https://github.com/ANAMIZED/YodMCP

YodMCP

Caution

Score 85 / 100 · 80 files read · 0 critical, 0 high, 1 medium, 19 low findings

Report 6b58bbfcea84eca5 · first scanned 2026-10-28 · scanned 3× · keyed to the exact package contents, so this link always shows this version

Listed in the Agent Census directory data

Subscores

credentials64

exfiltration92

execution100

injection100

obfuscation98

files100

100 is clean. Deductions come only from the cited findings below.

Findings

mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions

(package) · line 1 · rule M3

static.modelcontextprotocol.io

low1 binary file(s) were not parsed (static text analysis only)

(package) · line 1 · rule L3

1 binary files

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/core/substrate.py · line 31 · rule L1

= memory_backend or os.environ.get("YODMCP_MEMORY_BACKEND", "memory") db_path = memory_db_path or os.environ.get("YODMCP_MEMOR

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/core/tenant.py · line 25 · rule L1

return t return os.environ.get("YODMCP_TENANT_ID", "default") or "default" def set_request_id(rid: str) -> None: _reques

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/monetization/billing.py · line 50 · rule L1

t_id = tenant_id or os.environ.get("YODMCP_TENANT_ID", "default") self.plan = get_plan(plan_id) self.meter = meter

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/monetization/entitlements.py · line 36 · rule L1

path or os.environ.get("YODMCP_SYSTEM_DB") or os.environ.get("YODMCP_MEMORY_DB", "./data/yodmcp_system.db"

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/monetization/metering.py · line 53 · rule L1

ckend = (backend or os.environ.get("YODMCP_METER_BACKEND", "memory")).lower() self._db_path = str( db_path

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/monetization/plans.py · line 99 · rule L1

pid = plan_id or os.environ.get("YODMCP_PLAN", "free") return PLANS.get(pid, PLANS["free"])

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/observability/audit.py · line 61 · rule L1

e Path( os.environ.get("YODMCP_AUDIT_LOG", "/tmp/yodmcp_audit.jsonl") ) self._path.parent.mkdir(parent

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/observability/logging.py · line 35 · rule L1

json.""" fmt = (os.environ.get("YODMCP_LOG_FORMAT") or "text").lower() log_level = getattr(logging, (level or os.environ.g

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/observability/otel.py · line 27 · rule L1

yment.environment": os.environ.get("YODMCP_ENV", "dev"), } ) provider = TracerProvider(resource=resource) # C

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/security/attestation.py · line 53 · rule L1

_secret = secret or os.environ.get("YODMCP_ATTEST_SECRET", "yodmcp-dev-secret").encode() @property def mode(self) -> str:

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/security/auth.py · line 24 · rule L1

set[str]: raw = os.environ.get("YODMCP_API_KEYS") or os.environ.get("YODMCP_API_KEY") or "" return {k.strip() for k in raw

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/security/hitl.py · line 42 · rule L1

ttl_seconds or int(os.environ.get("YODMCP_HITL_TTL_SECONDS", "3600")) self.fail_closed = os.environ.get("YODMCP_HITL_FAIL

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/security/policy.py · line 70 · rule L1

global_allow = os.environ.get("YODMCP_TOOL_ALLOWLIST", "") if global_allow.strip(): self._global_allow =

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/security/rate_limit.py · line 33 · rule L1

s_per_minute or int(os.environ.get("YODMCP_RATE_LIMIT_RPM", "120")) self.exempt = exempt_paths or {"/health", "/ready", "/

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/security/validation.py · line 11 · rule L1

return int(os.environ.get(name, str(default))) except ValueError: return default MAX_MEMORY_CONTENT = _int_

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/skills/registry.py · line 134 · rule L1

ath] = [] env = os.environ.get("YODMCP_SKILLS_DIR") if env: roots.append(Path(env)) roots.append(Path.cwd() /

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/yodmcp/tasks/manager.py · line 71 · rule L1

ckend = (backend or os.environ.get("YODMCP_TASKS_BACKEND", "memory")).lower() self._db_path = str( db_path

lowReads named environment variables (normal for API keys; listed in the permission summary)

tests/test_production_auth_durable.py · line 15 · rule L1

h / "system.db" os.environ["YODMCP_SYSTEM_DB"] = str(db) os.environ["YODMCP_TASKS_BACKEND"] = "sqlite" os.environ["YOD

Permission surface

Network endpoints: anamized.grok.mebasescan.orgbuy.stripe.comdonate.stripe.cometherscan.iogithub.comglama.aiimg.shields.iomodelcontextprotocol.iopypi.orgsolscan.iostatic.modelcontextprotocol.iowww.python.org
Environment read: NITRO_ENCLAVEOTEL_EXPORTER_OTLP_ENDPOINTSGX_ENCLAVESTRIPE_SECRET_KEYSTRIPE_WEBHOOK_SECRETYODMCP_API_KEYYODMCP_API_KEYSYODMCP_ATTEST_MODEYODMCP_ATTEST_SECRETYODMCP_AUDIT_BACKENDYODMCP_AUDIT_LOGYODMCP_ENVYODMCP_HITL_FAIL_CLOSEDYODMCP_HITL_TTL_SECONDSYODMCP_LOG_FORMATYODMCP_LOG_LEVELYODMCP_MEMORY_BACKENDYODMCP_MEMORY_DBYODMCP_METER_BACKENDYODMCP_OTEL_CONSOLEYODMCP_PLANYODMCP_RATE_LIMIT_RPMYODMCP_SKILLS_DIRYODMCP_STRIPE_ENABLEDYODMCP_SYSTEM_DBYODMCP_TASKS_BACKENDYODMCP_TEE_KEY_PEMYODMCP_TENANT_IDYODMCP_TOOL_ALLOWLIST
Shell execution: yes — code or scripts can run shell commands
Install hooks: none
Credential material: Reads named environment variables (normal for API keys; listed in the permission summary)

Provenance

Source: GitHub
Repository: ANAMIZED/YodMCP
Owner: ANAMIZED
Stars: 1
Forks: 0
Repo created: 2026-08-18
Last push: 2026-08-27
License: NOASSERTION

Badge for the author

[![Preflight: Caution](https://preflight.orbitaldeskllc.com/badge/6b58bbfcea84eca5.svg)](https://preflight.orbitaldeskllc.com/b/6b58bbfcea84eca5)

The badge links back to this report and updates if the package is re-scanned at a new version.

Watch this package

Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.

Share this report: https://preflight.orbitaldeskllc.com/r/6b58bbfcea84eca5