Report 01M7BVKKT9T3PZRSPTXV696BSV · checks-v2

Siftable MCP server: automated checks

What HostedMCP checked on 14 Nov 2026, 01:44 UTC. Every result links to the public source it came from, so you can check it yourself.

Passed HostedMCP checks

93/100

8 of 11 checks ran · 0 high findings · not a security audit

Checked: 14 Nov 2026, 01:44 UTC
Commit: —
Package: @siftable/mcp-server · 1.5.1
Methodology: checks-v2

What to fix for a higher score

3 checks can earn more points. The next scan runs within a week, or right after the repository changes.

Build provenance (Sigstore attestation) up to +10 pts
Publish with build provenance: npm publish --provenance from GitHub Actions with id-token: write, or PyPI Trusted Publishing, which adds attestations.
OpenSSF Scorecard up to +15 pts
Add the OpenSSF Scorecard action (ossf/scorecard-action) to the repository and fix the weakest checks it lists, such as branch protection, pinned dependencies and token permissions.
Remote endpoint answers the MCP handshake up to +5 pts
Serve the remote endpoint over HTTPS and make sure it answers an MCP initialize request, or returns 401 when sign-in is required.

Origin

15 / 15 points

Source repository linked and reachable10 pts
execufunction-mcp/mcp-server is public and reachable
github.com/execufunction-mcp/mcp-server ↗
Pass
Package names this repository as its source5 pts
Not checked
Build provenance (Sigstore attestation)10 pts
No build attestation published for this release
How to fix: Publish with build provenance: npm publish --provenance from GitHub Actions with id-token: write, or PyPI Trusted Publishing, which adds attestations.
Not checked
Open source license (OSI)5 pts
MIT
spdx.org/licenses/MIT.html ↗
Pass

Practices

5 / 5 points

Commit or release in the last year5 pts
Last commit or release 2026-10-27
github.com/execufunction-mcp/mcp-server ↗
Pass
OpenSSF Scorecard15 pts
How to fix: Add the OpenSSF Scorecard action (ossf/scorecard-action) to the repository and fix the weakest checks it lists, such as branch protection, pinned dependencies and token permissions.
Not checked

Supply chain

25 / 25 points

Package name not close to a popular package10 pts
No popular package one edit away from @siftable/mcp-server
Pass
No critical advisory in the package or its dependencies15 pts
113 resolved dependencies checked; no critical advisory
osv.dev ↗
Pass

Tool safety

20 / 20 points

No hidden instructions to the model15 pts
106 tool descriptions and the README read; no override phrases, credential paths or hidden characters
Pass
Destructive tools are labelled5 pts
No tool named like delete, drop or exec
Pass

Endpoint

0 / 5 points

Remote endpoint answers the MCP handshake5 pts
Endpoint did not answer initialize: HTTP 525
How to fix: Serve the remote endpoint over HTTPS and make sure it answers an MCP initialize request, or returns 401 when sign-in is required.
Finding

What these checks do not cover

The server's code is not run and its logic is not audited.
Results describe the repository and package on the date above; a later release can differ.
A pass is not a guarantee of safety. Give every server the narrowest token or role it needs.

What to fix for a higher score

3 checks can earn more points. The next scan runs within a week, or right after the repository changes.

Build provenance (Sigstore attestation) up to +10 pts

Publish with build provenance: npm publish --provenance from GitHub Actions with id-token: write, or PyPI Trusted Publishing, which adds attestations.

OpenSSF Scorecard up to +15 pts

Add the OpenSSF Scorecard action (ossf/scorecard-action) to the repository and fix the weakest checks it lists, such as branch protection, pinned dependencies and token permissions.

Remote endpoint answers the MCP handshake up to +5 pts

Serve the remote endpoint over HTTPS and make sure it answers an MCP initialize request, or returns 401 when sign-in is required.