (§4)
Instruction/tool poisoning patterns (§5)

Limitations: pattern-based only (no semantic injection detection), static npm analysis (live server instructions not retrieved for package-only scans), single-server scope (no cross-server toxic flow analysis). See the full policy.

Methodology: MCP Server Security Policy. Unfamiliar term? See the glossary.