Close Open Privacy Scan

bolt Snapshot: commit d31124c
science engine v1.23
schedule 2026-07-27T01:10:05.383567+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

smart_toy MCP server detected: @modelcontextprotocol/sdk, @modelcontextprotocol/server-everything, @modelcontextprotocol/server-filesystem, @modelcontextprotocol/server-memory +2 more — detected in dependencies, not a safety judgment.

App Privacy Score

90 /100
Low privacy risk

Low risk · 166 finding(s)

Based on: 8 first-party package(s) · 21/21 deps analyzed

Dependency score: 82 (Low risk)

bar_chart Score Breakdown

egress −10

list Scan Summary

0 high 0 medium 166 low
First-party packages: 2
Dependency packages: 8
Ecosystem: python

swap_horiz External domains

::ffff:192.168.0.1brotlipy.readthedocs.iobugs.python.orgclick.palletsprojects.comdatatracker.ietf.orgdeveloper.mozilla.orgdiscuss.python.orgdocs.pydantic.devdocs.python.orgdocs.rsen.wikipedia.orgerrors.pydantic.devexam_ple.comfoo.comgist.github.comgit-scm.comgithub.bloggithub.comhttpbin.orghypothesis.readthedocs.iojson-schema.orglearn.microsoft.commodelcontextprotocol.iomypy.readthedocs.iomüller.denats.ioother.compackaging.python.orgpeps.python.orgpydantic-docs.helpmanual.iopypi.orgpython-devtools.helpmanual.ioraw.githubusercontent.comrequests.readthedocs.iorich.readthedocs.iostackoverflow.comstuk.github.iotools.ietf.orgunpkg.comwww.example.珠宝www.python.orgwww.rfc-editor.orgwww.w3.orgwww.xudongz.comxn--fiqs8s.icom.museum

</> First-Party Code

first-party (npm)

python first-party
expand_more 5 low-confidence finding(s)

first-party (python): src/fetch

python first-party
expand_more 2 low-confidence finding(s)
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations

</> Dependencies

click

python dependency
expand_more 31 low-confidence finding(s)
low env_fs Filesystem access. 8 locations
low env_fs Environment-variable access. 23 locations

gitpython

python dependency
expand_more 55 low-confidence finding(s)
low env_fs Filesystem access. 32 locations
low env_fs Environment-variable access. 23 locations

mcp

python dependency
expand_more 39 low-confidence finding(s)
low env_fs Environment-variable access. 16 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 6 locations
low env_fs Filesystem access. 15 locations
low egress Hardcoded external endpoint. Review what data is sent to this destination. 2 locations

tzlocal

python dependency
expand_more 8 low-confidence finding(s)
low env_fs Filesystem access. 5 locations
low env_fs Environment-variable access. 2 locations
low egress dependency Excluded from app score #5e7a673c55768d3a capability detected · no path traced Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/update_windows_mappings.py:60
    source = urlopen(WIN_ZONES_URL).read()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.