Mmcp.market

Is Zoteus safe?

Yes, with the usual care.

B78/100grade B

Safe to use. Minor gaps such as a missing repository or slower maintenance.

What to know before installing
  • highShell command built from a string (injection risk)

Public scan report

scanner v0.1.3 · 2026-09-19 · same rubric, same numbers if you re-run it

1 high1 medium
  • Code scan245 source files scanned8/25
  • Live reliabilityremote reachable in 151ms (auth required)20/20
  • –Tool poisoningtools not inspected (endpoint requires auth); not countedn/a
  • Auth qualityOAuth resource metadata advertised on 40115/15
  • Maintenancelast push 2 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (2)

  • mediumNetwork call to a raw IP addressnet.raw-ip
    dist/api/local-writes.d.ts: …to the same local API the reads use * (http://127.0.0.1:23119/api/users/0/...), gated by a *local* API…
  • highShell command built from a string (injection risk)exec.shell-concat
    dist/features/search/sqlite-index.js: …F EXISTS passages_fts'); db.exec(` CREATE VIRTUAL TABLE passages_fts USING fts5( text, content='passages', content_rowid='pid', tokenize='${FTS_TOKENIZER}' ); `); …
Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Full listing, tools and install