https://github.com/36412749-collab/routara-mcp

routara-mcp

Caution

Score 71 / 100 · 33 files read · 0 critical, 0 high, 3 medium, 9 low findings

Report 9a2680e36c003cc4 · first scanned 2026-10-28 · scanned 3× · keyed to the exact package contents, so this link always shows this version

Listed in the Agent Census directory data

Subscores

credentials84

exfiltration92

execution84

injection100

obfuscation98

files100

100 is clean. Deductions come only from the cited findings below.

Findings

mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions

(package) · line 1 · rule M3

static.modelcontextprotocol.io

mediumCan run shell commands from code

scripts/verify-release.mjs · line 2 · rule M1

spawn } from 'node:child_process'; import { createInterface } from 'node:readline'; import { once } from 'node:events'; import {

mediumCan run shell commands from code

src/test/handshake.test.ts · line 2 · rule M1

spawn } from 'node:child_process'; import { once } from 'node:events'; import { createInterface } from 'node:readline'; import {

low4 binary file(s) were not parsed (static text analysis only)

(package) · line 1 · rule L3

4 binary files

lowReads named environment variables (normal for API keys; listed in the permission summary)

examples/openai-sdk-migration/javascript/first_request.mjs · line 4 · rule L1

i'; const apiKey = process.env.ROUTARA_API_KEY?.trim(); if (!apiKey) { console.error('Set ROUTARA_API_KEY before running this e

lowReads named environment variables (normal for API keys; listed in the permission summary)

examples/openai-sdk-migration/python/first_request.py · line 10 · rule L1

int: api_key = os.environ.get("ROUTARA_API_KEY", "").strip() if not api_key: print("Set ROUTARA_API_KEY before ru

lowReads named environment variables (normal for API keys; listed in the permission summary)

scripts/live-smoke.mjs · line 8 · rule L1

i.js'; const key = process.env.ROUTARA_API_KEY?.trim(); if (!key) { console.error('Set ROUTARA_API_KEY'); process.exit(1); }

lowReads named environment variables (normal for API keys; listed in the permission summary)

scripts/prod-smoke.sh · line 17 · rule L1

int(hashlib.sha256((os.environ['API_KEY_PEPPER']+os.environ['PROBE_SECRET']).encode()).hexdigest())") USER_ID=usr_8cb89280 KID=key

lowReads named environment variables (normal for API keys; listed in the permission summary)

scripts/verify-release.mjs · line 37 · rule L1

environment = { ...process.env }; delete environment.ROUTARA_API_KEY; child = spawn(process.execPath, [join(stage, entry)], {

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/api.ts · line 64 · rule L1

= (opts.baseUrl ?? process.env.ROUTARA_API_BASE ?? DEFAULT_BASE).replace(/\/$/, ''); this.timeoutMs = opts.timeoutMs ?? posit

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/test/handshake.test.ts · line 29 · rule L1

const env = { ...process.env }; delete env.ROUTARA_API_KEY; return env; })(), stdio: ['pipe', 'pipe', 'pipe

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/test/smoke.test.ts · line 14 · rule L1

=> { const prev = process.env.ROUTARA_API_KEY; delete process.env.ROUTARA_API_KEY; try { assert.throws(() => resolveApiK

Permission surface

Network endpoints: api.routara.aigithub.comglama.aiimg.shields.iomcp.somodelcontextprotocol.ioopencollective.comregistry.modelcontextprotocol.ioregistry.npmjs.orgroutara.aischema.getpostman.comsmithery.aistatic.modelcontextprotocol.iowww.npmjs.comwww.pulsemcp.com
Environment read: API_KEY_PEPPERPROBE_SECRETROUTARA_API_BASEROUTARA_API_KEYROUTARA_API_TIMEOUT_MSROUTARA_MODEL
Shell execution: yes — code or scripts can run shell commands
Install hooks: none
Credential material: Reads named environment variables (normal for API keys; listed in the permission summary)

Provenance

Source: GitHub
Repository: 36412749-collab/routara-mcp
Owner: 36412749-collab
Stars: 1
Forks: 0
Repo created: 2026-06-22
Last push: 2026-10-14
License: MIT

Badge for the author

[![Preflight: Caution](https://preflight.orbitaldeskllc.com/badge/9a2680e36c003cc4.svg)](https://preflight.orbitaldeskllc.com/b/9a2680e36c003cc4)

The badge links back to this report and updates if the package is re-scanned at a new version.

Watch this package

Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.

Share this report: https://preflight.orbitaldeskllc.com/r/9a2680e36c003cc4