Close Open Privacy Scan
App Privacy Score
Medium risk · 458 finding(s)
Based on: 1 first-party package(s) · 10/11 deps analyzed
Dependency score: 82 (Low risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz External domains
api.github.comgithub.comjson-schema.orgo1.ingest.us.sentry.ioraw.githubusercontent.comunpkg.comwww.apple.comxcodebuildmcp.com
</> First-Party Code
first-party (npm)
npm first-partyimport * as Sentry from '@sentry/node';A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
import type * as Sentry from '@sentry/node';A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
cachedSentry = require('@sentry/node') as SentryModule;A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
import * as Sentry from '@sentry/node';A telemetry/analytics SDK is used; event data is sent to a third-party collector.
Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 406 low-confidence finding(s)
low env_fs — Filesystem access. 223 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 4 locations
headers: {
Accept: 'application/vnd.github+json',
Authorization: `Bearer ${process.env.GITHUB_TOKEN}`,
'X-GitHub-Api-Version': '2022-11-28',
...requestOptions.headers,
},A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.
Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
low env_fs — Environment-variable access. 178 locations
</> Dependencies
@modelcontextprotocol/sdk
npm dependencyexpand_more 38 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 22 locations
const response = await fetch(url);Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
writeFileSync(outputPath, fullContent, 'utf-8');Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Environment-variable access. 14 locations
bplist-parser
npm dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
chokidar
npm dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
glob
npm dependencyexpand_more 4 low-confidence finding(s)
yargs
npm dependencyexpand_more 1 low-confidence finding(s)
return process.env[key]Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Skipped dependencies
Production
- @clack/prompts prod — dist-only: no readable source