registry / @groundtruth-mcp/gt-mcp / 8.0.0

@groundtruth-mcp/gt-mcp@8.0.0

Enterprise-grade MCP server for live docs, best practices, code audit. Context7 alternative — 793+ libraries, evidence-verified answers (never generic), smart dispatch (use gt mcp), plain-text intent routing, telemetry, SSRF-hardened multi-source fetcher,

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Source inspection found an install-time local ID file consistent with the package's watermarking function, with no observed exfiltration or attack behavior. The scanner's obfuscation and network hints do not establish malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Package installation runs the postinstall hook; page-fetch behavior is invoked by the application.

Impact

A local identifier file is created; no harmful effect was established from the inspected source.

Mechanism

The hook reads or writes a small key file in the user's home directory. The inspected source showed no network transmission of that ID.

AI rationale

Evidence

~/.gt-mcp-install.key

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json runs postinstall.mjs during installation.
postinstall.mjs creates or reuses a small local install ID in the user's home directory and does not send it over the network.
The required deep-fetch-pages.js source imports fetch helpers and handles same-origin page links; inspected code did not establish an attack.

Evidence against

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 153 file(s), 1.62 MB of source, external domains: 10play.github.io, a2a-protocol.org, actix.rs, adk.dev, ai-sdk.dev, ai.google.dev, airflow.apache.org, ajv.js.org, alamofire.github.io, alembic.sqlalchemy.org, alpinejs.dev, amqp-node.github.io, angular.dev, animejs.com, ant.design, api.jquery.com, appandflow.github.io, appwrite.io, argo-cd.readthedocs.io, ariakit.com, arktype.io, arrow.apache.org, aspire.dev, auth.pilcrowonpaper.com, authjs.dev, auto-animate.formkit.com, axiom.co, axios.rest, babeljs.io, bandit.readthedocs.io, base-ui.com, better-auth.com, bevy.org, biomejs.dev, black.readthedocs.io, bun.sh, caddyserver.com, capacitorjs.com, changesets.dev, cheatsheetseries.owasp.org, cheerio.js.org, clang.llvm.org, clerk.com, click.palletsprojects.com, clickhouse.com, cloud.google.com, cmake.org, cobra.dev, code.claude.com, codemirror.net

Source & flagged code

4 flagged

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

1#!/usr/bin/env node L2: function a8_0x4706(_0x30b0a5,_0x2cd6d4){_0x30b0a5=_0x30b0a5-0x141;const _0x4706e9=a8_0x2cd6();let _0x3093b4=_0x4706e9[_0x30b0a5];if(a8_0x4706['uULcCe']===undefined){var _0x3ce744=f...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

dist/services/deep-fetch-pages.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/services/deep-fetch-pages.js#virtual:normalized:round1View on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

Findings

2 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limiteddist/services/deep-fetch-pages.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @groundtruth-mcp/gt-mcp@8.0.0.

See all versions of @groundtruth-mcp/gt-mcp for other recorded verdicts.

Review the evidence and your use of @groundtruth-mcp/gt-mcp@8.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 22:36:14.818Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code