{"name":"io.github.navig-run/navig","slug":"navig-run-navig","title":null,"description":"Local operator tools over your own sessions, knowledge, files, shell and devices.","url":"https://mcp.market/server/navig-run-navig","rating":null,"grade":"C","score":57,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":40,"stars":5,"forks":2,"downloads_week":885,"last_push_at":"2026-10-26T06:45:20.000Z","license":"NOASSERTION"},"uptime":null,"claimed":false,"transport":"pypi","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/navig-run/core","website":"https://navig.run","version":"3.27.5","remotes":[],"packages":[{"registryType":"pypi","registryBaseUrl":"https://pypi.org","identifier":"navig","version":"3.27.5","runtimeHint":"navig","transport":{"type":"stdio"}}],"tools":[],"scan":{"score":57,"grade":"C","scanned_at":"2026-10-27T05:18:52.142Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-27T05:18:52.091Z","components":{"code":{"score":3,"max":25,"notes":["1500 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 1 days ago"]},"identity":{"score":7,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[{"id":"exec.shell-true","severity":"medium","component":"code","title":"subprocess with shell=True","evidence":"navig-3.27.5/navig/agent/action_registry.py: …s.run, cmd_str, shell=True, capture_output=True, …"},{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"navig-3.27.5/navig/commands/eval.py: … context will be empty result = eval(expression, {\"__builtins__\": {}}, ctx) …"},{"id":"exec.shell-concat","severity":"high","component":"code","title":"Shell command built from a string (injection risk)","evidence":"navig-3.27.5/navig/desktop/tray_app.py: …echo.' try: subprocess.Popen(f'cmd /k \"{init}\"', creationflags=subproce…"}],"inputs":{"packages":[{"registryType":"pypi","identifier":"navig","version":"3.27.5","found":true,"weeklyDownloads":885,"license":"Apache-2.0","dependencyCount":82,"publishedAt":"2026-10-19T20:04:35.710698Z","repositoryUrl":"https://github.com/navig-run/core"}],"repo":{"found":true,"owner":"navig-run","repo":"core","archived":false,"pushedAt":"2026-10-26T06:45:20Z","stars":5,"forks":2,"openIssues":2,"ownerType":"Organization","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/261189068?v=4","ownerCreatedAt":"2026-02-12T11:53:05Z","license":"NOASSERTION"},"icon":{"url":"https://avatars.githubusercontent.com/u/261189068?v=4&s=128","source":"github"},"presence":{"stars":5,"forks":2,"downloadsWeek":885,"license":"NOASSERTION","lastPushAt":"2026-10-26T06:45:20.000Z","score":40}}}},"grade_history":[],"reviews":[]}