Close Open Privacy Scan

bolt Snapshot: commit 43eb386
science engine v1.23
schedule 2026-07-28T11:17:38.681049+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

smart_toy AI deps detected: fastmcp — detected in dependencies, not a safety judgment.

App Privacy Score

82 /100
Low privacy risk

Low risk · 100 finding(s)

Based on: 2 first-party package(s) · 4/6 deps analyzed

Dependency score: 97 (Low risk)

bar_chart Score Breakdown

egress −15
env_fs −3

list Scan Summary

0 high 0 medium 100 low
First-party packages: 2
Dependency packages: 3
Ecosystem: python

swap_horiz External domains

api.github.comchromium.googlesource.comdatatracker.ietf.orgdeveloper.android.comgithub.compackaging.python.orgpypi.orgrefspecs.linuxfoundation.orgwww.linkedin.com

</> First-Party Code

first-party (python): linkedin_mcp_server

python first-party
expand_more 58 low-confidence finding(s)
low env_fs Environment-variable access. 41 locations
low env_fs Filesystem access. 14 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations
low egress production #b6526a2b4670c13a capability detected · no path traced Hardcoded external endpoint. Review what data is sent to this destination.
repo/linkedin_mcp_server/update_check.py:105
    request = Request(
        _PYPI_URL,
        headers={
            "Accept": "application/json",
            "User-Agent": f"mcp-server-linkedin/{__version__}",
        },
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

</> Dependencies

cryptography

python dependency
expand_more 22 low-confidence finding(s)
low env_fs Filesystem access. 18 locations
low env_fs Environment-variable access. 4 locations

packaging

python dependency

Skipped dependencies

Production

  • fastmcp prod — sdist exceeds byte cap
  • patchright prod — no sdist (wheels only)