# Security Audit Report — @p31/mcp-membrane - **Report ID:** `751a9b28-4ad8-48d2-8057-6faa933190c7` - **Generated:** 2026-08-13T14:42:55.173184+00:00 - **Signature:** unsigned (cosign keyless signing runs in CI; Req 22.4) ## 1. Executive Summary **Badge:** Verified (composite) **Security score:** 99.33 | Scanner | Badge | | --- | --- | | agent-audit-kit | Verified | | agentshield | Verified | | bearer | Verified | | capslock | not_applicable | | cisco-skill-scanner | Verified | | govulncheck | not_applicable | | nerlo-behavioral | Verified | | nerlo-install-instruction | Verified | | osv-scanner | Verified | | trivy | Verified | | trivy_image | not_applicable | | Severity | Findings | | --- | --- | | critical | 0 | | high | 0 | | medium | 0 | | low | 2 | | informational | 8 | @p31/mcp-membrane meets the registry's verification bar at scan time. Keep monitoring enabled — verification reflects this commit, not future releases. ## 2. Source Provenance - **Repository:** https://github.com/p31labs/mcp-membrane - **Commit scanned:** `unknown` - **License:** MIT - **Maintainer:** P31 Labs - **Version:** 1.0.0 ## 3. Per-Scanner Detail ### agentshield (v1.4.0) — Verified / 100.0 No findings. ### cisco-skill-scanner (v2.0.11) — Verified / 96.0 - **[informational] Critically low analyzability score** — [mcp_server policy: capability-matches-purpose class; severity high -> informational] Only 61% of skill content could be analyzed. 5 of 14 files are opaque to the scanner. The safety assessment has low confidence. (/repo:None) - **[informational] Vague skill description** — [mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation. (/repo/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/SKILL.md:None) - **[informational] Outbound network request primitives in JavaScript/TypeScript** — [mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch( (/repo/src/client.ts:13) - **[informational] Outbound network request primitives in JavaScript/TypeScript** — [mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch( (/repo/src/client.ts:19) - **[informational] Outbound network request primitives in JavaScript/TypeScript** — [mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch( (/repo/src/client.ts:26) - **[informational] Outbound network request primitives in JavaScript/TypeScript** — [mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch( (/repo/src/client.ts:40) - **[informational] Outbound network request primitives in JavaScript/TypeScript** — [mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch( (/repo/src/client.ts:50) ### agent-audit-kit (v0.3.26) — Verified / 98.0 - **[low] MCP server repo missing SECURITY.md or security_contact** — A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a 'security_contact' entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel. (SECURITY.md:None) ### bearer (v2.0.2) — Verified / 98.0 - **[low] Usage of insufficient random value** — \#\# Description Using predictable random values compromises your application's security, particularly if these values serve security-related functions. \#\# Remediations - **Do** use a robust library for generating random values to enhance security. '''javascript const crypto = require('crypto'); crypto.randomBytes(16).toString('hex'); ''' (/repo/src/server.ts:157) ### nerlo-behavioral (v0.1.0) — Verified / 100.0 No findings. ### nerlo-install-instruction (v0.1.0) — Verified / 100.0 No findings. ### capslock (vv0.3.2) — not_applicable / n/a No findings. ### trivy (v0.71.0) — Verified / 100.0 No findings. ### osv-scanner (v2.3.8) — Verified / 100.0 No findings. ### trivy_image (v0.71.0) — not_applicable / n/a No findings. ### govulncheck (vv1.6.0) — not_applicable / n/a No findings. ## 4. Threat Model Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report. ## 5. Audit Chain - **Scan job:** `99717501-4c50-4a1d-813f-11a534013c5d` - **Completed:** 2026-08-12T11:32:48.889026+00:00 - **Scanner base image:** `us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:5f45d10278ac35d7492d5f81d502a583236c7acdaed5bc2b0443a0c45cfbb4db` - **AI decision log entries:** 2 - `b70e3412-bb0d-410f-bb06-b47d7ea6132e` - `a772d54b-fed4-47c9-89b4-23acc4d00e9e` ## 6. Appendix — Raw Scanner Output ```json [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.6514659600215964, "status": "complete", "examined": { "unit": "scan_targets", "count": 1 }, "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [ "supply_chain" ] }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 96.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo", "line_number": null, "rule_identifier": "LOW_ANALYZABILITY", "title": "Critically low analyzability score", "description": "[mcp_server policy: capability-matches-purpose class; severity high -> informational] Only 61% of skill content could be analyzed. 5 of 14 files are opaque to the scanner. The safety assessment has low confidence.", "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence." }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "[mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "data_exfiltration", "file_path": "/repo/src/client.ts", "line_number": 13, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "data_exfiltration", "file_path": "/repo/src/client.ts", "line_number": 19, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "data_exfiltration", "file_path": "/repo/src/client.ts", "line_number": 26, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "data_exfiltration", "file_path": "/repo/src/client.ts", "line_number": 40, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "data_exfiltration", "file_path": "/repo/src/client.ts", "line_number": 50, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(", "remediation": "Ensure network operations are necessary and document allowed destinations" } ], "execution_duration_seconds": 7.145815700001549, "status": "complete", "examined": { "unit": "skills", "count": 1 }, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 0, "high": 0, "medium": 0, "critical": 0, "informational": 8 }, "artifact_type_policy": "mcp_server", "downweighted_findings": 7 }, "display_score": 96.0, "display_badge": "Verified" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 98.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "SECURITY.md", "line_number": null, "rule_identifier": "AAK-SEC-MD-001", "title": "MCP server repo missing SECURITY.md or security_contact", "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.", "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest." } ], "execution_duration_seconds": 0.7583637899952009, "status": "complete", "examined": { "unit": "files", "count": 14 }, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 1, "high": 0, "medium": 0, "critical": 0, "informational": 0 } }, "display_score": 98.0, "display_badge": "Verified" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 98.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "bearer", "severity": "low", "category": null, "file_path": "/repo/src/server.ts", "line_number": 157, "rule_identifier": null, "title": "Usage of insufficient random value", "description": "## Description\n\nUsing predictable random values compromises your application's security, particularly if these values serve security-related functions.\n\n## Remediations\n\n- **Do** use a robust library for generating random values to enhance security.\n ```javascript\n const crypto = require('crypto');\n crypto.randomBytes(16).toString('hex');\n ```", "remediation": null } ], "execution_duration_seconds": 6.37024376395857, "status": "complete", "examined": { "unit": "files", "count": 5 }, "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 554, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"", "severity_counts": { "low": 1, "high": 0, "medium": 0, "critical": 0, "informational": 0 } }, "display_score": 98.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 3.6500098810065538, "status": "complete", "examined": { "unit": "files", "count": 5 }, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "ruleset_paths": [ "/opt/nerlo-rules/exfiltration.yaml", "/opt/nerlo-rules/clipboard_exfiltration.yaml", "/opt/nerlo-rules/rce_endpoint.yaml", "/opt/nerlo-rules/taint_egress.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "merged_invocation": true }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 3.650298860971816, "status": "complete", "examined": { "unit": "files", "count": 2 }, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "ruleset_paths": [ "/opt/nerlo-rules/install_instructions.yaml", "/opt/nerlo-rules/cursor_rules.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "merged_invocation": true }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "capslock", "scanner_version": "v0.3.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.1844658269546926, "status": "not_applicable", "examined": { "unit": "packages", "count": 0 }, "metadata": { "source": "go-module-proxy", "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2", "report_type": "go-capability", "vendor_mode": false, "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2 # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=", "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute", "go_files_present": 0, "artifact_type_policy": "mcp_server", "expected_capabilities": [ "CAPABILITY_FILES", "CAPABILITY_NETWORK", "CAPABILITY_READ_SYSTEM_STATE", "CAPABILITY_REFLECT", "CAPABILITY_RUNTIME" ], "artifact_type_explicit": true }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.1755689539713785, "status": "complete", "examined": { "unit": "manifests", "count": 1 }, "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "manifests_scanned": [ "package-lock.json" ] }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 6.617287368979305, "status": "complete", "examined": null, "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "manifests_scanned": [], "finding_id_aliases": {}, "cross_scanner_correlation": { "only_osv": [], "only_trivy": [], "intersection_ids": [] } }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "trivy_image", "scanner_version": "0.71.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 3.391999052837491e-05, "status": "not_applicable", "examined": { "unit": "image_targets", "count": 0 }, "metadata": { "reason": "no OCI image acquired for this artifact" }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "govulncheck", "scanner_version": "v1.6.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.06762446399079636, "status": "not_applicable", "examined": { "unit": "modules", "count": 0 }, "metadata": { "source": "go-module-proxy", "source_url": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck", "report_type": "go-reachability", "vendor_mode": false, "go_mod_present": false, "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install golang.org/x/vuln/cmd/govulncheck@v1.6.0 # golang.org/x/vuln v1.6.0 h1:FeMO9Rm/HwyduOztbvKcOw+zvDEPr4I4aQNSfevFcKY=", "offline_db_path": "/opt/govulncheck-db", "environment_note": "govulncheck found no go.mod, so this tree declares no Go module and no Go dependencies; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute" }, "display_score": null, "display_badge": "not_applicable" } ] ```