Report 01M7BZKSH14R53640F0PSPT1A0 · checks-v2

Lockbox MCP server: automated checks

What HostedMCP checked on 14 Nov 2026, 02:54 UTC. Every result links to the public source it came from, so you can check it yourself.

Passed HostedMCP checks

85/100

7 of 11 checks ran · 0 high findings · not a security audit

Checked: 14 Nov 2026, 02:54 UTC
Commit: —
Package: vaultbox · 0.1.1
Methodology: checks-v2

What to fix for a higher score

4 checks can earn more points. The next scan runs within a week, or right after the repository changes.

Package names this repository as its source up to +5 pts
Point the package's repository field at this repository, or list the package under the repository that publishes it.
Build provenance (Sigstore attestation) up to +10 pts
Publish with build provenance: npm publish --provenance from GitHub Actions with id-token: write, or PyPI Trusted Publishing, which adds attestations.
Open source license (OSI) up to +5 pts
Add a LICENSE file with an OSI-approved license such as MIT or Apache-2.0, and name it in package.json or pyproject.toml.
OpenSSF Scorecard up to +15 pts
Add the OpenSSF Scorecard action (ossf/scorecard-action) to the repository and fix the weakest checks it lists, such as branch protection, pinned dependencies and token permissions.

Origin

10 / 20 points

Source repository linked and reachable10 pts
sathergate/sathergate-toolkit is public and reachable
github.com/sathergate/sathergate-toolkit ↗
Pass
Package names this repository as its source5 pts
vaultbox names git+https://github.com/sathergate/lockbox.git as its source
npmjs.com/package/vaultbox ↗
How to fix: Point the package's repository field at this repository, or list the package under the repository that publishes it.
Finding
Build provenance (Sigstore attestation)10 pts
No build attestation published for this release
How to fix: Publish with build provenance: npm publish --provenance from GitHub Actions with id-token: write, or PyPI Trusted Publishing, which adds attestations.
Not checked
Open source license (OSI)5 pts
No license
How to fix: Add a LICENSE file with an OSI-approved license such as MIT or Apache-2.0, and name it in package.json or pyproject.toml.
Finding

Practices

5 / 5 points

Commit or release in the last year5 pts
Last commit or release 2026-09-11
github.com/sathergate/sathergate-toolkit ↗
Pass
OpenSSF Scorecard15 pts
How to fix: Add the OpenSSF Scorecard action (ossf/scorecard-action) to the repository and fix the weakest checks it lists, such as branch protection, pinned dependencies and token permissions.
Not checked

Supply chain

25 / 25 points

Package name not close to a popular package10 pts
No popular package one edit away from vaultbox
Pass
No critical advisory in the package or its dependencies15 pts
1 resolved dependencies checked; no critical advisory
osv.dev ↗
Pass

Tool safety

15 / 15 points

No hidden instructions to the model15 pts
0 tool descriptions and the README read; no override phrases, credential paths or hidden characters
Pass
Destructive tools are labelled5 pts
Not checked

Endpoint

not checked

Remote endpoint answers the MCP handshake5 pts
Not checked

What these checks do not cover

The server's code is not run and its logic is not audited.
Results describe the repository and package on the date above; a later release can differ.
A pass is not a guarantee of safety. Give every server the narrowest token or role it needs.

What to fix for a higher score

4 checks can earn more points. The next scan runs within a week, or right after the repository changes.

Package names this repository as its source up to +5 pts

Point the package's repository field at this repository, or list the package under the repository that publishes it.

Build provenance (Sigstore attestation) up to +10 pts

Publish with build provenance: npm publish --provenance from GitHub Actions with id-token: write, or PyPI Trusted Publishing, which adds attestations.

Open source license (OSI) up to +5 pts

Add a LICENSE file with an OSI-approved license such as MIT or Apache-2.0, and name it in package.json or pyproject.toml.

OpenSSF Scorecard up to +15 pts

Add the OpenSSF Scorecard action (ossf/scorecard-action) to the repository and fix the weakest checks it lists, such as branch protection, pinned dependencies and token permissions.