Report 01M7FYME3FTEW32V42RBNQ9FW7 · checks-v2

Pulr MCP server: automated checks

What HostedMCP checked on 15 Nov 2026, 15:53 UTC. Every result links to the public source it came from, so you can check it yourself.

Not verified

33/100

4 of 11 checks ran · 1 high finding · not a security audit

Checked: 15 Nov 2026, 15:53 UTC
Commit: —
Package: hosted endpoint
Methodology: checks-v2

What to fix for a higher score

2 checks can earn more points. The next scan runs within a week, or right after the repository changes.

OpenSSF Scorecard up to +15 pts
Add the OpenSSF Scorecard action (ossf/scorecard-action) to the repository and fix the weakest checks it lists, such as branch protection, pinned dependencies and token permissions.
No hidden instructions to the model up to +15 pts
Remove text the model would read as an order from tool descriptions and the README: phrases like "ignore previous instructions", IMPORTANT tags, requests to hide things from the user, paths to credential files, and hidden Unicode characters.

Origin

15 / 15 points

Source repository linked and reachable10 pts
taleilon/pulr is public and reachable
github.com/taleilon/pulr ↗
Pass
Package names this repository as its source5 pts
Not checked
Build provenance (Sigstore attestation)10 pts
Not checked
Open source license (OSI)5 pts
MIT
spdx.org/licenses/MIT.html ↗
Pass

Practices

5 / 5 points

Commit or release in the last year5 pts
Last commit or release 2026-11-01
github.com/taleilon/pulr ↗
Pass
OpenSSF Scorecard15 pts
How to fix: Add the OpenSSF Scorecard action (ossf/scorecard-action) to the repository and fix the weakest checks it lists, such as branch protection, pinned dependencies and token permissions.
Not checked

Supply chain

not checked

Package name not close to a popular package10 pts
Not checked
No critical advisory in the package or its dependencies15 pts
Not checked

Tool safety

0 / 15 points

No hidden instructions to the model15 pts
Instruction aimed at the model found in the description or README
How to fix: Remove text the model would read as an order from tool descriptions and the README: phrases like "ignore previous instructions", IMPORTANT tags, requests to hide things from the user, paths to credential files, and hidden Unicode characters.
Finding
Destructive tools are labelled5 pts
Not checked

Endpoint

not checked

Remote endpoint answers the MCP handshake5 pts
Not checked

What these checks do not cover

The server's code is not run and its logic is not audited.
Results describe the repository and package on the date above; a later release can differ.
A pass is not a guarantee of safety. Give every server the narrowest token or role it needs.

What to fix for a higher score

2 checks can earn more points. The next scan runs within a week, or right after the repository changes.

OpenSSF Scorecard up to +15 pts

Add the OpenSSF Scorecard action (ossf/scorecard-action) to the repository and fix the weakest checks it lists, such as branch protection, pinned dependencies and token permissions.

No hidden instructions to the model up to +15 pts

Remove text the model would read as an order from tool descriptions and the README: phrases like "ignore previous instructions", IMPORTANT tags, requests to hide things from the user, paths to credential files, and hidden Unicode characters.