Report 01M7A023ZD7HDSRP09Z3K5N4F2 · static-2

Work Iq MCP server: automated checks

What HostedMCP checked on 13 Nov 2026, 08:23 UTC. Every result links to the public source it came from, so you can check it yourself.

Passed HostedMCP checks

86/100

5 of 8 checks ran · 0 high findings · not a security audit

Checked: 13 Nov 2026, 08:23 UTC
Commit: —
Package: @microsoft/workiq · latest
Methodology: static-2

What to fix for a higher score

One check can earn more points. The next scan runs within a week, or right after the repository changes.

Open source license (OSI) up to +10 pts
Add a LICENSE file with an OSI-approved license such as MIT or Apache-2.0, and name it in package.json or pyproject.toml.

Origin

15 / 25 points

Source repository linked and reachable15 pts
Pass
Open source license (OSI)10 pts
No license
How to fix: Add a LICENSE file with an OSI-approved license such as MIT or Apache-2.0, and name it in package.json or pyproject.toml.
Finding

Practices

10 / 10 points

Commit or release in the last year10 pts
Pass

Supply chain

15 / 15 points

Package name not close to a popular package15 pts
Pass
No critical advisory in the package or its dependencies10 pts
Not checked

Tool safety

20 / 20 points

Destructive tools are labelled10 pts
Not checked
No hidden instructions to the model20 pts
Pass

Endpoint

not checked

Remote endpoint uses HTTPS10 pts
Not checked

What these checks do not cover

The server's code is not run and its logic is not audited.
Results describe the repository and package on the date above; a later release can differ.
A pass is not a guarantee of safety. Give every server the narrowest token or role it needs.