{"name":"io.github.tombaldwin/candor","slug":"tombaldwin-candor","title":"candor","description":"Per-function effect analysis for agents: blast radius, what reaches the network, gate verdicts.","url":"https://mcp.market/server/tombaldwin-candor","rating":null,"grade":"A","score":85,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":33,"stars":0,"forks":0,"downloads_week":1181,"last_push_at":"2026-09-18T03:10:47.000Z","license":"Apache-2.0"},"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/tombaldwin/candor-ts","website":"https://candor.poly.io","version":"0.38.3","remotes":[],"packages":[{"registryType":"npm","identifier":"candor-ts","version":"0.38.3","transport":{"type":"stdio"},"packageArguments":[{"value":"--mcp","type":"positional"}],"environmentVariables":[{"description":"Lock the server to one workspace: every report prefix is resolved under this root. Unset, the server reads .candor/ relative to the client's working directory.","name":"CANDOR_ROOT"}]}],"tools":[],"scan":{"score":85,"grade":"A","scanned_at":"2026-09-19T10:14:13.734Z","report":{"scannerVersion":"0.1.3","scannedAt":"2026-09-19T10:14:13.718Z","components":{"code":{"score":20,"max":25,"notes":["21 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 1 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"scan.mjs: …asured: a `pkgc#both` doing // `eval(k)` (its own `reflect:`) and calling a `…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"candor-ts","version":"0.38.3","found":true,"license":"(MIT OR Apache-2.0)","hasInstallScripts":false,"dependencyCount":2,"publishedAt":"2026-09-16T13:02:15.679Z","repositoryUrl":"git+https://github.com/tombaldwin/candor-ts.git","weeklyDownloads":1181}],"repo":{"found":true,"owner":"tombaldwin","repo":"candor-ts","archived":false,"pushedAt":"2026-09-18T03:10:47Z","stars":0,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/1909530?v=4","ownerCreatedAt":"2012-06-30T19:25:55Z","license":"Apache-2.0"},"icon":{"url":"https://candor.poly.io/favicon/candor/apple-touch-180.png?v=07e0e39b","source":"site","width":180,"height":180},"presence":{"stars":0,"forks":0,"downloadsWeek":1181,"license":"Apache-2.0","lastPushAt":"2026-09-18T03:10:47.000Z","score":33}}}},"grade_history":[],"reviews":[]}