REPORT 01M7CMS9206HQG8KFHGZ9FVYR3 · checks-v2
Jitapi MCP server: automated checks
What HostedMCP checked on 14 Nov 2026, 09:04 UTC for jitapi 0.1.1. Every result links to the public source it came from, so you can check it yourself.
Not verified
77/100
7 of 11 checks ran · 1 high finding · not a security audit
- Checked
- 14 Nov 2026, 09:04 UTC
- Commit
- —
- Package
- pypi · 0.1.1
- Methodology
- checks-v2
Origin
20 / 20 points- PassSource repository linked and reachable10 pts
nk3750/jitapi is public and reachable
github.com/nk3750/jitapi ↗ - PassPackage names this repository as its source5 pts
jitapi names nk3750/jitapi as source
pypi.org/project/jitapi/ ↗ - Not checkedBuild provenance (Sigstore attestation)10 pts
No build attestation published for this release
- Pass
Practices
5 / 5 points- Pass
- Not checkedOpenSSF Scorecard15 pts
Supply chain
10 / 25 points- PassPackage name not close to a popular package10 pts
No popular package one edit away from jitapi
- FindingNo critical advisory in the package or its dependencies15 pts
Critical advisory: GHSA-36p7-vc44-83pf, GHSA-f4j7-r4q5-qw2c
osv.dev/vulnerability/GHSA-36p7-vc44-83pf ↗
Tool safety
15 / 15 points- PassNo hidden instructions to the model15 pts
8 tool descriptions and the README read; no override phrases, credential paths or hidden characters
- Not checkedDestructive tools are labelled5 pts
Endpoint
not checked- Not checkedRemote endpoint answers the MCP handshake5 pts
What these checks do not cover
- The server's code is not run and its logic is not audited.
- Results describe the state on the date above and jitapi 0.1.1; a later release can differ.
- A pass is not a guarantee of safety. Give every server the narrowest token or role it needs.