Close Open Privacy Scan
App Privacy Score
Low risk · 265 finding(s)
Based on: 6 first-party package(s) · 12/15 deps analyzed
Dependency score: 82 (Low risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz External domains
api.github.comcaca.zoy.orgcdn.jsdelivr.netcontext7.comgithub.comlogin.microsoftonline.commcp.context7.comraw.githubusercontent.comregistry.npmjs.orgsam.zoy.orgwww.googleapis.comwww.rfc-editor.org
</> First-Party Code
first-party (npm): packages/cli
npm first-partyexpand_more 119 low-confidence finding(s)
low env_fs — Filesystem access. 91 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 21 locations
low env_fs — Environment-variable access. 7 locations
first-party (npm): packages/mcp
npm first-partyexpand_more 21 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 4 locations
low env_fs — Environment-variable access. 13 locations
low env_fs — Filesystem access. 4 locations
first-party (npm): packages/pi
npm first-partyexpand_more 6 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 2 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations
first-party (npm): packages/sdk
npm first-partyexpand_more 18 low-confidence finding(s)
low env_fs — Environment-variable access. 13 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
first-party (npm): packages/tools-ai-sdk
npm first-partyexpand_more 2 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
</> Dependencies
@modelcontextprotocol/sdk
npm dependencyexpand_more 38 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 22 locations
const response = await fetch(url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
writeFileSync(outputPath, fullContent, 'utf-8');Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Environment-variable access. 14 locations
@upstash/redis
npm dependencyexpand_more 16 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 12 locations
low env_fs — Environment-variable access. 4 locations
commander
npm dependencyexpand_more 5 low-confidence finding(s)
low env_fs — Environment-variable access. 5 locations
express
npm dependencyexpand_more 1 low-confidence finding(s)
var env = process.env.NODE_ENV || 'development';Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
figlet
npm dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
jose
npm dependencyexpand_more 23 low-confidence finding(s)
low env_fs — Filesystem access. 21 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 2 locations
ora
npm dependencyexpand_more 1 low-confidence finding(s)
if (process.env.NODE_ENV === 'test') {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
undici
npm dependencyexpand_more 13 low-confidence finding(s)
low env_fs — Environment-variable access. 7 locations
return session.request(headers, options)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs — Filesystem access. 5 locations
Skipped dependencies
Production
- @inquirer/core prod — dist-only: no readable source
- @inquirer/type prod — dist-only: no readable source
- @inquirer/prompts prod — dist-only: no readable source