{"name":"io.github.pranlabs/valca","slug":"pranlabs-valca","title":"Valca","description":"Scans code, IaC and AI-agent config for security problems. Read-only — nothing can be edited.","url":"https://mcp.market/server/pranlabs-valca","rating":null,"grade":"B","score":75,"certified":false,"status":"active","category":"ai","tags":["ai","security"],"presence":{"score":32,"stars":2,"forks":1,"downloads_week":71,"last_push_at":"2026-10-10T18:19:51.000Z","license":"NOASSERTION"},"uptime":null,"claimed":false,"transport":"pypi","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/PranLabs/valca","website":"https://valca.io","version":"0.6.1","remotes":[],"packages":[{"registryType":"pypi","registryBaseUrl":"https://pypi.org","identifier":"valca","version":"0.6.1","runtimeHint":"uvx","transport":{"type":"stdio"}}],"tools":[{"name":"list_rules","description":"Return the rule catalogue: every rule id, its severity, and what it catches.","write_action":false,"price_micros":0,"input_schema":null},{"name":"scan","description":"Scan a file or directory for security problems and return the findings.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":75,"grade":"B","scanned_at":"2026-10-14T05:23:16.105Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-14T05:23:16.063Z","components":{"code":{"score":15,"max":25,"notes":["38 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 3 days ago"]},"identity":{"score":7,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"valca-0.6.1/src/valca/rules/js_security.py: … baked into bundle VGL-JS004 HIGH eval() or new Function() with non-literal arg…"},{"id":"exec.shell-true","severity":"medium","component":"code","title":"subprocess with shell=True","evidence":"valca-0.6.1/src/valca/rules/secrets.py: … \"VGL-I002\" name = \"subprocess with shell=True\" severity = Severity.HIGH # Req…"}],"inputs":{"packages":[{"registryType":"pypi","identifier":"valca","version":"0.6.1","found":true,"weeklyDownloads":71,"dependencyCount":1,"publishedAt":"2026-09-28T01:01:09.921039Z","repositoryUrl":"https://github.com/PranLabs/valca"}],"repo":{"found":true,"owner":"PranLabs","repo":"valca","archived":false,"pushedAt":"2026-10-10T18:19:51Z","stars":2,"forks":1,"openIssues":0,"ownerType":"Organization","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/334695909?v=4","ownerCreatedAt":"2026-09-27T21:35:24Z","license":"NOASSERTION"},"icon":{"url":"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='7' fill='%23161b22'/%3E%3Cpath d='M9 11l7 12 7-12' fill='none' stroke='%2358d68d' stroke-width='2.6' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E","source":"site"},"presence":{"stars":2,"forks":1,"downloadsWeek":71,"license":"NOASSERTION","lastPushAt":"2026-10-10T18:19:51.000Z","score":32}}}},"grade_history":[],"reviews":[]}