{"name":"io.github.DeepSleuth/deepsleuth","slug":"deepsleuth","title":"Deepsleuth","description":"Deterministic, no-LLM security scanner for MCP servers, plus an inline proxy gate.","url":"https://mcp.market/server/deepsleuth","rating":null,"grade":"C","score":55,"certified":false,"status":"active","category":"ai","tags":["ai","security"],"presence":{"score":36,"stars":1,"forks":0,"downloads_week":940,"last_push_at":"2026-10-07T11:46:46.000Z","license":"Apache-2.0"},"uptime":null,"claimed":false,"transport":"pypi","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/DeepSleuth/deepsleuth-mcp","website":"https://github.com/DeepSleuth/deepsleuth-mcp","version":"1.0.4","remotes":[],"packages":[{"registryType":"pypi","registryBaseUrl":"https://pypi.org","identifier":"security-scanner-deepsleuth-mcp","version":"1.0.4","transport":{"type":"stdio"}}],"tools":[{"name":"docstring_param_docs","description":"Parameter names (and their text) from a docstring's argument section: Google (``Args:`` then ``name (type): text``), numpy (``Parameters``, a dashed underline, ``name : type`` with indented text) and Sphinx (``:param name: text``). Structural: a header line, then entries indented deeper than it; a non-blank line at or above the header's indent, or another section header, ends the section.","write_action":false,"price_micros":0,"input_schema":null},{"name":"find_duplicate_tool_defs","description":"","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":55,"grade":"C","scanned_at":"2026-10-13T23:18:42.265Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-13T23:18:42.242Z","components":{"code":{"score":3,"max":25,"notes":["47 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 6 days ago"]},"identity":{"score":6,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[{"id":"exec.shell-true","severity":"medium","component":"code","title":"subprocess with shell=True","evidence":"security_scanner_deepsleuth_mcp-1.0.4/deepsleuth/analysis/buildbackend.py: …n``/``os.exec*``, ``subprocess`` with ``shell=True`` or with a shell / downloader as arg…"},{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"security_scanner_deepsleuth_mcp-1.0.4/deepsleuth/analysis/constfold.py: …o] = {} self.steps = 0 def eval(self, node: ast.AST, loc: Dict[str, Any]…"},{"id":"env.dump","severity":"high","component":"code","title":"Whole environment serialized (possible credential exfil)","evidence":"security_scanner_deepsleuth_mcp-1.0.4/deepsleuth/analysis/envdump.py: …ronment -- ``str(dict(os.environ))``, ``json.dumps(dict(os.environ))``, a loop over ``os.environ.items()`` …"}],"inputs":{"packages":[{"registryType":"pypi","identifier":"security-scanner-deepsleuth-mcp","version":"1.0.4","found":true,"weeklyDownloads":940,"license":"Apache-2.0","dependencyCount":2,"publishedAt":"2026-10-07T11:46:52.506914Z","repositoryUrl":"https://github.com/DeepSleuth/deepsleuth-mcp"}],"repo":{"found":true,"owner":"DeepSleuth","repo":"deepsleuth-mcp","archived":false,"pushedAt":"2026-10-07T11:46:46Z","stars":1,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/338080601?v=4","ownerCreatedAt":"2026-10-05T10:39:44Z","license":"Apache-2.0"},"icon":{"url":"https://raw.githubusercontent.com/DeepSleuth/deepsleuth-mcp/main/docs/deepsleuth-icon.svg","source":"registry"},"presence":{"stars":1,"forks":0,"downloadsWeek":940,"license":"Apache-2.0","lastPushAt":"2026-10-07T11:46:46.000Z","score":36}}}},"grade_history":[],"reviews":[]}