{"id":"6cae91a88885","status":"done","kind":"auto","source":"npm","target":"npm:@faapi/mcp","name":"@faapi/mcp","version":"7.6.0","verdict":"COULD NOT RUN","top_finding":null,"findings":1,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-25T19:18:28.944191Z","finished_at":"2026-10-25T19:18:44.999726Z","report_url":"https://detonationlabs.com/r/6cae91a88885","progress":[{"phase":"mcp","label":"baseline","status":"ok","duration":2.1,"new":["ownread:~/.npmrc","write:~/.npm/_logs/*-debug-0.log"],"findings":[],"note":"server did not complete the handshake: no response; 0 tool calls"},{"phase":"mcp","label":"time-travel","status":"ok","duration":2.0,"new":[],"findings":[],"note":"server did not complete the handshake: no response; 0 tool calls"},{"phase":"mcp","label":"ci-github","status":"ok","duration":2.0,"new":[],"findings":[],"note":"server did not complete the handshake: no response; 0 tool calls"}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-25T19:18:44Z","target":{"name":"@faapi/mcp","sha256":"9fcc42c32cfc440c5cec9565e755a93f5f28c484593273962456a77139c834da","files":7,"scripts":["dist/index.js"],"declared":{},"trigger_hints":[],"source":"npm:@faapi/mcp@7.6.0","command":"node skill/node_modules/@faapi/mcp/./dist/index.js","kind":"mcp","version":"7.6.0"},"verdict":"COULD NOT RUN","observed":{"network":[],"files_written":["~/.npm/_logs/*-debug-0.log"],"secrets_read":[],"commands":[],"exfiltration":[]},"findings":[{"rule":"secret-read-by-owner","severity":"low","title":"A tool read its own credentials (e.g. gh, aws, ssh)","evidence":["~/.npmrc (by npm)"],"run_label":"mcp:baseline","confidence":"Info","confidence_reason":"A tool opened its own login or config file, such as npm reading ~/.npmrc.","why":"Normal: that is how the tool works. Listed so nothing is hidden.","technique":"","description":"A tool opened its own configuration or login file, such as npm reading ~/.npmrc or gh reading its hosts file.","impact":"None in itself: this is how those tools work. Listed so the report shows every credential access.","remediation":"No action needed.","references":[]}],"exploration":{"runs":[{"phase":"mcp","target":"@faapi/mcp","label":"baseline","status":"ok","duration":2.136,"new_signatures":["ownread:~/.npmrc","write:~/.npm/_logs/*-debug-0.log"],"findings":1,"note":"server did not complete the handshake: no response; 0 tool calls","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c export npm_config_update_notifier=false npm_config_audit=...","flag":"","children":[{"kind":"proc","label":"npm rebuild --offline --foreground-scripts --no-audit --no-fund","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm rebuild --offline --foreground-scripts --no-audit","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c node skill/node_modules/@faapi/mcp/./dist/index.js","flag":"","children":[{"kind":"proc","label":"node skill/node_modules/@faapi/mcp/./dist/index.js","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"mcp","target":"@faapi/mcp","label":"time-travel","status":"ok","duration":2.04,"new_signatures":[],"findings":0,"note":"server did not complete the handshake: no response; 0 tool calls","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c export npm_config_update_notifier=false npm_config_audit=...","flag":"","children":[{"kind":"proc","label":"npm rebuild --offline --foreground-scripts --no-audit --no-fund","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm rebuild --offline --foreground-scripts --no-audit","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c node skill/node_modules/@faapi/mcp/./dist/index.js","flag":"","children":[{"kind":"proc","label":"node skill/node_modules/@faapi/mcp/./dist/index.js","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"mcp","target":"@faapi/mcp","label":"ci-github","status":"ok","duration":1.99,"new_signatures":[],"findings":0,"note":"server did not complete the handshake: no response; 0 tool calls","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c export npm_config_update_notifier=false npm_config_audit=...","flag":"","children":[{"kind":"proc","label":"npm rebuild --offline --foreground-scripts --no-audit --no-fund","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm rebuild --offline --foreground-scripts --no-audit","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c node skill/node_modules/@faapi/mcp/./dist/index.js","flag":"","children":[{"kind":"proc","label":"node skill/node_modules/@faapi/mcp/./dist/index.js","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}}],"stopped":"mcp: coverage plateau (2 runs with no new behavior)","model_usage":{"prompt_tokens":0,"completion_tokens":0,"llm_runs":0}},"surface":{},"note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We could not start this server, so none of its behavior was tested.","recommendation":{"action":"Review","text":"We could not start it, so nothing was tested. Treat it as unverified."},"iocs":{"hosts":[],"ips":[],"sha256":"9fcc42c32cfc440c5cec9565e755a93f5f28c484593273962456a77139c834da","benign_hosts":[]},"coverage":{"runs":3,"phases":["mcp"],"environments":["baseline","time-travel","ci-github"],"tool_calls":0,"model_runs":0,"stopped":"mcp: coverage plateau (2 runs with no new behavior)"},"tree":{"run":"mcp:baseline","roots":[{"kind":"proc","label":"bash -c export npm_config_update_notifier=false npm_config_audit=...","flag":"","children":[{"kind":"proc","label":"npm rebuild --offline --foreground-scripts --no-audit --no-fund","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm rebuild --offline --foreground-scripts --no-audit","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c node skill/node_modules/@faapi/mcp/./dist/index.js","flag":"","children":[{"kind":"proc","label":"node skill/node_modules/@faapi/mcp/./dist/index.js","flag":"","children":[],"hot":false}],"hot":false}],"preview":[],"truncated":0},"flow":{"package":{"name":"@faapi/mcp","version":"7.6.0","files":7,"kind":"mcp"},"install":[],"has_install":true,"run":["node ./dist/index.js"],"tools":[],"tool_calls":0,"agent_runs":0,"network":[],"secrets":[{"path":"~/.npmrc","own":true,"when":"during install","leaked":false}],"files":[],"has_graph":true},"confidence":""}}